Function at 0x40c080
Capabilities:
Create thread
Get common file path
Get file size
Read file on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x48ecee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x344
mov eax, dword [0x4afd08]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x150]
mov dword [esp + 0x35c], 0
call fcn.00419b20
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x35c], 1
push ecx
push 0x104
mov dword [esp + 0x20], 0x50
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, str._setting.ini
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x4c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push str.BKIIS
push str.FLAG
lea ecx, [esp + 0x15c]
call fcn.00419b90
test eax, eax
je 0x40c1b0
mov ecx, dword [ebx + 0x1e4]
push 0
push 0
push 0x1004
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
mov esi, eax
push 0
lea edi, [ebx + 0x1c8]
push 0x4aee74
push esi
push 1
mov ecx, edi
call fcn.0047b2ce
push 0x4aee6c
push 1
push esi
mov ecx, edi
call fcn.0047b39e
call fcn.0048150a
test eax, eax
je 0x40c199
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c19b
xor eax, eax
push 0
lea ecx, [esp + 0x1c]
push 4
push ecx
push 0x22200c
mov ecx, eax
call fcn.00406050
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x150]
push edx
push 0x4aee68
push 0x4aee64
call fcn.00419b90
test eax, eax
mov dword [ebx + 0x240], eax
je 0x40c1dc
mov ecx, ebx
call fcn.0040bf70
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.BIND
push 0x4aee64
call fcn.00419b90
test eax, eax
je 0x40c2bc
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x2d]
mov byte [esp + 0x2c], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x4c]
stosw word es:[edi], ax
push ecx
push str.LOCALIP
push 0x4aee64
lea ecx, [esp + 0x15c]
stosb byte es:[edi], al
call fcn.00419bb0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x2c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x3f
lea edi, [esp + 0x255]
mov byte [esp + 0x254], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x254]
stosb byte es:[edi], al
push ecx
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
call fcn.00419870
lea edi, [esp + 0x254]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebx + 0x14c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [str.Key.dat]
mov edx, dword [0x4aee4c]
mov al, byte [0x4aee50]
push 0
push 0
push 3
mov dword [esp + 0x2c], ecx
push 0
push 0
lea ecx, [esp + 0x34]
push 0x80000000
push ecx
mov dword [esp + 0x40], edx
mov byte [esp + 0x44], al
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40c32a
call fcn.0048150a
test eax, eax
je 0x40c319
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov dword [eax + 0x2a50], 1
jmp 0x40cbee
xor eax, eax
mov dword [eax + 0x2a50], 1
jmp 0x40cbee
call fcn.0048150a
test eax, eax
je 0x40c33c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c33e
xor eax, eax
push 0
push ebp
mov dword [eax + 0x2a50], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + 1]
push eax
call fcn.00480d9f
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [esp + 0x14]
mov byte [edx + esi + 1], 0
mov eax, dword [esp + 0x14]
cmp eax, 0x3c
jae 0x40c38a
push 0
call fcn.004244ab
call fcn.0048150a
test eax, eax
je 0x40c39e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov edx, eax
jmp 0x40c3a0
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [edx + 0x2a5c]
rep stosd dword es:[edi], eax
call fcn.0048150a
test eax, eax
je 0x40c3c3
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov edx, eax
jmp 0x40c3c5
xor edx, edx
mov ecx, 0x40
xor eax, eax
lea edi, [edx + 0x2b5c]
rep stosd dword es:[edi], eax
call fcn.0048150a
test eax, eax
je 0x40c3e6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c3e8
xor eax, eax
push 0x20
add eax, 0x2a5c
push esi
push eax
call fcn.0040b950
add esp, 0xc
call fcn.0048150a
xor edi, edi
cmp eax, edi
je 0x40c40d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c40f
xor eax, eax
lea ecx, [esi + 0x20]
push 0x20
add eax, 0x2b5c
push ecx
push eax
call fcn.0040b950
add esp, 0xc
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00480dc8
add esp, 4
push edi
push edi
push ebx
push 0x40b8f0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x14
call fcn.00480d9f
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x35c], 2
je 0x40c471
mov ebp, 1
mov ecx, eax
push ebp
push 0x4070e0
call fcn.00418860
jmp 0x40c478
xor eax, eax
mov ebp, 1
mov ecx, eax
mov byte [esp + 0x35c], 1
mov dword [ebx + 0xe0], eax
call fcn.004188b0
mov ecx, dword [ebx + 0xe0]
push 0x2a24
call fcn.004188d0
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x150]
push edx
push str.FLAG
push str.FLAG
call fcn.00419b90
mov esi, eax
cmp esi, edi
je 0x40c67e
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.PORT
push str.SYSPORT
mov dword [ebx + 0x244], ebp
call fcn.00419b90
dec esi
mov dword [ebx + 0x260], eax
je 0x40c602
dec esi
je 0x40c591
dec esi
je 0x40c520
call fcn.0048150a
cmp eax, edi
je 0x40c514
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aee24
jmp 0x40c665
xor eax, eax
push 0x4aee24
jmp 0x40c665
push 0x4aee10
push 0x3ff
mov ecx, ebx
call fcn.00480a2f
push 0x14
call fcn.00480d9f
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x35c], 5
je 0x40c55b
push 3
push 0x407180
mov ecx, eax
call fcn.00418860
jmp 0x40c55d
xor eax, eax
mov byte [esp + 0x35c], 1
mov dword [ebx + 0xdc], eax
call fcn.0048150a
cmp eax, edi
je 0x40c585
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aedf8
jmp 0x40c665
xor eax, eax
push 0x4aedf8
jmp 0x40c665
push 0x4aede4
push 0x3ff
mov ecx, ebx
mov dword [ebx + 0x148], ebp
call fcn.00480a2f
push 0x14
call fcn.00480d9f
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x35c], 4
je 0x40c5d2
push 2
push 0x4072e0
mov ecx, eax
call fcn.00418860
jmp 0x40c5d4
xor eax, eax
mov byte [esp + 0x35c], 1
mov dword [ebx + 0xdc], eax
call fcn.0048150a
cmp eax, edi
je 0x40c5f9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aedcc
jmp 0x40c665
xor eax, eax
push 0x4aedcc
jmp 0x40c665
push 0x4aedb4
push 0x3ff
mov ecx, ebx
call fcn.00480a2f
push 0x14
call fcn.00480d9f
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov byte [esp + 0x35c], 3
je 0x40c63c
push edi
push 0x407220
mov ecx, eax
call fcn.00418860
jmp 0x40c63e
xor eax, eax
mov byte [esp + 0x35c], 1
mov dword [ebx + 0xdc], eax
call fcn.0048150a
cmp eax, edi
je 0x40c65e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c660
xor eax, eax
push 0x4aed98
lea ecx, [eax + 0x1f4]
call fcn.00404040
mov eax, dword [ebx + 0x260]
mov ecx, ebx
push eax
call fcn.0040d720
lea ecx, [esp + 0x4c]
push ecx
push str.JHATK
push str.FLAG
lea ecx, [esp + 0x15c]
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x26c], eax
je 0x40c6df
call fcn.0048150a
cmp eax, edi
je 0x40c6b5
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c6b7
xor eax, eax
push ebp
mov ecx, eax
call fcn.0040b810
call fcn.0048150a
cmp eax, edi
je 0x40c6d6
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aed78
jmp 0x40c714
xor eax, eax
push 0x4aed78
jmp 0x40c714
call fcn.0048150a
cmp eax, edi
je 0x40c6f1
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c6f3
xor eax, eax
push edi
mov ecx, eax
call fcn.0040b810
call fcn.0048150a
cmp eax, edi
je 0x40c70d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c70f
xor eax, eax
push 0x4aed60
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.CUSUM
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x268], eax
je 0x40c787
call fcn.0048150a
cmp eax, edi
je 0x40c756
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c758
xor eax, eax
push edi
push edi
push edi
push 0x22203c
mov ecx, eax
call fcn.00406050
call fcn.0048150a
cmp eax, edi
je 0x40c77e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aed44
jmp 0x40c7c3
xor eax, eax
push 0x4aed44
jmp 0x40c7c3
call fcn.0048150a
cmp eax, edi
je 0x40c799
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c79b
xor eax, eax
push edi
push edi
push edi
push 0x222040
mov ecx, eax
call fcn.00406050
call fcn.0048150a
cmp eax, edi
je 0x40c7bc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c7be
xor eax, eax
push 0x4aed30
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push 0x4aed2c
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x248], eax
je 0x40c82d
call fcn.0048150a
cmp eax, edi
je 0x40c805
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c807
xor eax, eax
mov dword [eax + 0x29e8], ebp
call fcn.0048150a
cmp eax, edi
je 0x40c824
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aecf4
jmp 0x40c860
xor eax, eax
push 0x4aecf4
jmp 0x40c860
call fcn.0048150a
cmp eax, edi
je 0x40c83f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c841
xor eax, eax
mov dword [eax + 0x29e8], edi
call fcn.0048150a
cmp eax, edi
je 0x40c859
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c85b
xor eax, eax
push 0x4aecc0
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.RANDPORT
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x258], eax
je 0x40c8d0
call fcn.0048150a
cmp eax, edi
je 0x40c8a2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c8a4
xor eax, eax
mov dword [eax + 0x2a08], ebp
call fcn.0048150a
cmp eax, edi
je 0x40c8c4
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aec9c
jmp 0x40c97d
xor eax, eax
push 0x4aec9c
jmp 0x40c97d
push 4
push 0x4ac220
push 0x4aec00
mov ecx, ebx
call fcn.0047f043
cmp eax, 7
jne 0x40c94a
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push ebp
push str.RANDPORT
push str.FLAG
call fcn.00419c30
call fcn.0048150a
cmp eax, edi
je 0x40c916
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c918
xor eax, eax
mov dword [eax + 0x2a08], ebp
call fcn.0048150a
cmp eax, edi
je 0x40c930
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c932
xor eax, eax
push 0x4aec9c
lea ecx, [eax + 0x1f4]
call fcn.00404040
mov dword [ebx + 0x258], ebp
jmp 0x40c988
call fcn.0048150a
cmp eax, edi
je 0x40c95c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c95e
xor eax, eax
mov dword [eax + 0x2a08], edi
call fcn.0048150a
cmp eax, edi
je 0x40c976
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c978
xor eax, eax
push 0x4aebe8
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.PTPORT
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x25c], eax
je 0x40c9e7
call fcn.0048150a
cmp eax, edi
je 0x40c9bf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c9c1
xor eax, eax
mov dword [eax + 0x29ec], ebp
call fcn.0048150a
cmp eax, edi
je 0x40c9de
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aebc4
jmp 0x40ca1a
xor eax, eax
push 0x4aebc4
jmp 0x40ca1a
call fcn.0048150a
cmp eax, edi
je 0x40c9f9
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40c9fb
xor eax, eax
mov dword [eax + 0x29ec], edi
call fcn.0048150a
cmp eax, edi
je 0x40ca13
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ca15
xor eax, eax
push 0x4aeba8
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.BKDLW
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x24c], eax
je 0x40ca76
call fcn.0048150a
cmp eax, edi
je 0x40ca5c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ca5e
xor eax, eax
mov dword [eax + 0x29f8], ebp
call fcn.0048150a
cmp eax, edi
je 0x40caa2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40caa4
call fcn.0048150a
cmp eax, edi
je 0x40ca88
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40ca8a
xor eax, eax
mov dword [eax + 0x29f8], edi
call fcn.0048150a
cmp eax, edi
je 0x40caa2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40caa4
xor eax, eax
push 0x4aeb84
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.BKDX
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x250], eax
je 0x40cb13
call fcn.0048150a
cmp eax, edi
je 0x40caeb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40caed
xor eax, eax
mov dword [eax + 0x29fc], ebp
call fcn.0048150a
cmp eax, edi
je 0x40cb0a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aeb64
jmp 0x40cb46
xor eax, eax
push 0x4aeb64
jmp 0x40cb46
call fcn.0048150a
cmp eax, edi
je 0x40cb25
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40cb27
xor eax, eax
mov dword [eax + 0x29fc], edi
call fcn.0048150a
cmp eax, edi
je 0x40cb3f
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40cb41
xor eax, eax
push 0x4aeb4c
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x150]
push eax
push str.BKDX
push str.FLAG
call fcn.00419b90
cmp eax, edi
mov dword [ebx + 0x254], eax
je 0x40cbb0
call fcn.0048150a
cmp eax, edi
je 0x40cb88
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40cb8a
xor eax, eax
mov dword [eax + 0x2a00], ebp
call fcn.0048150a
cmp eax, edi
je 0x40cba7
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
push 0x4aeb34
jmp 0x40cbe3
xor eax, eax
push 0x4aeb34
jmp 0x40cbe3
call fcn.0048150a
cmp eax, edi
je 0x40cbc2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40cbc4
xor eax, eax
mov dword [eax + 0x2a00], edi
call fcn.0048150a
cmp eax, edi
je 0x40cbdc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
jmp 0x40cbde
xor eax, eax
push 0x4aeb1c
lea ecx, [eax + 0x1f4]
call fcn.00404040
lea ecx, [esp + 0x150]
mov byte [esp + 0x35c], 0
call fcn.00419b50
lea ecx, [esp + 0x1c]
mov dword [esp + 0x35c], 0xffffffff
call fcn.0048105e
mov ecx, dword [esp + 0x354]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x350
ret