Function at 0x406f90
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a710
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
cmp eax, 0x400
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], 0
jg 0x4073be
je 0x407395
cmp eax, 0x3ee
jg 0x407287
je 0x407280
cmp eax, 0x3e9
jg 0x407240
je 0x40720b
sub eax, 2
je 0x407079
sub eax, 0x3e6
jne case.0x407590.40006
push 2
mov ecx, 0x438300
call fcn.0040a830
mov dword [0x438350], eax
mov eax, dword [0x43867c]
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je case.0x407590.40006
mov al, byte [0x43880c]
test al, al
jne case.0x407590.40006
mov ecx, dword [ebp + 8]
push 0
push 0
push ecx
push 0x407710
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x438808], eax
jne case.0x407590.40006
lea edx, [ebp + 0xc]
lea ecx, [ebp - 0x20]
push edx
mov dword [ebp + 0xc], 0x4354d4
call fcn.0041e52d
lea eax, [ebp - 0x20]
push 0x431950
push eax
call fcn.0041e608
mov eax, dword [0x438660]
mov ecx, dword [0x438664]
cmp eax, ecx
je 0x4071d1
mov eax, dword [0x438704]
test eax, eax
jne 0x4071c7
mov ecx, dword [0x4387c4]
mov eax, dword [0x42c244]
mov ebx, ecx
cmp eax, ebx
jae 0x4070ac
mov ebx, eax
test ebx, ebx
jbe 0x407126
cmp ebx, ecx
jne 0x407126
mov eax, dword [0x4387c0]
test eax, eax
jne 0x4070c2
mov eax, 0x42c240
cmp byte [eax - 1], 0xfe
jae 0x407126
mov eax, dword [0x438700]
test eax, eax
je 0x4070ee
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x4070e5
cmp al, 0xff
je 0x4070e5
dec al
mov byte [ecx], al
jmp 0x4070ee
push ecx
call fcn.00410270
add esp, 4
mov eax, dword [0x4387c0]
test eax, eax
jne 0x4070fc
mov eax, 0x42c240
mov ecx, dword [0x4387c4]
mov edx, dword [0x4387c8]
mov dword [0x438700], eax
mov dword [0x438704], ecx
mov dword [0x438708], edx
mov cl, byte [eax - 1]
inc cl
mov byte [eax - 1], cl
jmp 0x4071c7
cmp ebx, 0xfffffffd
jbe 0x407130
call fcn.004105fd
mov edi, dword [0x438700]
test edi, edi
je 0x40715b
mov al, byte [edi - 1]
test al, al
je 0x40715b
cmp al, 0xff
je 0x40715b
test ebx, ebx
jne 0x407187
dec al
push ebx
mov ecx, 0x4386fc
mov byte [edi - 1], al
call fcn.00402d60
jmp 0x4071c7
test ebx, ebx
jne 0x40716d
push 1
mov ecx, 0x4386fc
call fcn.00402d60
jmp 0x4071c7
mov eax, dword [0x438708]
cmp eax, 0x1f
ja 0x40717b
cmp eax, ebx
jae 0x407198
push 1
mov ecx, 0x4386fc
call fcn.00402d60
push ebx
mov ecx, 0x4386fc
call fcn.00403f10
mov edi, dword [0x438700]
mov esi, dword [0x4387c0]
test esi, esi
jne 0x4071a7
mov esi, 0x42c240
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x438700]
mov dword [0x438704], ebx
mov byte [ecx + ebx], 0
mov ecx, 0x438640
call fcn.0040b380
mov edx, dword [0x438808]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x438638]
push eax
call esi
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push str.BIN_image__.bin_
lea edx, [ebp + 8]
push 0x43871c
push edx
mov ecx, 0x438468
call fcn.00405f90
mov ecx, 0x438640
call fcn.0040b980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x3ea
jne case.0x407590.40006
push 0
push str.BIN_image__.bin_
lea eax, [ebp + 8]
push 0x43872c
push eax
mov ecx, 0x438468
call fcn.004060d0
mov ecx, 0x438640
call fcn.0040b980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 1
jmp 0x4075d8
add eax, 0xfffffc0e
cmp eax, 0xd
ja case.0x407590.40006
xor edx, edx
mov dl, byte [eax + 0x4076e8]
jmp dword [edx*4 + 0x4076d4]
mov al, byte [0x43865a]
test al, al
je case.0x407590.40006
mov eax, dword [0x438740]
test eax, eax
jne 0x4072bf
mov eax, 0x42c240
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.0040cae0
mov eax, dword [eax + 4]
add esp, 8
test eax, eax
mov ecx, 0x42c240
je 0x4072da
mov ecx, eax
mov eax, dword [0x438740]
test eax, eax
jne 0x4072e8
mov eax, 0x42c240
push 5
push ecx
mov ecx, dword [ebp + 8]
push 0
push eax
push 0
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x2c]
test eax, eax
je case.0x407590.40006
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x407328
cmp al, 0xff
je 0x407328
dec al
mov byte [ecx], al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
call fcn.00410270
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 0x1000
push 0x4354c0
push 0x435974
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
push 0
push 0
push str.https:__vk.com_public183424781
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
push 0
push 0
push str.https:__mkt.ultimatecup.ru_
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x9c42
jg 0x407582
je 0x407468
cmp eax, 0x403
jg 0x40743c
je 0x407013
sub eax, 0x401
je 0x407413
dec eax
jne case.0x407590.40006
push 0xa
push 0
push 0
push str.https:__vk.me_join_AJQ1d__QFB9rNhJv1Bp_BLpV
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa
push 0
push 0
push str.https:__vk.com_club187374240
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x9c41
jne case.0x407590.40006
mov al, byte [0x43865c]
test al, al
je case.0x407590.40006
mov al, byte [0x43880c]
test al, al
jne case.0x407590.40006
push 3
jmp 0x4075d8
mov al, byte [0x43865b]
test al, al
je case.0x407590.40006
mov byte [0x43865a], 0
push 0
push 0x435274
lea ecx, [ebp + 8]
push 0x43873c
push ecx
mov ecx, 0x438468
call fcn.00405f90
test al, al
mov al, byte [0x43865b]
je 0x407562
test al, al
je 0x4074b1
mov ecx, 0x438640
call fcn.0040b380
mov edx, dword [0x438674]
mov al, 1
push 0x43541c
push edx
mov byte [0x43865a], al
mov byte [0x43865b], al
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, 0x438640
call fcn.0040b980
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x43865a]
test al, al
je 0x40747c
mov eax, dword [0x438740]
test eax, eax
jne 0x407501
mov eax, 0x42c240
lea edx, [ebp - 0x40]
push eax
push edx
call fcn.0040cae0
mov eax, dword [eax + 4]
add esp, 8
test eax, eax
mov ecx, 0x42c240
je 0x40751c
mov ecx, eax
mov eax, dword [0x438740]
test eax, eax
jne 0x40752a
mov eax, 0x42c240
push 5
push ecx
push 0
push eax
mov eax, dword [ebp + 8]
push 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x3c]
test eax, eax
je case.0x407590.40006
lea ecx, [eax - 1]
mov al, byte [eax - 1]
test al, al
je 0x407328
cmp al, 0xff
je 0x407328
jmp 0x407313
test al, al
je case.0x407590.40006
mov byte [0x43865a], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add eax, 0xffff63bd
cmp eax, 4
ja case.0x407590.40006
jmp dword [eax*4 + 0x4076f8]
mov eax, dword [ebp + 8]
mov ecx, dword [0x438350]
push 0x438640
push eax
call fcn.00409880
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x43865d]
test al, al
je case.0x407590.40006
mov al, byte [0x43880c]
test al, al
jne case.0x407590.40006
push 4
mov ecx, 0x438300
call fcn.0040a830
mov ecx, dword [ebp + 8]
push 0
push 0x403
push 0x111
mov dword [0x438350], eax
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x43880c]
test al, al
jne case.0x407590.40006
push 5
mov ecx, 0x438300
call fcn.0040a830
mov edx, dword [ebp + 8]
push 0
push 0x403
push 0x111
mov dword [0x438350], eax
push edx
jmp 0x4075f7
mov eax, dword [0x438664]
xor ecx, ecx
cmp eax, 1
setne cl
mov dword [0x438664], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret