Function at 0x40abc0
Capabilities:
Create process on windows
Create tcp socket
Create udp socket
Initialize winsock library
Send data
Send data on socket
Set socket configuration
Start tcp server

Disassembly:
sub esp, 0x31c
push ebp
push esi
lea eax, [esp + 0x194]
push eax
push 2
mov ebp, ecx
mov dword [esp + 0x24], 0x10
mov esi, 0x17
call sub.WSOCK32.dll_WSAStartup
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
cmp eax, 0xffffffff
mov dword [ebp + 0x14], eax
je 0x40b0ed
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
push ecx
mov dword [esp + 0x1c], ecx
mov word [esp + 0x10], 2
call sub.WSOCK32.dll_htonl
mov dword [esp + 0x10], eax
push esi
call sub.WSOCK32.dll_htons
push 0x10
lea edx, [esp + 0x10]
mov word [esp + 0x12], ax
mov eax, dword [ebp + 0x14]
push edx
push eax
call sub.WSOCK32.dll_bind
test eax, eax
je 0x40ac5c
cmp esi, 0x17
jne 0x40ac4b
mov esi, 0xc000
jmp 0x40ac20
inc esi
cmp esi, 0x10000
jl 0x40ac20
test eax, eax
jne 0x40b0ed
mov edx, dword [ebp + 0x14]
push edi
push 8
lea ecx, [esp + 0x2c]
push ecx
push 0x1006
push 0xffff
push edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
call sub.WSOCK32.dll_setsockopt
mov eax, dword [ebp + 0x14]
push 1
push eax
call sub.WSOCK32.dll_listen
mov byte [esp + 0x50], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.ProgramFiles
stosb byte es:[edi], al
call fcn.00497445
add esp, 4
test eax, eax
je 0x40acdd
push str.ProgramFiles
call fcn.00497445
add esp, 4
push eax
push str._s_teraterm_ttermpro.exe
push 0x104
push 0x4cf5a4
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cf5a4
call fcn.004974e3
add esp, 8
test eax, eax
jne 0x40ad40
push str.ProgramFiles
call fcn.00497445
add esp, 4
test eax, eax
je 0x40ad26
push str.ProgramFiles
call fcn.00497445
add esp, 4
push eax
push str._s_teraterm_ttermpro.exe
push 0x104
push 0x4cf5a4
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cf5a4
push str._s_localhost:_d__T1
push 0x104
lea ecx, [esp + 0x60]
push ecx
jmp 0x40b029
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
test eax, eax
je 0x40ad76
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
push eax
push str._s_teraterm_ttermpro.exe
push 0x104
push 0x4cf6a8
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cf6a8
call fcn.004974e3
add esp, 8
test eax, eax
jne 0x40add9
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
test eax, eax
je 0x40adbf
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
push eax
push str._s_teraterm_ttermpro.exe
push 0x104
push 0x4cf6a8
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cf6a8
push str._s_localhost:_d__T1
push 0x104
lea edx, [esp + 0x60]
push edx
jmp 0x40b029
push str.ProgramFiles
call fcn.00497445
add esp, 4
test eax, eax
je 0x40ae0f
push str.ProgramFiles
call fcn.00497445
add esp, 4
push eax
push str._sPuTTYputty.exe
push 0x104
push 0x4cf7ac
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cf7ac
call fcn.004974e3
add esp, 8
test eax, eax
jne 0x40ae68
push str.ProgramFiles
call fcn.00497445
add esp, 4
test eax, eax
je 0x40ae58
push str.ProgramFiles
call fcn.00497445
add esp, 4
push eax
push str._sPuTTYputty.exe
push 0x104
push 0x4cf7ac
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cf7ac
push str._s__telnet_localhost__d
jmp 0x40b01f
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
test eax, eax
je 0x40ae9e
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
push eax
push str._sPuTTYputty.exe
push 0x104
push 0x4cf8b0
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cf8b0
call fcn.004974e3
add esp, 8
test eax, eax
jne 0x40af01
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
test eax, eax
je 0x40aee7
push str.ProgramFiles_x86_
call fcn.00497445
add esp, 4
push eax
push str._sPuTTYputty.exe
push 0x104
push 0x4cf8b0
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cf8b0
push str._s__telnet_localhost__d
push 0x104
lea ecx, [esp + 0x60]
push ecx
jmp 0x40b029
push str.windir
call fcn.00497445
add esp, 4
test eax, eax
je 0x40af37
push str.windir
call fcn.00497445
add esp, 4
push eax
push str._sSysnative_telnet.exe
push 0x104
push 0x4cf9b4
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cf9b4
call fcn.004974e3
add esp, 8
test eax, eax
push str.windir
jne 0x40af9a
call fcn.00497445
add esp, 4
test eax, eax
je 0x40af80
push str.windir
call fcn.00497445
add esp, 4
push eax
push str._sSysnative_telnet.exe
push 0x104
push 0x4cf9b4
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cf9b4
push str._s__t_vt100_localhost__d
push 0x104
lea edx, [esp + 0x60]
push edx
jmp 0x40b029
call fcn.00497445
add esp, 4
test eax, eax
je 0x40afcb
push str.windir
call fcn.00497445
add esp, 4
push eax
push str._sSystem32_telnet.exe
push 0x104
push 0x4cfab8
call fcn.004893a0
add esp, 0x10
push 0
push 0x4cfab8
call fcn.004974e3
add esp, 8
test eax, eax
jne 0x40b031
push str.windir
call fcn.00497445
add esp, 4
test eax, eax
je 0x40b014
push str.windir
call fcn.00497445
add esp, 4
push eax
push str._sSystem32_telnet.exe
push 0x104
push 0x4cfab8
call fcn.004893a0
add esp, 0x10
push esi
push 0x4cfab8
push str._s__t_vt100_localhost__d
push 0x104
lea eax, [esp + 0x60]
push eax
call fcn.004893a0
add esp, 0x14
mov al, byte [esp + 0x50]
test al, al
je 0x40b07c
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x154]
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
lea eax, [esp + 0x158]
push eax
push ecx
push ecx
push 0x10
push ecx
push ecx
push ecx
mov dword [esp + 0x5c], ecx
lea ecx, [esp + 0x70]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x44]
push eax
push ecx
call sub.WSOCK32.dll_accept
cmp eax, 0xffffffff
mov dword [ebp + 0x18], eax
pop edi
je 0x40b0ed
lea edx, [esp + 0x20]
push edx
push 0x8004667e
push eax
mov dword [esp + 0x2c], 1
call sub.WSOCK32.dll_ioctlsocket
mov ecx, dword [ebp + 0x18]
push 0
push 3
lea eax, [esp + 0x10]
push eax
push ecx
mov byte [ebp + 0x11], 0
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], 0xfb
mov byte [esp + 0x1a], 1
call sub.WSOCK32.dll_send
push str.e_2l
mov ecx, ebp
call fcn.0040b100
push str.e_12h
mov ecx, ebp
call fcn.0040b100
pop esi
pop ebp
add esp, 0x31c
ret 4