Function at 0x4c8da0
Capabilities:
Create raw socket
Get socket status
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Set socket configuration

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x400
mov rbp, rsp
mov rbx, rcx
xor rax, rax
mov byte [rbp + 0x3f], al
mov cx, 0x201
lea rdx, [rbp + 0x268]
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4c90cf
mov ecx, 2
mov edx, 3
mov r8d, 1
call sub.wsock32.dll_socket
mov rsi, rax
cmp rsi, 0xffffffffffffffff
je 0x4c90cf
mov dword [rbp + 0x254], 0x1e
mov rcx, rsi
xor rdx, rdx
mov r8d, 7
lea r9, [rbp + 0x254]
mov dword [rsp + 0x20], 4
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
jne 0x4c8e47
mov rcx, rsi
xor rdx, rdx
mov r8d, 4
lea r9, [rbp + 0x254]
mov dword [rsp + 0x20], 4
call sub.wsock32.dll_setsockopt
cmp eax, 0xffffffff
je 0x4c90cf
lea rcx, [rbp + 0x258]
mov edx, 0x10
call fcn.00421ad0
mov rcx, rbx
call fcn.00411320
mov rcx, rax
call sub.wsock32.dll_inet_addr
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0xffffffff
je 0x4c8e98
mov eax, dword [rbp + 0x254]
mov dword [rbp + 0x25c], eax
mov word [rbp + 0x258], 2
jmp 0x4c8ec5
mov rcx, rbx
call fcn.00411320
mov rcx, rax
call sub.wsock32.dll_gethostbyname
test rax, rax
je 0x4c8ec5
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
mov eax, dword [rax]
mov dword [rbp + 0x25c], eax
mov word [rbp + 0x258], 2
cmp dword [rbp + 0x25c], 0
je 0x4c90cf
mov ecx, 0x20
call fcn.004088f0
mov rbx, rax
mov ecx, 0x414
call fcn.004088f0
mov rdi, rax
mov rcx, rdi
mov edx, 0x414
call fcn.00421ad0
cmp word [0x00b2f83c], 0xffff
jne 0x4c8f11
mov word [0x00b2f83c], 0
jmp 0x4c8f19
add word [0x00b2f83c], 1
mov r13, rbx
mov byte [r13], 8
mov byte [r13 + 1], 0
mov word [r13 + 2], 0
call sub.kernel32.dll_GetCurrentProcessId
mov word [r13 + 4], ax
movzx rax, word [0x00b2f83c]
mov word [r13 + 6], ax
mov dword [rbp + 0x254], 0
movsxd rax, dword [rbp + 0x254]
mov dword [r13 + rax*4 + 8], 0xdeadbeef
add dword [rbp + 0x254], 1
cmp dword [rbp + 0x254], 6
jne 0x4c8f4e
nop
xor rax, rax
mov dword [rbp + 0x254], 1
movsxd rcx, dword [rbp + 0x254]
movzx ecx, word [rbx + rcx*2 - 2]
add eax, ecx
add dword [rbp + 0x254], 1
cmp dword [rbp + 0x254], 0x11
jne 0x4c8f7c
nop
mov ecx, eax
shr ecx, 0x10
movzx eax, ax
add ecx, eax
mov eax, ecx
mov ecx, 0xffff
movzx eax, ax
sub ecx, eax
mov eax, ecx
mov word [r13 + 2], ax
mov rcx, rsi
mov rdx, rbx
mov r8d, 0x20
xor r9, r9
lea rax, [rbp + 0x258]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0x10
call sub.wsock32.dll_sendto
cmp eax, 0xffffffff
je 0x4c90bf
mov dword [rbp + 0x48], 1
mov qword [rbp + 0x50], rsi
mov dword [rbp + 0x40], 1
mov dword [rbp + 0x44], 0
xor rcx, rcx
lea rdx, [rbp + 0x48]
xor r8, r8
xor r9, r9
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
call sub.wsock32.dll_select
test eax, eax
jle 0x4c90be
mov rcx, rsi
mov rdx, rdi
mov r8d, 0x414
xor r9, r9
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call sub.wsock32.dll_recvfrom
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0xffffffff
je 0x4c90be
movzx rax, byte [rdi]
and al, 0xf
movzx rax, al
add eax, eax
add eax, eax
add eax, 0x20
cmp dword [rbp + 0x254], eax
jl 0x4c90be
movzx rax, byte [rdi]
and al, 0xf
movzx rax, al
add eax, eax
add eax, eax
mov eax, eax
lea r13, [rdi + rax]
cmp byte [r13], 0
jne 0x4c8feb
call sub.kernel32.dll_GetCurrentProcessId
cmp word [r13 + 4], ax
jne 0x4c8feb
movzx rax, word [r13 + 6]
cmp ax, word [0x00b2f83c]
jne 0x4c8feb
mov al, 1
mov byte [rbp + 0x3f], al
nop
mov rcx, rdi
call fcn.00408920
mov rcx, rbx
call fcn.00408920
call sub.wsock32.dll_WSACleanup
movzx rax, byte [rbp + 0x3f]
lea rsp, [rbp + 0x400]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret