Function at 0x431700
Capabilities:
Create process on windows
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f34
call fcn.00414360
mov eax, dword [0x43e268]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x4378c4
push 0x4378d0
call fcn.0041a610
add esp, 8
mov byte [0x461dba], 1
call fcn.0042c140
lea ecx, [ebp - 0x1ec8]
call fcn.00401550
mov dword [0x440500], 0x14
mov dword [0x440504], 0
movzx eax, byte [0x43f062]
test eax, eax
je 0x4317d0
call fcn.00418dc0
movzx ecx, al
test ecx, ecx
je 0x4317d0
mov edx, dword [0x461da8]
push edx
call fcn.0041a6b0
add esp, 4
mov dword [ebp - 0x1ecc], eax
mov eax, dword [ebp - 0x1ecc]
push eax
push str.netsh_interface_ipv4_delete_neighbors__d
lea ecx, [ebp - 0x1f00]
push ecx
call fcn.00407379
add esp, 0xc
push 0
lea edx, [ebp - 0x1f00]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x437900
push 0x437908
call fcn.0041a610
add esp, 8
lea eax, [ebp - 0x1f00]
push eax
push 0x437910
call fcn.0041a610
add esp, 8
cmp dword [0x4406ac], 0
jne 0x4317e6
cmp dword [0x440a08], 0
je 0x43236a
mov ecx, 1
test ecx, ecx
je 0x43236a
mov dword [0x4402f0], 0
movzx edx, byte [0x43f062]
test edx, edx
je 0x4319f3
cmp dword [0x440da4], 0
je 0x431893
mov dword [ebp - 0x1f04], 0
jmp 0x431830
mov eax, dword [ebp - 0x1f04]
add eax, 1
mov dword [ebp - 0x1f04], eax
mov ecx, dword [ebp - 0x1f04]
cmp ecx, dword [0x4402f0]
jae 0x431857
mov edx, dword [ebp - 0x1f04]
mov eax, dword [edx*4 + 0x4402f4]
cmp eax, dword [0x440d90]
jne 0x431855
jmp 0x431857
jmp 0x431821
mov ecx, dword [ebp - 0x1f04]
cmp ecx, dword [0x4402f0]
jne 0x43188f
cmp dword [0x4402f0], 0x40
jae 0x43188f
mov edx, dword [ebp - 0x1f04]
mov eax, dword [0x440d90]
mov dword [edx*4 + 0x4402f4], eax
mov ecx, dword [0x4402f0]
add ecx, 1
mov dword [0x4402f0], ecx
xor edx, edx
jne 0x431815
movzx eax, byte [0x44b43d]
test eax, eax
je 0x43191d
mov dword [ebp - 0x1f08], 0
jmp 0x4318b9
mov ecx, dword [ebp - 0x1f08]
add ecx, 1
mov dword [ebp - 0x1f08], ecx
mov edx, dword [ebp - 0x1f08]
cmp edx, dword [0x4402f0]
jae 0x4318e0
mov eax, dword [ebp - 0x1f08]
mov ecx, dword [eax*4 + 0x4402f4]
cmp ecx, dword [0x4409d8]
jne 0x4318de
jmp 0x4318e0
jmp 0x4318aa
mov edx, dword [ebp - 0x1f08]
cmp edx, dword [0x4402f0]
jne 0x431919
cmp dword [0x4402f0], 0x40
jae 0x431919
mov eax, dword [ebp - 0x1f08]
mov ecx, dword [0x4409d8]
mov dword [eax*4 + 0x4402f4], ecx
mov edx, dword [0x4402f0]
add edx, 1
mov dword [0x4402f0], edx
xor eax, eax
jne 0x43189e
mov dword [ebp - 0x1f0c], 0
jmp 0x431938
mov ecx, dword [ebp - 0x1f0c]
add ecx, 1
mov dword [ebp - 0x1f0c], ecx
cmp dword [ebp - 0x1f0c], 0x10
jge 0x4319f3
mov edx, dword [ebp - 0x1f0c]
imul edx, edx, 0x34
cmp dword [edx + 0x4406ac], 0
je 0x4319f3
mov dword [ebp - 0x1f10], 0
jmp 0x431976
mov eax, dword [ebp - 0x1f10]
add eax, 1
mov dword [ebp - 0x1f10], eax
mov ecx, dword [ebp - 0x1f10]
cmp ecx, dword [0x4402f0]
jae 0x4319a6
mov edx, dword [ebp - 0x1f0c]
imul edx, edx, 0x34
mov eax, dword [ebp - 0x1f10]
mov ecx, dword [eax*4 + 0x4402f4]
cmp ecx, dword [edx + 0x440698]
jne 0x4319a4
jmp 0x4319a6
jmp 0x431967
mov edx, dword [ebp - 0x1f10]
cmp edx, dword [0x4402f0]
jne 0x4319e6
cmp dword [0x4402f0], 0x40
jae 0x4319e6
mov eax, dword [ebp - 0x1f0c]
imul eax, eax, 0x34
mov ecx, dword [ebp - 0x1f10]
mov edx, dword [eax + 0x440698]
mov dword [ecx*4 + 0x4402f4], edx
mov eax, dword [0x4402f0]
add eax, 1
mov dword [0x4402f0], eax
xor ecx, ecx
jne 0x43195b
jmp 0x431929
movzx edx, byte [0x43f063]
test edx, edx
je 0x431c2e
mov dword [ebp - 0x1f14], 0
jmp 0x431a1d
mov eax, dword [ebp - 0x1f14]
add eax, 1
mov dword [ebp - 0x1f14], eax
mov ecx, dword [ebp - 0x1f14]
cmp ecx, dword [0x4402f0]
jae 0x431a44
mov edx, dword [ebp - 0x1f14]
mov eax, dword [edx*4 + 0x4402f4]
cmp eax, dword [0x440bb4]
jne 0x431a42
jmp 0x431a44
jmp 0x431a0e
mov ecx, dword [ebp - 0x1f14]
cmp ecx, dword [0x4402f0]
jne 0x431a7c
cmp dword [0x4402f0], 0x40
jae 0x431a7c
mov edx, dword [ebp - 0x1f14]
mov eax, dword [0x440bb4]
mov dword [edx*4 + 0x4402f4], eax
mov ecx, dword [0x4402f0]
add ecx, 1
mov dword [0x4402f0], ecx
xor edx, edx
jne 0x431a02
mov dword [ebp - 0x1f18], 0
jmp 0x431a9b
mov eax, dword [ebp - 0x1f18]
add eax, 1
mov dword [ebp - 0x1f18], eax
cmp dword [ebp - 0x1f18], 0x10
jge 0x431b58
mov ecx, dword [ebp - 0x1f18]
imul ecx, ecx, 0x1c
cmp dword [ecx + 0x440a08], 0
je 0x431b58
mov dword [ebp - 0x1f1c], 0
jmp 0x431ad9
mov edx, dword [ebp - 0x1f1c]
add edx, 1
mov dword [ebp - 0x1f1c], edx
mov eax, dword [ebp - 0x1f1c]
cmp eax, dword [0x4402f0]
jae 0x431b09
mov ecx, dword [ebp - 0x1f18]
imul ecx, ecx, 0x1c
mov edx, dword [ebp - 0x1f1c]
mov eax, dword [edx*4 + 0x4402f4]
cmp eax, dword [ecx + 0x4409f4]
jne 0x431b07
jmp 0x431b09
jmp 0x431aca
mov ecx, dword [ebp - 0x1f1c]
cmp ecx, dword [0x4402f0]
jne 0x431b4b
cmp dword [0x4402f0], 0x40
jae 0x431b4b
mov edx, dword [ebp - 0x1f18]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x1f1c]
mov ecx, dword [edx + 0x4409f4]
mov dword [eax*4 + 0x4402f4], ecx
mov edx, dword [0x4402f0]
add edx, 1
mov dword [0x4402f0], edx
xor eax, eax
jne 0x431abe
jmp 0x431a8c
mov dword [ebp - 0x1f20], 0
jmp 0x431b73
mov ecx, dword [ebp - 0x1f20]
add ecx, 1
mov dword [ebp - 0x1f20], ecx
cmp dword [ebp - 0x1f20], 0x10
jge 0x431c2e
mov edx, dword [ebp - 0x1f20]
imul edx, edx, 0x1c
cmp dword [edx + 0x440be4], 0
je 0x431c2e
mov dword [ebp - 0x1f24], 0
jmp 0x431bb1
mov eax, dword [ebp - 0x1f24]
add eax, 1
mov dword [ebp - 0x1f24], eax
mov ecx, dword [ebp - 0x1f24]
cmp ecx, dword [0x4402f0]
jae 0x431be1
mov edx, dword [ebp - 0x1f20]
imul edx, edx, 0x1c
mov eax, dword [ebp - 0x1f24]
mov ecx, dword [eax*4 + 0x4402f4]
cmp ecx, dword [edx + 0x440bd0]
jne 0x431bdf
jmp 0x431be1
jmp 0x431ba2
mov edx, dword [ebp - 0x1f24]
cmp edx, dword [0x4402f0]
jne 0x431c21
cmp dword [0x4402f0], 0x40
jae 0x431c21
mov eax, dword [ebp - 0x1f20]
imul eax, eax, 0x1c
mov ecx, dword [ebp - 0x1f24]
mov edx, dword [eax + 0x440bd0]
mov dword [ecx*4 + 0x4402f4], edx
mov eax, dword [0x4402f0]
add eax, 1
mov dword [0x4402f0], eax
xor ecx, ecx
jne 0x431b96
jmp 0x431b64
push 0x440500
push 0
push 0
push 0x4402f0
mov edx, dword [0x442040]
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x43234b
movzx eax, byte [0x43f062]
test eax, eax
je 0x431e42
cmp dword [0x440da4], 0
je 0x431d51
push 0x4402f0
mov ecx, dword [0x440d90]
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x431d51
push 0x24
push 1
call fcn.004091cb
add esp, 8
mov dword [ebp - 0x1f28], eax
cmp dword [ebp - 0x1f28], 0
je 0x431d30
mov edx, dword [ebp - 0x1f28]
mov dword [edx + 0x14], 0x10
mov eax, dword [ebp - 0x1f28]
add eax, 0x14
push eax
mov ecx, dword [ebp - 0x1f28]
add ecx, 4
push ecx
mov edx, dword [0x440d90]
push edx
call dword [sym.imp.WS2_32.dll_accept]
mov ecx, dword [ebp - 0x1f28]
mov dword [ecx], eax
mov edx, dword [ebp - 0x1f28]
cmp dword [edx], 0xffffffff
jne 0x431d1f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Accept_Failed__Error_u_n
push 0x44bd18
call fcn.00407379
add esp, 0xc
push 2
push 0x44bd18
call fcn.0041b050
add esp, 8
mov eax, dword [ebp - 0x1f28]
push eax
call fcn.0040913d
add esp, 4
jmp 0x431d2e
mov ecx, dword [ebp - 0x1f28]
push ecx
call fcn.00425900
add esp, 4
jmp 0x431d51
push 0x437940
push 0x44bd18
call fcn.00407379
add esp, 8
push 0
push 0x44bd18
call fcn.0041b050
add esp, 8
movzx edx, byte [0x44b43d]
test edx, edx
je 0x431da9
push 0x4402f0
mov eax, dword [0x4409d8]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x431da9
mov dword [ebp - 0x628], 0x10
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x638]
push edx
push 0
push 0x400
lea eax, [ebp - 0xb54]
push eax
mov ecx, dword [0x4409d8]
push ecx
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebp - 0x64c], eax
mov dword [ebp - 0x1f2c], 0
jmp 0x431dc4
mov edx, dword [ebp - 0x1f2c]
add edx, 1
mov dword [ebp - 0x1f2c], edx
cmp dword [ebp - 0x1f2c], 0x10
jge 0x431e42
mov eax, dword [ebp - 0x1f2c]
imul eax, eax, 0x34
cmp dword [eax + 0x4406ac], 0
je 0x431e42
push 0x4402f0
mov ecx, dword [ebp - 0x1f2c]
imul ecx, ecx, 0x34
mov edx, dword [ecx + 0x440698]
push edx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x431e3d
movzx eax, byte [ebp - 0x1f2c]
push eax
lea ecx, [ebp - 0xb58]
push ecx
call fcn.0041b120
add esp, 8
movzx edx, ax
test edx, edx
je 0x431e3d
lea eax, [ebp - 0xb58]
push eax
call fcn.00430990
add esp, 4
test eax, eax
je 0x431e3d
lea ecx, [ebp - 0xb58]
push ecx
call fcn.0042bf00
add esp, 4
jmp 0x431db5
movzx edx, byte [0x43f063]
test edx, edx
je 0x43234b
mov dword [ebp - 0x1f30], 0
jmp 0x431e6c
mov eax, dword [ebp - 0x1f30]
add eax, 1
mov dword [ebp - 0x1f30], eax
cmp dword [ebp - 0x1f30], 0x10
jge 0x4320cc
mov ecx, dword [ebp - 0x1f30]
imul ecx, ecx, 0x1c
cmp dword [ecx + 0x440a08], 0
je 0x4320cc
push 0x4402f0
mov edx, dword [ebp - 0x1f30]
imul edx, edx, 0x1c
mov eax, dword [edx + 0x4409f4]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4320c7
movzx ecx, byte [ebp - 0x1f30]
push ecx
lea edx, [ebp - 0x1ec8]
push edx
call fcn.00423f20
add esp, 8
movzx eax, ax
test eax, eax
je 0x4320c7
mov ecx, dword [ebp - 0x1ec8]
mov dl, byte [ecx + 3]
and dl, 0xf
movzx eax, dl
cmp eax, 4
je 0x431efb
mov ecx, dword [ebp - 0x1ec8]
mov dl, byte [ecx + 3]
and dl, 0xf
movzx eax, dl
cmp eax, 5
jne 0x431f0f
lea ecx, [ebp - 0x1ec8]
push ecx
call fcn.00419f10
add esp, 4
jmp 0x4320c7
lea edx, [ebp - 0x1ec8]
push edx
call fcn.004234b0
add esp, 4
movzx eax, ax
test eax, eax
je 0x4320a2
mov ecx, dword [ebp - 0x1ec8]
movzx edx, word [ecx + 6]
push edx
call dword [sym.imp.WS2_32.dll_htons]
movzx eax, ax
test eax, eax
je 0x43202c
movzx ecx, word [ebp - 0xb66]
cmp ecx, 6
jne 0x431f7c
push 0x437950
push 0x437958
call fcn.0041a610
add esp, 8
lea edx, [ebp - 0xec0]
push edx
push str.SOA_Sent_for_zone__s_n
call fcn.0041a610
add esp, 8
jmp 0x43202a
movzx eax, word [ebp - 0xb66]
cmp eax, 2
jne 0x431fb0
push 0x437978
push 0x437980
call fcn.0041a610
add esp, 8
lea ecx, [ebp - 0xec0]
push ecx
push str.NS_Sent_for_zone__s_n
call fcn.0041a610
add esp, 8
jmp 0x43202a
movzx edx, byte [ebp - 0xbb0]
cmp edx, 0x14
jne 0x431ff4
push 0x4379a0
push 0x4379a8
call fcn.0041a610
add esp, 8
lea eax, [ebp - 0x1ec8]
push eax
call fcn.0041d010
add esp, 4
push eax
lea ecx, [ebp - 0xec0]
push ecx
push str._s_resolved_from_Cache_to__s_n
call fcn.0041a610
add esp, 0xc
jmp 0x43202a
push 0x4379d0
push 0x4379d8
call fcn.0041a610
add esp, 8
lea edx, [ebp - 0x1ec8]
push edx
call fcn.0041d010
add esp, 4
push eax
lea eax, [ebp - 0xec0]
push eax
push str._s_resolved_Locally_to__s_n
call fcn.0041a610
add esp, 0xc
jmp 0x432091
mov ecx, dword [ebp - 0x1ec8]
mov dl, byte [ecx + 3]
and dl, 0xf
movzx eax, dl
cmp eax, 3
je 0x432053
mov ecx, dword [ebp - 0x1ec8]
mov dl, byte [ecx + 3]
and dl, 0xf
movzx eax, dl
test eax, eax
jne 0x432091
mov ecx, dword [ebp - 0x1ec8]
mov dl, byte [ecx + 3]
and dl, 0xf0
or dl, 3
mov eax, dword [ebp - 0x1ec8]
mov byte [eax + 3], dl
push 0x4379fc
push 0x437a04
call fcn.0041a610
add esp, 8
lea ecx, [ebp - 0xec0]
push ecx
push str._s_not_found_n
call fcn.0041a610
add esp, 8
lea edx, [ebp - 0x1ec8]
push edx
call fcn.00419f10
add esp, 4
jmp 0x4320c7
lea eax, [ebp - 0x1ec8]
push eax
call fcn.00429090
add esp, 4
movzx ecx, ax
test ecx, ecx
jne 0x4320c7
lea edx, [ebp - 0x1ec8]
push edx
call fcn.00419f10
add esp, 4
jmp 0x431e5d
mov dword [ebp - 0x1f34], 0
jmp 0x4320e7
mov eax, dword [ebp - 0x1f34]
add eax, 1
mov dword [ebp - 0x1f34], eax
cmp dword [ebp - 0x1f34], 0x10
jge 0x4321bc
mov ecx, dword [ebp - 0x1f34]
imul ecx, ecx, 0x1c
cmp dword [ecx + 0x440be4], 0
je 0x4321bc
push 0x4402f0
mov edx, dword [ebp - 0x1f34]
imul edx, edx, 0x1c
mov eax, dword [edx + 0x440bd0]
push eax
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4321b7
mov cl, byte [ebp - 0x1f34]
mov byte [ebp - 0xb61], cl
mov dword [ebp - 0xb84], 0x10
call fcn.00409828
mov dword [eax], 0
lea edx, [ebp - 0xb84]
push edx
lea eax, [ebp - 0xb94]
push eax
mov ecx, dword [ebp - 0x1f34]
imul ecx, ecx, 0x1c
mov edx, dword [ecx + 0x440bd0]
push edx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [ebp - 0xb98], eax
cmp dword [ebp - 0xb98], 0xffffffff
jne 0x4321a8
push 0x437a1c
push 0x437a24
call fcn.0041a610
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Accept_Failed__Error_u
call fcn.0041a610
add esp, 8
jmp 0x4321b7
lea eax, [ebp - 0x1ec8]
push eax
call fcn.00424510
add esp, 4
jmp 0x4320d8
push 0x4402f0
mov ecx, dword [0x440bb4]
push ecx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x43234b
lea edx, [ebp - 0x1ec8]
push edx
call 0x428770
add esp, 4
movzx eax, ax
test eax, eax
je 0x43234b
lea ecx, [ebp - 0x1ec8]
push ecx
call fcn.00419f10
add esp, 4
movzx edx, byte [ebp - 0xbae]
cmp edx, 0x10
jge 0x4322af
mov eax, dword [ebp - 0x1ec8]
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x432284
lea edx, [ebp - 0x1ec8]
push edx
call fcn.0041d010
add esp, 4
test eax, eax
je 0x43225c
push 0x437a44
push 0x437a4c
call fcn.0041a610
add esp, 8
push 0x43fd60
lea eax, [ebp - 0xec0]
push eax
push str._s_resolved_from_Forwarding_server_as__s_n
call fcn.0041a610
add esp, 0xc
jmp 0x432282
push 0x437a80
push 0x437a88
call fcn.0041a610
add esp, 8
lea ecx, [ebp - 0xec0]
push ecx
push str._s_resolved_from_Forwarding_server_n
call fcn.0041a610
add esp, 8
jmp 0x432296
push 0x437ab4
push 0x437abc
call fcn.0041a610
add esp, 8
lea edx, [ebp - 0xec0]
push edx
push str._s_not_found_by_Forwarding_Server_n
call fcn.0041a610
add esp, 8
jmp 0x43234b
mov eax, dword [ebp - 0x1ec8]
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x432325
lea edx, [ebp - 0x1ec8]
push edx
call fcn.0041d010
add esp, 4
test eax, eax
je 0x4322fd
push 0x437ae8
push 0x437af0
call fcn.0041a610
add esp, 8
push 0x43fd60
lea eax, [ebp - 0xec0]
push eax
push str._s_resolved_from_Child_Server_as__s_n
call fcn.0041a610
add esp, 0xc
jmp 0x432323
push 0x437b20
push 0x437b28
call fcn.0041a610
add esp, 8
lea ecx, [ebp - 0xec0]
push ecx
push str._s_resolved_from_Child_Server_n
call fcn.0041a610
add esp, 8
jmp 0x432337
push str.runProg
push 0x437b58
call fcn.0041a610
add esp, 8
lea edx, [ebp - 0xec0]
push edx
push str._s_not_found_by_Child_Server_n
call fcn.0041a610
add esp, 8
mov al, byte [0x461db9]
mov byte [0x461db8], al
movzx ecx, byte [0x461db8]
push ecx
call fcn.00426600
add esp, 4
jmp 0x4317e6
call fcn.0041d580
call dword [sym.imp.WS2_32.dll_WSACleanup]
push str.__runProg
push 0x437b8c
call fcn.0041a610
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406dc0
mov esp, ebp
pop ebp
ret