Function at 0x4402a2
Capabilities:
Create process on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4402ab
mov eax, dword [ebp - 4]
add esp, 0xfffffd1c
push ebx
push esi
push edi
mov esi, 0x45f1ea
xor edi, edi
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], 1
push 0
push dword [ebp - 4]
lea edx, [ebp - 0x32e8]
add edx, dword [ebp - 8]
push edx
push dword [ebp + 8]
call sub.WSOCK32.dll_recv
test eax, eax
jle 0x44052b
add dword [ebp - 8], eax
push 0x7d0
lea ecx, [ebp - 0x7d8]
push ecx
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x32e8]
push edx
call fcn.0043d8ff
add esp, 0x10
mov ebx, eax
test ebx, ebx
je 0x4402d4
push 1
push 0x100
lea eax, [ebp - 0x8d8]
push eax
push ebx
lea edx, [ebp - 0x7d8]
push edx
call fcn.0043d86d
add esp, 0x14
lea ecx, [esi + 0x1c9]
push ecx
lea eax, [ebp - 0x8d8]
push eax
call fcn.00441038
add esp, 8
test eax, eax
jne 0x440383
push 2
push 0x100
lea edx, [ebp - 0x9d8]
push edx
push ebx
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.0043d86d
add esp, 0x14
lea eax, [ebp - 0x9d8]
push eax
call fcn.0041889e
pop ecx
call fcn.00418918
lea edx, [esi + 0x1ce]
push edx
lea ecx, [ebp - 0x8d8]
push ecx
call fcn.00441038
add esp, 8
test eax, eax
jne 0x4403c0
push 2
push 0x100
lea eax, [ebp - 0x9d8]
push eax
push ebx
lea edx, [ebp - 0x7d8]
push edx
call fcn.0043d86d
add esp, 0x14
mov edi, 1
lea eax, [esi + 0x1d5]
push eax
lea edx, [ebp - 0x8d8]
push edx
call fcn.00441038
add esp, 8
test eax, eax
jne 0x440476
push 2
push 0x100
lea ecx, [ebp - 0x9d8]
push ecx
push ebx
lea eax, [ebp - 0x7d8]
push eax
call fcn.0043d86d
add esp, 0x14
push 3
push 0x100
lea edx, [ebp - 0xad8]
push edx
push ebx
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.0043d86d
add esp, 0x14
push 4
push 0x100
lea eax, [ebp - 0xbd8]
push eax
push ebx
lea edx, [ebp - 0x7d8]
push edx
call fcn.0043d86d
add esp, 0x14
lea ecx, [ebp - 0xbd8]
push ecx
call fcn.004470f4
pop ecx
push eax
lea eax, [ebp - 0xad8]
push eax
call fcn.004470f4
pop ecx
push eax
lea edx, [ebp - 0x9d8]
push edx
push dword [ebp + 8]
call fcn.0044010e
add esp, 0x10
test eax, eax
jne 0x440471
xor eax, eax
jmp 0x44055b
mov edi, 1
lea eax, [esi + 0x1db]
push eax
lea edx, [ebp - 0x8d8]
push edx
call fcn.00441038
add esp, 8
test eax, eax
jne 0x4404fd
push 0x14
lea ecx, [esi + 0x1e3]
push ecx
lea eax, [ebp - 0x8d8]
push eax
call fcn.00441094
pop ecx
lea edx, [ebp - 0x7d8]
add eax, edx
push eax
push dword [0x171d168]
call sub.USER32.dll_MessageBoxA
cmp eax, 6
jne 0x4404da
push 1
push 0
push 0
lea ecx, [esi + 0x1f9]
push ecx
lea eax, [esi + 0x1f4]
push eax
push 0
call sub.SHELL32.DLL_ShellExecuteA
push 2
push 0x100
lea edx, [ebp - 0x9d8]
push edx
push ebx
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.0043d86d
add esp, 0x14
mov edi, 1
push 0x7d0
lea eax, [ebp - 0x7d8]
push eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x32e8]
push ecx
call fcn.0043d8ff
add esp, 0x10
mov ebx, eax
test ebx, ebx
jne 0x44031b
jmp 0x4402d4
cmp dword [0x45edb8], 0
je 0x440559
call fcn.0040166c
push 0
lea eax, [esi + 0x219]
push eax
call sub.KERNEL32.dll_WinExec
call fcn.0042df99
call fcn.00418c82
push 0
call fcn.00449498
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret