Function at 0x40e070
Capabilities:
Delete file
Get hostname
Log keystrokes via polling
Resolve dns

Disassembly:
sub esp, 0x358
mov eax, dword [0x5fe940]
mov dword [esp + 0x354], eax
push 0x40
lea eax, [esp + 0x218]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x40e8bd
push esi
lea ecx, [esp + 0x218]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
jne 0x40e0f6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [esp + 0x1dc]
push str.Error:_gethostbyname__r_n_Err_Code___d
push edx
call fcn.0059000d
add esp, 0xc
push esi
push str.fail_
lea eax, [esp + 0x1e0]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x354]
call fcn.005900c7
add esp, 0x358
ret
push ebx
push edi
lea ecx, [esp + 0x260]
push ecx
mov ecx, 0x67a884
call fcn.00403cb0
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, dword [eax]
mov dword [esp + 0x1d0], edx
mov ecx, dword [eax + 4]
mov dword [esp + 0x1d4], ecx
mov edx, dword [eax + 8]
mov ecx, dword [str.lunarian74]
mov dword [esp + 0x1d8], edx
mov eax, dword [eax + 0xc]
mov edx, dword [0x5b60a4]
mov dword [esp + 0x1dc], eax
mov ax, word [0x5b60a8]
mov word [esp + 0x18], ax
mov eax, dword [str.idlebread]
mov dword [esp + 0x14], edx
xor edx, edx
mov dword [esp + 0x10], ecx
mov cl, byte [0x5b60aa]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1b], edx
xor eax, eax
mov byte [esp + 0x1a], cl
mov ecx, dword [0x5b6098]
mov byte [esp + 0x1f], dl
mov dx, word [0x5b609c]
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
mov dword [esp + 0x24], ecx
mov ecx, dword [str.z2510]
mov word [esp + 0x28], dx
mov dx, word [0x5b6090]
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x30], ecx
mov ecx, dword [str.yd0200]
mov word [esp + 0x34], dx
mov dx, word [0x5b6088]
mov word [esp + 0x3e], ax
mov al, byte [0x5b608a]
mov dword [esp + 0x40], ecx
mov word [esp + 0x44], dx
mov edx, dword [str.yd02000]
xor ecx, ecx
mov byte [esp + 0x46], al
mov eax, dword [0x5b6080]
mov dword [esp + 0x50], edx
mov edx, dword [str.test00]
mov dword [esp + 0x47], ecx
mov dword [esp + 0x54], eax
mov ax, word [0x5b6078]
mov dword [esp + 0x4b], ecx
mov dword [esp + 0x60], edx
xor edx, edx
mov byte [esp + 0x4f], cl
mov word [esp + 0x64], ax
mov eax, dword [str.test01]
mov dword [esp + 0x58], ecx
mov dword [esp + 0x67], edx
mov dword [esp + 0x5c], ecx
mov cl, byte [0x5b607a]
mov dword [esp + 0x70], eax
mov dword [esp + 0x6b], edx
xor eax, eax
mov byte [esp + 0x66], cl
mov cx, word [0x5b6070]
mov byte [esp + 0x6f], dl
mov dl, byte [0x5b6072]
mov dword [esp + 0x77], eax
mov word [esp + 0x74], cx
mov byte [esp + 0x76], dl
mov dword [esp + 0x7b], eax
mov ecx, dword [str.test02]
mov dx, word [0x5b6068]
mov dword [esp + 0x80], ecx
mov word [esp + 0x84], dx
mov edx, dword [str.test03]
xor ecx, ecx
mov dword [esp + 0x90], edx
mov dword [esp + 0x87], ecx
mov byte [esp + 0x7f], al
mov al, byte [0x5b606a]
xor edx, edx
mov dword [esp + 0x8b], ecx
mov dword [esp + 0x97], edx
mov byte [esp + 0x86], al
mov ax, word [0x5b6060]
mov byte [esp + 0x8f], cl
mov cl, byte [0x5b6062]
mov dword [esp + 0x9b], edx
mov word [esp + 0x94], ax
mov eax, dword [str.test04]
mov byte [esp + 0x96], cl
mov cx, word [0x5b6058]
mov byte [esp + 0x9f], dl
mov dl, byte [0x5b605a]
mov dword [esp + 0xa0], eax
mov word [esp + 0xa4], cx
mov ecx, dword [str.test05]
mov byte [esp + 0xa6], dl
mov dx, word [0x5b6050]
xor eax, eax
mov dword [esp + 0xb0], ecx
mov word [esp + 0xb4], dx
mov edx, dword [str.test06]
mov dword [esp + 0xa7], eax
xor ecx, ecx
mov dword [esp + 0xab], eax
mov dword [esp + 0xc0], edx
mov dword [esp + 0xb7], ecx
mov byte [esp + 0xaf], al
mov al, byte [0x5b6052]
xor edx, edx
mov dword [esp + 0xbb], ecx
mov dword [esp + 0xc7], edx
mov byte [esp + 0xb6], al
mov ax, word [0x5b6048]
mov byte [esp + 0xbf], cl
mov cl, byte [0x5b604a]
mov dword [esp + 0xcb], edx
mov word [esp + 0xc4], ax
mov eax, dword [str.test07]
mov byte [esp + 0xc6], cl
mov cx, word [0x5b6040]
mov byte [esp + 0xcf], dl
mov dl, byte [0x5b6042]
mov dword [esp + 0xd0], eax
mov word [esp + 0xd4], cx
mov ecx, dword [str.test08]
mov byte [esp + 0xd6], dl
mov dx, word [0x5b6038]
xor eax, eax
mov dword [esp + 0xe0], ecx
mov word [esp + 0xe4], dx
mov edx, dword [str.test09]
mov dword [esp + 0xd7], eax
xor ecx, ecx
mov dword [esp + 0xdb], eax
mov dword [esp + 0xf0], edx
mov dword [esp + 0xe7], ecx
mov byte [esp + 0xdf], al
mov al, byte [0x5b603a]
xor edx, edx
mov dword [esp + 0xeb], ecx
mov dword [esp + 0xf7], edx
mov byte [esp + 0xe6], al
mov ax, word [0x5b6030]
mov byte [esp + 0xef], cl
mov cl, byte [0x5b6032]
mov dword [esp + 0xfb], edx
mov word [esp + 0xf4], ax
mov byte [esp + 0xf6], cl
mov byte [esp + 0xff], dl
mov eax, dword [str.test10]
mov cx, word [0x5b6028]
mov dl, byte [0x5b602a]
mov dword [esp + 0x100], eax
xor eax, eax
mov dword [esp + 0x107], eax
mov word [esp + 0x104], cx
mov cx, word [0x5b6020]
mov byte [esp + 0x106], dl
mov dl, byte [0x5b6022]
mov dword [esp + 0x10b], eax
mov byte [esp + 0x10f], al
mov eax, dword [str.test11]
mov word [esp + 0x114], cx
mov byte [esp + 0x116], dl
mov word [esp + 0x124], cx
mov byte [esp + 0x126], dl
mov edx, dword [str.test12]
xor ecx, ecx
mov dword [esp + 0x110], eax
mov dword [esp + 0x120], eax
mov ax, word [0x5b6018]
mov dword [esp + 0x130], edx
mov dword [esp + 0x127], ecx
xor edx, edx
mov dword [esp + 0x12b], ecx
mov word [esp + 0x134], ax
mov eax, dword [str.test13]
mov dword [esp + 0x137], edx
mov byte [esp + 0x12f], cl
mov cl, byte [0x5b601a]
mov dword [esp + 0x13b], edx
mov dword [esp + 0x140], eax
mov byte [esp + 0x136], cl
mov cx, word [0x5b6010]
mov byte [esp + 0x13f], dl
mov dl, byte [0x5b6012]
xor eax, eax
mov dword [esp + 0x147], eax
mov word [esp + 0x144], cx
mov ecx, dword [str.test14]
mov byte [esp + 0x146], dl
mov dx, word [0x5b6008]
mov dword [esp + 0x14b], eax
mov byte [esp + 0x14f], al
mov al, byte [0x5b600a]
mov dword [esp + 0x150], ecx
mov word [esp + 0x154], dx
mov edx, dword [str.test15]
xor ecx, ecx
mov byte [esp + 0x156], al
mov ax, word [0x5b6000]
mov dword [esp + 0x160], edx
mov dword [esp + 0x157], ecx
xor edx, edx
mov dword [esp + 0x15b], ecx
mov word [esp + 0x164], ax
mov eax, dword [str.test16]
mov dword [esp + 0x167], edx
mov byte [esp + 0x15f], cl
mov cl, byte [0x5b6002]
mov dword [esp + 0x16b], edx
xor ebx, ebx
mov dword [esp + 0x170], eax
mov byte [esp + 0x166], cl
mov cx, word [0x5b5ff8]
mov byte [esp + 0x16f], dl
mov dl, byte [0x5b5ffa]
xor eax, eax
mov dword [esp + 0x117], ebx
mov dword [esp + 0x177], eax
mov word [esp + 0x174], cx
mov ecx, dword [str.test17]
mov byte [esp + 0x176], dl
mov dx, word [0x5b5ff0]
mov dword [esp + 0x11b], ebx
mov dword [esp + 0x17b], eax
mov byte [esp + 0x11f], bl
mov byte [esp + 0x17f], al
mov dword [esp + 0x180], ecx
mov word [esp + 0x184], dx
mov edx, dword [str.test18]
mov al, byte [0x5b5ff2]
mov dword [esp + 0x190], edx
xor edx, edx
xor ecx, ecx
mov dword [esp + 0x197], edx
mov byte [esp + 0x186], al
mov ax, word [0x5b5fe8]
mov dword [esp + 0x187], ecx
mov dword [esp + 0x19b], edx
mov dword [esp + 0x18b], ecx
mov byte [esp + 0x19f], dl
mov dl, byte [0x5b5fe2]
mov word [esp + 0x194], ax
mov eax, dword [str.test19]
mov byte [esp + 0x18f], cl
mov cl, byte [0x5b5fea]
mov byte [esp + 0x1a6], dl
mov dx, word [0x5b5fd8]
mov dword [esp + 0x1a0], eax
mov byte [esp + 0x196], cl
mov cx, word [0x5b5fe0]
xor eax, eax
mov word [esp + 0x1b4], dx
mov word [esp + 0x1a4], cx
mov ecx, dword [str.test20]
mov dword [esp + 0x1a7], eax
xor edx, edx
mov dword [esp + 0x1ab], eax
mov dword [esp + 0x1c1], edx
mov dword [esp + 0x1b0], ecx
mov byte [esp + 0x1af], al
mov al, byte [0x5b5fda]
xor ecx, ecx
mov dword [esp + 0x1c5], edx
mov byte [esp + 0x1b6], al
mov dword [esp + 0x1b7], ecx
mov dword [esp + 0x1c9], edx
mov dword [esp + 0x1bb], ecx
lea eax, [esp + 0x1d0]
mov word [esp + 0x1cd], dx
push eax
mov byte [esp + 0x1c3], cl
mov byte [esp + 0x1c4], cl
mov byte [esp + 0x1d3], dl
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, eax
push 0xa0
mov dword [esp + 0x10], ebx
call esi
test ax, ax
jne 0x40e797
push 0x11
call esi
test ax, ax
je 0x40e802
mov al, byte [esp + 0x10]
test al, al
je 0x40e7ed
lea esi, [esp + 0x10]
mov edi, esi
lea eax, [esp + 0x260]
lea esp, [esp]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40e7d4
test cl, cl
je 0x40e7d0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40e7d4
add eax, 2
add esi, 2
test cl, cl
jne 0x40e7b0
xor eax, eax
jmp 0x40e7d9
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40e892
mov al, byte [edi + 0x10]
add edi, 0x10
test al, al
mov esi, edi
jne 0x40e7a5
cmp bl, 0xde
jne 0x40e81d
cmp bh, 0x6a
jne 0x40e802
cmp byte [esp + 0xe], 0x8a
je 0x40e892
pop edi
pop ebx
mov eax, 1
pop esi
mov ecx, dword [esp + 0x354]
call fcn.005900c7
add esp, 0x358
ret
cmp bl, 0xd3
jne 0x40e83a
cmp bh, 0x2c
jne 0x40e82e
cmp byte [esp + 0xe], 7
jmp 0x40e7fc
cmp bh, 0xc9
jne 0x40e84b
cmp byte [esp + 0xe], 0x86
jmp 0x40e7fc
cmp bl, 0xd2
jne 0x40e802
cmp bh, 0x61
jne 0x40e802
cmp byte [esp + 0xe], 0xf4
jmp 0x40e7fc
cmp bh, 0xce
jne 0x40e86d
cmp byte [esp + 0xe], 0x7d
jne 0x40e802
movzx ecx, byte [esp + 0xf]
mov eax, 0x41
cmp eax, ecx
je 0x40e892
inc eax
cmp eax, 0x4e
jle 0x40e861
jmp 0x40e802
cmp bh, 0xd7
jne 0x40e802
cmp byte [esp + 0xe], 0x11
jne 0x40e802
movzx ecx, byte [esp + 0xf]
mov eax, 0x71
cmp eax, ecx
je 0x40e892
inc eax
cmp eax, 0x7e
jle 0x40e883
jmp 0x40e802
push str.f700c.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
mov eax, 1
pop ebx
mov dword [0x60d2a0], eax
pop esi
mov ecx, dword [esp + 0x354]
call fcn.005900c7
add esp, 0x358
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [esp + 0x1d8]
push str.Error:_gethostname__r_n_Err_Code___d
push eax
call fcn.0059000d
add esp, 0xc
push 0
push str.fail_
lea ecx, [esp + 0x1dc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x354]
xor eax, eax
call fcn.005900c7
add esp, 0x358
ret