Function at 0x426140
Capabilities:
Connect socket
Create process on windows
Get routing table
Resolve dns

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x47a16b
push eax
mov eax, 0x6958
mov dword fs:[0], esp
call fcn.00458680
mov al, byte [0x494b70]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov byte [esp + 0x144], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 4]
push 0x400
stosw word es:[edi], ax
add ecx, 0x1f9fa
lea edx, [esp + 0x148]
push ecx
push edx
mov dword [esp + 0x1c], ebp
stosb byte es:[edi], al
call fcn.00459160
mov eax, dword [ebp + 4]
add esp, 0xc
add eax, 0x1f9fa
lea ecx, [esp + 0x495c]
push 0x48e23c
push eax
mov byte [esp + 0x54b], 0
call fcn.00443360
mov esi, 0x4902a0
lea eax, [esp + 0x144]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4261fd
test cl, cl
je 0x4261f9
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4261fd
add eax, 2
add esi, 2
test cl, cl
jne 0x4261d5
xor eax, eax
jmp 0x426202
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4263ec
mov eax, dword [0x4950fc]
test eax, eax
je 0x4262a3
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x3c
push 0x40
mov dword [esp + 0x2c], 0
call edi
mov esi, eax
lea eax, [esp + 0x24]
push 0
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x426299
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebx
mov ecx, dword [esp + 0x24]
push ecx
push 0x40
call edi
lea edx, [esp + 0x24]
mov edi, eax
push 0
push edx
push edi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x426296
mov eax, dword [edi]
xor ebp, ebp
test eax, eax
jbe 0x426292
lea esi, [edi + 4]
cmp dword [esi], 0
jne 0x426288
mov eax, dword [esi + 4]
test eax, eax
jne 0x426288
push esi
mov dword [esi + 0x24], 1
call sub.iphlpapi.dll_CreateIpForwardEntry
mov eax, dword [edi]
inc ebp
add esi, 0x38
cmp ebp, eax
jb 0x42626f
mov ebp, dword [esp + 0x10]
push edi
call ebx
mov dword [0x4950fc], 1
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov al, byte [esp + 0x2b]
xor ecx, ecx
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
cmp esi, ecx
mov dword [esp + 0x6970], ecx
je 0x4262f6
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
cmp eax, ecx
je 0x4262f6
push eax
mov eax, dword [esp + 0x20]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.004346b0
mov ecx, dword [esi + 0xc]
inc edi
mov eax, dword [ecx + edi*4]
test eax, eax
jne 0x4262d8
xor ecx, ecx
mov ebx, dword [esp + 0x697c]
xor eax, eax
mov esi, dword [ebx + 0x24]
cmp esi, ecx
jl 0x426336
mov eax, dword [ebp + 4]
add eax, 0x364d4
mov edx, dword [eax + 4]
cmp edx, ecx
je 0x42632d
mov ecx, dword [eax + 8]
mov eax, 0x60f25deb
sub ecx, edx
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
mov eax, esi
xor edx, edx
imul eax, edi
div ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x24]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jl 0x4263d4
mov ecx, dword [ebp + 4]
mov edx, dword [ecx + 0x364d8]
lea ecx, [eax*8]
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*8]
lea ecx, [edx + eax*4]
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x4263d4
mov ecx, dword [ebx + 0x24]
mov edx, dword [ebp + 4]
push 0x400
mov edx, dword [edx + 0x364d8]
lea eax, [ecx*8]
sub eax, ecx
lea eax, [eax + eax*2]
lea ecx, [ecx + eax*8]
lea eax, [esp + 0x148]
lea edx, [edx + ecx*4]
push edx
push eax
call fcn.00459160
add esp, 0xc
mov byte [esp + 0x543], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x6970], 0xffffffff
push ecx
call fcn.0046eff2
add esp, 4
push 0
mov word [esp + 0x30], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 0x144]
mov word [esp + 0x2e], ax
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, dword [esp + 0x6978]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x2c]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
mov eax, dword [ebp + 4]
mov ecx, dword [eax + 0x1b9e0]
test ecx, ecx
je 0x426491
add eax, 0x1b9e4
push 0x48e23c
push eax
lea ecx, [esp + 0x94c]
call fcn.00443360
lea ecx, [esp + 0x944]
call fcn.00443420
test eax, eax
je 0x426491
lea ecx, [esp + 0x944]
call fcn.004433c0
push eax
call fcn.00458e12
mov ebp, dword [esp + 0x6988]
add esp, 4
cmp ebp, eax
je 0x426538
lea ecx, [esp + 0x944]
call fcn.00443420
test eax, eax
jne 0x42645b
jmp 0x426498
mov ebp, dword [esp + 0x6984]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x6988]
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x410c]
test edx, edx
jne 0x426702
mov edx, dword [eax + edi*4 + 0x5118]
test edx, edx
jne 0x426702
mov esi, dword [esp + 0x6980]
xor ecx, ecx
mov dword [esp + 0x14], ecx
push str.reboot.ccproxy
mov dword [esp + 0x1c], ecx
push esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
call fcn.0045d2f0
add esp, 8
test eax, eax
jne 0x42653f
mov dl, byte [0x494b70]
mov ecx, 0x41
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], dl
rep stosd dword es:[edi], eax
push 0x494e60
lea eax, [esp + 0x40]
push str._sCCProxy.exe
push eax
call fcn.004585a3
add esp, 0xc
lea ecx, [esp + 0x3c]
push 5
push 0x494e60
push str._reboot
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x426720
push esi
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x426570
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x426641
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x1c9e8]
test ecx, ecx
je 0x4266a5
add eax, 0x1c9ec
push 0x48e23c
push eax
lea ecx, [esp + 0x2958]
call fcn.00443360
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2950]
call fcn.00443420
test eax, eax
je 0x42669e
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov al, byte [0x494b70]
mov ecx, 0xff
mov byte [esp + 0x544], al
xor eax, eax
lea edi, [esp + 0x545]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2950]
stosb byte es:[edi], al
call fcn.004433c0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x544]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x48e1a8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x548]
push ecx
call fcn.00458600
add esp, 8
test eax, eax
je 0x42664e
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
mov byte [eax], 0
inc eax
push eax
call esi
lea edx, [esp + 0x544]
mov edi, eax
push edx
call esi
mov esi, eax
jmp 0x426660
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x426720
lea eax, [esp + 0x544]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
mov edi, esi
push edi
call ebp
push ebx
mov edi, eax
call ebp
cmp eax, edi
ja 0x42667c
push esi
call ebp
push ebx
mov esi, eax
call ebp
cmp eax, esi
jae 0x426538
lea ecx, [esp + 0x2950]
call fcn.00443420
test eax, eax
jne 0x4265ba
mov edi, dword [esp + 0x6988]
mov ebp, dword [esp + 0x6984]
mov ebx, dword [esp + 0x6978]
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x10]
mov word [esp + 0x16], ax
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x1b9dc]
test eax, eax
je 0x4266ec
cmp edi, 3
je 0x4266d6
cmp edi, 2
je 0x4266d6
cmp ebp, 0x19
je 0x4266d6
cmp ebp, 0x6e
jne 0x4266ec
lea eax, [esp + 0x14]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4266fb
xor eax, eax
jmp 0x426720
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.0041cde0
test eax, eax
je 0x426720
mov eax, 1
jmp 0x426720
mov eax, dword [esp + 0x6980]
mov edx, dword [esp + 0x697c]
push edi
push ebp
push eax
push edx
push ebx
call fcn.00426f00
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x6968]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6964
ret 0x14