int __stdcall StartAddress(LPVOID lpThreadParameter)
{
CHAR *v1; // edi@1
CHAR *v2; // ebx@1
void *v3; // ebx@1
HMODULE v4; // eax@9
LPCSTR v5; // esi@14
LPCSTR v6; // eax@14
LPCSTR v7; // eax@14
DWORD v8; // eax@15
HANDLE v9; // ecx@17
int v10; // eax@25
INTERNET_SCHEME v11; // ecx@27
signed int v12; // eax@31
signed int v13; // eax@33
int v14; // eax@35
LPCSTR v15; // ecx@35
int v16; // eax@37
const CHAR *v17; // ecx@37
void *v18; // ebx@39
void *v19; // eax@41
void *v20; // esi@43
LPCWSTR v21; // edi@49
unsigned int v22; // ecx@50
unsigned int v23; // edx@50
HWND v24; // edi@56
const char *v25; // ecx@56
const CHAR *v26; // ST1C_4@58
HWND v27; // eax@58
const char *v28; // eax@58
const CHAR *v29; // ST1C_4@60
HWND v30; // eax@60
LONG v31; // eax@61
char *v32; // eax@71
DWORD v33; // eax@72
char v34; // al@74
int v35; // eax@80
DWORD v36; // eax@82
char *v37; // eax@89
const CHAR *v38; // ST18_4@91
HWND v39; // eax@91
int v40; // eax@92
DWORD v41; // eax@95
const CHAR *v43; // [sp-10h] [bp-88h]@37
DWORD v44; // [sp-Ch] [bp-84h]@35
DWORD v45; // [sp-8h] [bp-80h]@33
struct $BC2FB811D417144E831EE3AEA4A279C8 UrlComponents; // [sp+Ch] [bp-6Ch]@1
int v47; // [sp+48h] [bp-30h]@4
int v48; // [sp+4Ch] [bp-2Ch]@4
DWORD dwError; // [sp+50h] [bp-28h]@69
CHAR *v50; // [sp+54h] [bp-24h]@1
LPCSTR lpszUserName; // [sp+58h] [bp-20h]@1
LPCSTR lpString2; // [sp+5Ch] [bp-1Ch]@1
LPCSTR lpszServerName; // [sp+60h] [bp-18h]@1
LPCSTR lpString; // [sp+64h] [bp-14h]@1
DWORD dwBufferLength; // [sp+68h] [bp-10h]@2
HANDLE hFile; // [sp+6Ch] [bp-Ch]@1
void *v57; // [sp+70h] [bp-8h]@1
DWORD Buffer; // [sp+74h] [bp-4h]@2
hFile = 0;
lpszServerName = LocalAlloc(0x40u, iMaxLength);
v1 = LocalAlloc(0x40u, iMaxLength);
v50 = v1;
lpString2 = LocalAlloc(0x40u, iMaxLength);
v2 = LocalAlloc(0x40u, iMaxLength);
lpszUserName = v2;
UrlComponents.lpszScheme = 0;
UrlComponents.dwSchemeLength = 0;
UrlComponents.nScheme = 0;
lpString = LocalAlloc(0x40u, iMaxLength);
UrlComponents.lpszHostName = lpszServerName;
UrlComponents.lpszPassword = lpString;
UrlComponents.dwStructSize = 60;
UrlComponents.dwHostNameLength = iMaxLength;
UrlComponents.nPort = 0;
UrlComponents.lpszUserName = v2;
UrlComponents.dwUserNameLength = iMaxLength;
UrlComponents.dwPasswordLength = iMaxLength;
UrlComponents.lpszUrlPath = v1;
UrlComponents.dwUrlPathLength = iMaxLength;
UrlComponents.lpszExtraInfo = lpString2;
UrlComponents.dwExtraInfoLength = iMaxLength;
v3 = InternetOpenA(&szAgent, dwAccessType, lpszProxy, 0, 0);
v57 = v3;
if ( !v3 )
{
dword_10005AB4 = 8;
goto LABEL_108;
}
Buffer = 0;
dwBufferLength = 4;
if ( InternetQueryOptionA(v3, 0x32u, &Buffer, &dwBufferLength) && Buffer & 0x10 )
{
v48 = 0;
v47 = 1;
InternetSetOptionA(v3, 0x32u, &v47, 8u);
}
if ( dword_10005AC4 )
dwBufferLength = InternetSetOptionA(v3, 2u, &dword_10005AC4, 4u);
if ( dword_10005AC8 )
InternetSetOptionA(v3, 6u, &dword_10005AC8, 4u);
v4 = LoadLibraryA("wininet.dll");
if ( v4 )
dword_100056C0 = GetProcAddress(v4, "FtpCommandA");
do
{
while ( 1 )
{
if ( sub_10003B5A(lpString1)
|| !lstrcmpiA(lpString1, "/end")
|| sub_10003B5A(FileName)
|| !lstrcmpiA(lpString1, "/end") )
{
goto LABEL_105;
}
v5 = lpszUserName;
dword_10005AB4 = 1;
*lpString2 = 0;
v6 = lpString;
*v1 = 0;
*v6 = 0;
v7 = lpszServerName;
*v5 = 0;
*v7 = 0;
nDenominator = 0;
nNumber = 0;
PostMessageA(lpThreadParameter, 0x113u, 1u, 0);
if ( ::lpString2 )
{
v9 = hFile;
break;
}
v8 = 0x40000000;
if ( byte_10005ADF )
v8 = 2147483648;
v9 = CreateFileA(FileName, v8, 1u, 0, (byte_10005ADF != 0) + 2, 0, 0);
hFile = v9;
if ( v9 != -1 )
break;
dword_10005AB4 = 11;
}
UrlComponents.dwExtraInfoLength = iMaxLength;
UrlComponents.dwUrlPathLength = iMaxLength;
UrlComponents.dwPasswordLength = iMaxLength;
UrlComponents.dwUserNameLength = iMaxLength;
UrlComponents.dwHostNameLength = iMaxLength;
if ( byte_10005ADF )
nDenominator = GetFileSize(v9, 0);
if ( InternetCrackUrlA(lpString1, 0, 0, &UrlComponents) )
{
if ( *v5 && *lpString )
{
wsprintfA(&szBuffer, "%s:%s", v5, lpString);
v10 = lstrlenA(&szBuffer);
sub_100013A9(v10, &szBuffer, &String1);
szBuffer = 0;
}
lstrcatA(v1, lpString2);
dword_10005AD0 = GetTickCount();
while ( 1 )
{
v11 = UrlComponents.nScheme;
if ( byte_10005ADF && UrlComponents.nScheme != 1 || hMem )
{
nNumber = 0;
SetFilePointer(hFile, 0, 0, 0);
v11 = UrlComponents.nScheme;
}
dwBufferLength = nNumber;
v12 = 0;
if ( v11 == 1 )
v12 = 0x8000000;
v45 = v12;
v13 = 3;
if ( v11 == 1 )
v13 = 1;
v44 = v13;
dword_10005AB4 = 1;
v14 = lstrlenA(lpString);
v15 = 0;
if ( v14 > 0 )
v15 = lpString;
v43 = v15;
v16 = lstrlenA(v5);
v17 = 0;
if ( v16 > 0 )
v17 = v5;
v18 = InternetConnectA(v3, lpszServerName, UrlComponents.nPort, v17, v43, v44, v45, 0);
if ( v18 )
break;
dword_10005AB4 = 15;
if ( UrlComponents.nScheme == 1
&& (Buffer = 2048, InternetGetLastResponseInfoA(&dwError, &szBuffer, &Buffer))
&& sub_10001065(&szBuffer, "530") )
{
v32 = sub_10001065(&szBuffer, "530");
lstrcpynA(&byte_10005000[32 * dword_10005AB4], v32, 32);
}
else
{
v33 = GetLastError();
Buffer = v33;
if ( v33 == 12003 || v33 == 12002 )
{
v34 = byte_10005ADA;
if ( !byte_10005AD8 )
v34 = 1;
byte_10005ADA = v34;
}
}
LABEL_77:
if ( (!byte_10005ADF || UrlComponents.nScheme == 1) && nNumber > dwBufferLength )
{
v35 = dword_10005AB4;
if ( dword_10005AB4 != 10 )
goto LABEL_84;
if ( !SleepEx(0x7D0u, 0) )
{
dword_10005AB4 = 5;
v36 = SleepEx(0xBB8u, 0);
v3 = v57;
if ( !v36 )
continue;
}
}
v35 = dword_10005AB4;
LABEL_84:
if ( !byte_10005ADA || !v35 || v35 == 3 || v35 == 19 || ShowWindow(lpThreadParameter, 0) == -1 )
goto LABEL_113;
v37 = &byte_10005828;
if ( !byte_10005828 )
v37 = "Inetc plug-in";
v38 = v37;
v39 = GetParent(lpThreadParameter);
if ( MessageBoxA(v39, Text, v38, 0x35u) != 4 )
goto LABEL_113;
v40 = 5;
dword_10005AB4 = 5;
if ( byte_10005AD8 )
v40 = 0;
if ( ShowWindow(lpThreadParameter, v40) )
{
LABEL_113:
v3 = v57;
goto LABEL_99;
}
v41 = SleepEx(0x3E8u, 0);
v3 = v57;
if ( v41 )
goto LABEL_99;
}
dword_10005AB4 = 4;
if ( UrlComponents.nScheme == 1 )
v19 = sub_10002324(v18, v1);
else
v19 = sub_100026FC(v18, UrlComponents.nScheme, v1);
v20 = v19;
if ( dword_10005AB4 != 4 )
{
if ( !v19 )
{
LABEL_67:
InternetCloseHandle(v18);
v5 = lpszUserName;
goto LABEL_77;
}
InternetCloseHandle(v19);
v20 = 0;
}
if ( v20 )
{
if ( byte_10005AE8 )
{
Buffer = 2048;
if ( HttpQueryInfoA(v20, 0x16u, &szBuffer, &Buffer, 0) )
{
v21 = ::lpString2;
if ( ::lpString2 )
{
v22 = dword_10005ABC;
v23 = 0;
if ( dword_10005ABC < iMaxLength )
{
while ( v23 < Buffer )
{
*(v21 + v22) = *(&szBuffer + v23++);
v22 = dword_10005ABC + 1;
dword_10005ABC = v22;
if ( v22 >= iMaxLength )
break;
v21 = ::lpString2;
}
}
}
else
{
WriteFile(hFile, &szBuffer, Buffer, &dwBufferLength, 0);
}
}
dword_10005AB4 = 0;
}
else
{
v24 = GetDlgItem(lpThreadParameter, 1005);
SendDlgItemMessageA(lpThreadParameter, 1005, 0x402u, 0, 0);
v25 = "Not Available";
if ( nDenominator != -1 )
v25 = String;
v26 = v25;
v27 = GetDlgItem(lpThreadParameter, 1006);
SetWindowTextA(v27, v26);
v28 = "Unknown";
if ( nDenominator != -1 )
v28 = String;
v29 = v28;
v30 = GetDlgItem(lpThreadParameter, 1004);
SetWindowTextA(v30, v29);
if ( nDenominator == -1 )
v31 = GetWindowLongA(v24, -16) | 8;
else
v31 = GetWindowLongA(v24, -16) & 0xFFFFFFF7;
SetWindowLongA(v24, -16, v31);
SendDlgItemMessageA(lpThreadParameter, 1005, 0x40Au, nDenominator == -1, 50);
sub_1000148A(hFile, v20);
if ( byte_10005ADF && UrlComponents.nScheme != 1 )
{
Buffer = HttpEndRequestA(v20, 0, 0, 0);
sub_10002E1F(v20);
}
}
InternetCloseHandle(v20);
v1 = v50;
}
goto LABEL_67;
}
dword_10005AB4 = 18;
LABEL_99:
CloseHandle(hFile);
}
while ( byte_10005ADF || !dword_10005AB4 || ::lpString2 );
Buffer = DeleteFileA(FileName);
LABEL_105:
InternetCloseHandle(v3);
if ( !lstrcmpiA(lpString1, "/end") )
sub_10003B9E(lpString1);
LABEL_108:
LocalFree(lpszServerName);
LocalFree(v1);
LocalFree(lpszUserName);
LocalFree(lpString);
LocalFree(lpString2);
if ( IsWindow(lpThreadParameter) )
PostMessageA(lpThreadParameter, 0x111u, 0xFFEE0001, 0);
return dword_10005AB4;
}
Alles anzeigen
Könnte als Virus / Trojaner erkannt werden, da hier ein Upload in Abschnitt eins getätigt wird, und in Abschnitt 2 Senden wir mittels eines integrierten FTP Clienten Daten / Downloaden uns welche... Ich schau mal wohin das ganze weitergeleitet wird.
Im Anhang habe ich den C Quellcode und die dazugehörige DLL Datei hinzugefügt, ebenso habe ich ein Virustotal Log Link beigelegt.
