Function at 0x401630
Capabilities:
Execute command
Execute shellcode via indirect call
Move file
Set console window title
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4040ce
mov eax, dword fs:[0]
push eax
sub esp, 0xb8
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0xb0], eax
push ebx
push esi
push edi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0xc8]
mov dword fs:[0], eax
xor ebx, ebx
push 0x40528c
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push ebx
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
mov dword [esp + 0xb8], 0xf
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
mov dword [esp + 0xd0], ebx
lea edi, [ebx + 0xa]
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 6
idiv ecx
lea esi, [esp + 0xa4]
mov bl, byte [edx + 0x405311]
call fcn.00401c50
dec edi
jne 0x4016b8
mov dword [esp + 0x44], edi
mov edi, 0x21
lea esi, [esp + 0x34]
mov dword [esp + 0x48], 0xf
mov byte [esp + 0x34], 0
call fcn.00402e20
lea edx, [esp + 0xa4]
push edx
lea eax, [esp + 0x8c]
push eax
mov byte [esp + 0xd8], 1
call fcn.00403200
push eax
mov eax, 0x405414
lea ecx, [esp + 0x78]
mov byte [esp + 0xdc], 2
call fcn.004032c0
add esp, 0xc
push eax
mov eax, str.mnth
lea ecx, [esp + 0x54]
mov byte [esp + 0xd4], 3
call fcn.004032c0
add esp, 4
mov ebx, dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov edi, 0x10
cmp dword [esp + 0x80], edi
jb 0x401769
mov ecx, dword [esp + 0x6c]
push ecx
call ebx
add esp, 4
mov esi, 0xf
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], 0
mov byte [esp + 0x6c], 0
mov byte [esp + 0xd0], 6
cmp dword [esp + 0x9c], edi
jb 0x4017a0
mov edx, dword [esp + 0x88]
push edx
call ebx
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], 0
mov byte [esp + 0x88], 0
cmp dword [esp + 0x64], edi
jae 0x4017c8
lea ecx, [esp + 0x50]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x4017d6
lea eax, [esp + 0x34]
mov esi, dword [sym.imp.MSVCR100.dll_rename]
push ecx
push eax
call esi
mov ecx, dword [esp + 0x58]
add esp, 8
cmp dword [esp + 0x64], edi
jae 0x4017f1
lea ecx, [esp + 0x50]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x4017ff
lea eax, [esp + 0x34]
push ecx
push eax
call esi
mov ecx, dword [esp + 0x58]
add esp, 8
cmp dword [esp + 0x64], edi
jae 0x401814
lea ecx, [esp + 0x50]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x401822
lea eax, [esp + 0x34]
push ecx
push eax
call esi
mov ecx, dword [esp + 0x58]
add esp, 8
cmp dword [esp + 0x64], edi
jae 0x401837
lea ecx, [esp + 0x50]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], edi
jae 0x401845
lea eax, [esp + 0x34]
push ecx
push eax
call esi
mov esi, dword [sym.imp.MSVCR100.dll_system]
push str.Color_A
call esi
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 0xc
push eax
push ecx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push 0x40545c
push ecx
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call edi
push str.Color_B
call esi
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push edx
push ecx
push str.
push eax
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x1f4
call edi
push str.Color_C
call esi
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push ecx
push ecx
push str.www.gembelcit.net
push edx
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x1f4
call edi
push str.Color_D
call esi
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
add esp, 4
push eax
push ecx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push str.
push ecx
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0x1f4
call edi
push str.Color_E
call esi
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
push edx
push ecx
push 0x40545c
push eax
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
push ecx
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push edx
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
push ecx
push str.e_0m
push ecx
push str.Start_PB
push ecx
push str.e_32m
push edx
call fcn.00401090
add esp, 0xc
push eax
call fcn.00401090
add esp, 0xc
push eax
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
lea ecx, [ecx]
push str.Point_Blank
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401b3c
lea ecx, [esp + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push str.RtlGetFullPathName_U
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x1c]
push edx
push 0
push 0x1fffff
mov esi, eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x40927c
push 0x40
push 5
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, 0x409850
sub eax, esi
mov ebx, esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 5
jmp 0x401a4a
mov eax, dword [esp + 0x20]
push 0
push 1
add eax, ebx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
inc ebx
dec dword [esp + 0x14]
jne 0x401a46
push 0
push 5
push 0x4053f4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
sub esp, 0x1c
mov ecx, esp
lea eax, [esp + 0x6c]
mov dword [esp + 0x30], esp
push eax
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
or eax, 0xffffffff
xor ebx, ebx
mov byte [ecx], 0
call fcn.004029a0
mov ecx, dword [esp + 0x38]
call fcn.004013f0
add esp, 0x1c
test al, al
je 0x401b3c
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
push ecx
push str.e_0m
push ecx
push str.Sukses
push ecx
push str.e_36m
push edx
call fcn.00401090
add esp, 0xc
push eax
call fcn.00401090
add esp, 0xc
push eax
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov ebx, esi
mov dword [esp + 0x14], 5
lea ebx, [ebx]
mov eax, dword [esp + 0x20]
push 0
push 1
add eax, ebx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
inc ebx
dec dword [esp + 0x14]
jne 0x401b00
mov ecx, dword [0x40927c]
push 0x40927c
push ecx
push 5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov dword [0x409858], 1
jmp 0x401b45
cmp dword [0x409858], 1
jne 0x401b92
mov ecx, 0x85
xor eax, eax
lea esp, [esp]
mov dl, byte [eax + 0x4053d0]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x24], dl
jns 0x401b6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x401b50
or dword [esp + 0x18], 1
lea eax, [esp + 0x24]
push eax
push 0
mov byte [esp + 0x37], 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401b92
mov cl, 1
jmp 0x401b94
xor cl, cl
test byte [esp + 0x18], 1
je 0x401bae
and dword [esp + 0x18], 0xfffffffe
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
test cl, cl
je 0x4019d0
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2a
xor eax, eax
jmp 0x401bd0
mov dl, byte [eax + 0x4053fc]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [esp + eax + 0x24], dl
jns 0x401bed
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x401bd0
lea eax, [esp + 0x24]
push eax
mov byte [esp + 0x36], 0
call fcn.00401320
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]