Function at 0x4039fb
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Copy file
Create process on windows
Create tcp socket
Create udp socket
Encode data using base64
Encode data using xor
Enumerate processes
Get common file path
Get socket status
Get startup folder
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Terminate process
Terminate process by name
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x610
call fcn.004057bf
lea esi, [esp + 0x47c]
mov edi, dword [sym.imp.WS2_32.dll_WSAStartup]
push esi
push 0x202
call edi
test eax, eax
jne 0x403a1c
mov edi, str._SELF_INSTALL_
push edi
call fcn.00405e7e
add esp, 4
push str.self_installing
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
lea ebx, [esp + 0x140]
push 0x104
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, eax
push edi
call fcn.00405e7e
add esp, 4
test esi, esi
je 0x403c2d
push ebx
push str.executable_path:__s
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
lea edi, [esp + 0x38]
xor eax, eax
push edi
push eax
push eax
push 7
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov esi, eax
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
test esi, esi
mov eax, str.cloudnt_get_startup_folder
jne 0x403c32
push edi
push str.startup_path:__s
call fcn.00405e7e
add esp, 8
mov eax, 0xa
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
lea esi, [esp + 0x370]
push edi
push str._smineplug.exe
push 0x104
push esi
call fcn.00405ea9
add esp, 0x10
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
push esi
push str.target_path:__s
call fcn.00405e7e
add esp, 8
mov eax, 0xa
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push esi
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x403c45
push 0
push 0xf
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x40561e
mov edi, eax
lea ebx, [esp + 0x248]
mov dword [ebx], 0x128
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 8], eax
push ebx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x405625
mov dword [esp], 0
mov esi, dword [esp + 0x250]
cmp esi, dword [esp + 8]
je 0x403c08
push 0xd
push str.mineplug.exe
lea eax, [esp + 0x274]
push eax
call fcn.00403574
add esp, 0xc
test eax, eax
jne 0x403c08
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x403c01
mov ebx, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, eax
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
test esi, esi
mov eax, str.killed_Mineplug__PID:__u
mov ecx, str.failed_to_kill_Mineplug__PID___u
cmove eax, ecx
mov ecx, dword [esp]
mov edx, 1
cmovne ecx, edx
mov dword [esp], ecx
push dword [esp + 0x250]
push eax
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ebx, [esp + 0x248]
push ebx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x403b6e
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp], 0
jne 0x405651
jmp 0x40562c
mov eax, str.cloudnt_get_executable_path
push eax
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.assigning_websocket_master
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov dword [0x40c500], 0
xor edi, edi
inc edi
mov ecx, 0xbb9a
call fcn.0040383d
cmp eax, 0xffffffff
jne 0x403cc9
inc dword [0x40c500]
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.error_assigning_websocket_master
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
cmp dword [0x40c500], 3
ja 0x405794
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403c76
mov ebx, eax
mov esi, str._MISC_
push esi
call fcn.00405e7e
add esp, 4
push ebx
push str.websocket_master_assigned:__d
call fcn.00405e7e
add esp, 8
mov edi, 0xa
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push esi
call fcn.00405e7e
add esp, 4
push str.assigning_minecraft_master
call fcn.00405e7e
add esp, 4
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov ecx, 0x63dd
call fcn.0040383d
cmp eax, 0xffffffff
jne 0x403d5a
inc dword [0x40c500]
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.error_assigning_minecraft_master
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x403d14
mov esi, eax
push str._MISC_
call fcn.00405e7e
add esp, 4
push esi
push str.minecraft_master_assigned:__d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
cmp esi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], esi
cmovg ebx, esi
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
cmp eax, ecx
mov dword [esp + 0x24c], eax
mov dword [esp + 0x248], 1
jne 0x403dc7
cmp byte [0x40c4a3], 1
mov eax, 1
mov esi, dword [esp + 0x14]
je 0x403def
jmp 0x403e7e
mov dword [esp + 0x250], ecx
mov dword [esp + 0x248], 2
mov eax, 2
cmp byte [0x40c4a3], 0
mov esi, dword [esp + 0x14]
je 0x403e7e
xor ecx, ecx
mov edx, dword [0x40c4b0]
cmp dword [esp + ecx*4 + 0x24c], edx
je 0x403e07
inc ecx
cmp eax, ecx
jne 0x403df7
jmp 0x403e0b
cmp ecx, eax
jne 0x403e33
mov ecx, dword [0x40c4b0]
mov dword [esp + eax*4 + 0x24c], ecx
mov eax, dword [esp + 0x248]
xor ecx, ecx
inc eax
mov dword [esp + 0x248], eax
mov esi, dword [0x40c4b4]
jne 0x403e39
jmp 0x403e4b
mov esi, dword [0x40c4b4]
xor ecx, ecx
cmp dword [esp + ecx*4 + 0x24c], esi
je 0x403e4b
inc ecx
cmp eax, ecx
jne 0x403e3b
mov ecx, eax
cmp ecx, eax
jne 0x403e6a
cmp eax, 0x3f
ja 0x403e6a
mov dword [esp + eax*4 + 0x24c], esi
mov eax, dword [esp + 0x248]
inc eax
mov dword [esp + 0x248], eax
mov ecx, dword [esp + 0x14]
cmp esi, ecx
cmovle esi, ecx
mov ecx, dword [0x40c4b0]
cmp ecx, esi
cmovg esi, ecx
xor ecx, ecx
xor ebx, ebx
lea edi, [esp + 0x248]
mov edx, dword [ecx + 0x41c508]
test edx, edx
jle 0x403ed8
xor edi, edi
test eax, eax
je 0x403ea9
cmp dword [esp + edi*4 + 0x24c], edx
je 0x403ea9
inc edi
cmp eax, edi
jne 0x403e99
mov edi, eax
cmp edi, eax
jne 0x403ed1
cmp eax, 0x3f
lea edi, [esp + 0x248]
ja 0x403ed8
mov dword [esp + eax*4 + 0x24c], edx
mov eax, dword [esp + 0x248]
inc eax
mov dword [esp + 0x248], eax
jmp 0x403ed8
lea edi, [esp + 0x248]
cmp edx, esi
cmovg esi, edx
cmp ecx, 0xb4
lea ecx, [ecx + 0xc]
jb 0x403e89
inc esi
push ebx
push ebx
push ebx
push edi
push esi
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x403ee9
cmp byte [0x40c4a3], 1
jne 0x4045b6
lea eax, [esp + 0x248]
push eax
push dword [0x40c4b4]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404508
push 0
push 0x10000
push 0x40c504
push dword [0x40c4b4]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [0x41c504], eax
test eax, eax
jle 0x404503
xor eax, eax
mov dword [esp + 8], eax
mov bl, byte [eax + 0x40c504]
inc dword [0x40c4fc]
mov dword [0x40c4bc], 0x40c080
mov dword [0x40c4c0], 0
mov cl, byte [0x40c491]
cmp cl, 1
mov eax, dword [0x40c48c]
jne 0x404024
test eax, eax
jle 0x404024
mov esi, dword [0x40c488]
cmp esi, 0x3ff
jg 0x403f9d
lea eax, [esi + 0x40c080]
jmp 0x40400a
xor eax, eax
cmp esi, 0x400
jne 0x403ffb
push str._MITM_
call fcn.00405e7e
add esp, 4
push str.popped_c2s_buffer
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov dword [0x40c4bc], 0x40c080
mov esi, dword [0x40c488]
mov dword [0x40c4c0], esi
call fcn.00403981
test al, al
jne 0x404503
cmp esi, 0x400
jl 0x40400c
mov eax, dword [0x40c4c0]
lea ecx, [eax + 1]
mov dword [0x40c4c0], ecx
lea eax, [eax + 0x40c080]
mov byte [eax], bl
inc esi
mov dword [0x40c488], esi
mov eax, dword [0x40c48c]
dec eax
mov dword [0x40c48c], eax
mov cl, byte [0x40c491]
test cl, cl
je 0x4040f9
mov edi, 0x40c080
test eax, eax
jg 0x404212
mov eax, dword [0x40c488]
cmp eax, 0x400
jg 0x4041fa
mov dword [esp + 0x10], eax
mov al, byte [0x40c4c4]
test al, al
jne 0x404066
cmp dword [0x40c4fc], 0x400
ja 0x404503
mov dword [0x40c4bc], 0x40c080
mov edx, dword [esp + 0x10]
mov dword [0x40c4c0], edx
mov ecx, dword [0x40c4b8]
cmp ecx, 2
je 0x40413a
test ecx, ecx
jne 0x4041e7
xor edi, edi
test edx, edx
mov eax, 0
cmovg eax, edx
neg eax
mov dword [esp + 0xc], eax
mov eax, 5
sub eax, edx
mov dword [esp], eax
mov dword [esp + 4], 0x40c080
xor ecx, ecx
xor eax, eax
inc eax
xor esi, esi
mov edx, dword [esp + 0xc]
add edx, eax
cmp edx, 1
je 0x404503
movzx ebx, byte [eax + 0x40c07f]
mov edx, ebx
and edx, 0x7f
shl edx, cl
or esi, edx
test bl, bl
jns 0x404183
inc eax
add ecx, 7
inc edi
inc dword [esp + 4]
inc dword [esp]
cmp eax, 6
jne 0x4040bc
jmp 0x404503
movzx edx, bl
and edx, 0x7f
mov byte [esp], bl
movzx ebx, byte [0x40c490]
lea ecx, [ebx*8]
sub ecx, ebx
inc bl
mov byte [0x40c490], bl
shl edx, cl
or edx, eax
mov dword [0x40c48c], edx
mov al, 1
mov edi, 0x40c080
cmp byte [esp], 0
jns 0x40420d
jmp 0x404212
test al, al
jne 0x4041e7
xor ecx, ecx
test edx, edx
mov esi, 0
cmovg esi, edx
neg esi
xor ebx, ebx
inc ebx
xor edx, edx
lea eax, [esi + ebx]
cmp eax, 1
je 0x404503
movzx eax, byte [ebx + 0x40c07f]
mov edi, eax
and edi, 0x7f
shl edi, cl
or edx, edi
test al, al
jns 0x4041cf
inc ebx
add ecx, 7
cmp ebx, 6
jne 0x404155
jmp 0x404503
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov dword [esp + 0xc], ecx
js 0x404503
test esi, esi
mov edx, dword [esp + 0x10]
jne 0x4041e7
mov ecx, eax
sub ecx, edx
xor esi, esi
inc esi
lea edx, [ecx + esi]
cmp edx, 1
je 0x404503
cmp byte [eax + esi + 0x40c07f], 0
jns 0x404297
inc esi
inc edi
inc dword [esp + 4]
inc dword [esp]
cmp esi, 6
jne 0x4041a2
jmp 0x404503
mov eax, dword [esp + 0x10]
sub eax, ebx
mov dword [esp + 4], eax
js 0x404503
test edx, edx
mov eax, dword [esp + 0x10]
je 0x40424c
call fcn.00403981
test al, al
jne 0x404503
mov edi, dword [0x40c4bc]
xor eax, eax
mov dword [0x40c488], eax
mov dword [0x40c48c], eax
mov byte [0x40c490], 0
mov byte [0x40c491], al
mov esi, dword [0x40c4b0]
mov ebx, dword [0x40c4c0]
test ebx, ebx
je 0x404236
push 0
push ebx
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
sub ebx, eax
add edi, eax
cmp eax, 0xffffffff
jne 0x40421e
mov eax, dword [esp + 8]
inc eax
cmp eax, dword [0x41c504]
jl 0x403f47
jmp 0x404508
lea ecx, [ebx + 0x40c080]
mov dword [esp + 0xc], ecx
mov ecx, ebx
sub ecx, eax
mov dword [esp], ecx
xor ecx, ecx
xor edx, edx
inc edx
xor esi, esi
mov eax, dword [esp]
add eax, edx
cmp eax, 1
je 0x404503
movzx edi, byte [ebx + edx + 0x40c07f]
mov eax, edi
and eax, 0x7f
shl eax, cl
or esi, eax
mov eax, edi
test al, al
jns 0x4042e5
inc edx
add ecx, 7
cmp edx, 6
jne 0x404264
jmp 0x404503
sub dword [esp + 0xc], esi
js 0x404503
add dword [esp + 0x10], 0xfffffffe
xor ecx, ecx
xor esi, esi
inc esi
xor eax, eax
cmp dword [esp + 0x10], edi
je 0x404503
movzx edx, byte [edi + 0x40c082]
mov ebx, edx
and ebx, 0x7f
shl ebx, cl
or eax, ebx
test dl, dl
jns 0x404435
inc esi
add ecx, 7
inc edi
inc dword [esp + 4]
inc dword [esp]
cmp ecx, 0x23
jne 0x4042ad
jmp 0x404503
sub dword [esp + 4], edx
js 0x404503
mov eax, esi
cmp dword [esp + 4], esi
jl 0x404503
mov edi, dword [esp + 0xc]
add edi, edx
lea eax, [edi + esi]
mov dword [esp + 4], eax
push str._MITM_
call fcn.00405e7e
add esp, 4
push edi
push esi
push str.og_nick___.s
call fcn.00405e7e
add esp, 0xc
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov eax, dword [0x40c4bc]
mov dword [esp + 0xc], eax
mov byte [0x40c4c4], 1
xor edi, edi
cmp byte [edi + 0x40c4cb], 0
je 0x404354
inc edi
cmp edi, 0x10
jne 0x404340
mov edi, 0x10
mov esi, str._MITM_
push esi
call fcn.00405e7e
add esp, 4
push edi
push str.new_nick_len:__d
call fcn.00405e7e
add esp, 8
mov eax, 0xa
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push esi
call fcn.00405e7e
add esp, 4
push 0x40c4cb
push edi
push str.new_nick:__.s
call fcn.00405e7e
add esp, 0xc
mov eax, 0xa
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
cmp edi, 0x80
mov edx, 1
jb 0x4043d2
xor edx, edx
mov eax, edi
mov ecx, edx
cmp edx, 3
lea edx, [edx + 1]
ja 0x4043d1
mov ecx, eax
shr ecx, 7
cmp eax, 0x3fff
mov eax, ecx
ja 0x4043b9
inc edx
mov dword [esp], edx
mov esi, ebx
sub esi, dword [esp + 4]
add esi, dword [esp + 0xc]
mov eax, dword [0x40c4bc]
add eax, ebx
mov edx, dword [0x40c4c0]
mov dword [esp + 4], edx
sub edx, ebx
mov ebx, eax
add dword [esp], edi
add esi, dword [esp]
mov ecx, eax
push esi
call fcn.0040394d
add esp, 4
add esi, dword [esp + 4]
mov dword [0x40c4c0], esi
mov esi, dword [esp]
xor eax, eax
mov ecx, edi
cmp esi, eax
je 0x404430
cmp ecx, 0x7f
jbe 0x40448a
mov edx, ecx
or dl, 0x80
mov byte [ebx + eax], dl
shr ecx, 7
inc eax
cmp eax, 5
jne 0x404416
xor eax, eax
dec eax
jmp 0x40448e
sub dword [esp + 0xc], esi
js 0x404503
mov ecx, dword [esp + 0xc]
sub ecx, eax
cmp ecx, 2
jl 0x404503
add dword [esp + 4], eax
add dword [esp], eax
mov eax, 0xfffffffb
xor ecx, ecx
xor ebx, ebx
mov edx, dword [esp]
add edx, eax
cmp edx, 0xfffffffb
je 0x404503
mov edx, dword [esp + 4]
movzx edx, byte [edx + eax + 0xa]
mov esi, edx
and esi, 0x7f
shl esi, cl
or ebx, esi
test dl, dl
jns 0x4044e0
add ecx, 7
inc eax
jne 0x40445e
jmp 0x404503
mov byte [ebx + eax], cl
inc eax
test eax, eax
setns cl
sub esi, eax
cmp esi, edi
setl dl
test eax, eax
js 0x404503
test esi, esi
js 0x404503
and cl, dl
jne 0x404503
add ebx, eax
push edi
push 0x40c4cb
push ebx
call fcn.0040354f
add esp, 0xc
push str._MITM_
call fcn.00405e7e
add esp, 4
push str.nick_replace_done
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
jmp 0x4041e7
mov dword [0x40c4b8], ebx
push str._MITM_
call fcn.00405e7e
add esp, 4
push ebx
push str.next_state___d
call fcn.00405e7e
add esp, 8
jmp 0x4044d1
call fcn.00403900
cmp byte [0x40c4a3], 1
jne 0x4045b6
lea eax, [esp + 0x248]
push eax
push dword [0x40c4b0]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x4045b6
push 0
push 0x10000
push 0x40c504
push dword [0x40c4b0]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [0x41c504], eax
test eax, eax
jle 0x4045b1
xor eax, eax
inc dword [0x40c4fc]
mov dword [esp + 8], eax
mov al, byte [eax + 0x40c504]
mov byte [0x40c080], al
mov edi, 0x40c080
mov dword [0x40c4bc], 0x40c080
mov dword [0x40c4c0], 1
mov ebx, dword [0x40c4b4]
xor esi, esi
inc esi
test esi, esi
je 0x4045a2
push 0
push esi
push edi
push ebx
call dword [sym.imp.WS2_32.dll_send]
sub esi, eax
add edi, eax
cmp eax, 0xffffffff
jne 0x40458a
mov eax, dword [esp + 8]
inc eax
cmp eax, dword [0x41c504]
jl 0x404553
jmp 0x4045b6
call fcn.00403900
lea edi, [esp + 0x248]
push edi
push dword [esp + 0x1c]
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
lea ebx, [esp + 0x140]
je 0x4048dd
cmp byte [0x40c4a2], 0
jne 0x4048b6
xor edi, edi
cmp edi, 0xffffffff
jne 0x404621
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.client_key_failed
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push 0xffffffffffffffff
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.getting_client_key
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
pxor xmm0, xmm0
movdqa xmmword [esp + 0x140], xmm0
movdqa xmmword [esp + 0x150], xmm0
mov dword [esp + 0x144], 2
mov dword [esp + 0x148], 1
lea eax, [esp + 0x38]
push eax
push ebx
push 0x40a1e2
push str.localhost
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x404809
push str._MISC_
call fcn.00405e7e
add esp, 4
push 0x40a186
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov eax, dword [esp + 0x38]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
js 0x4047ff
mov edi, eax
push str._MISC_
call fcn.00405e7e
add esp, 4
push edi
push str.socket__d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov eax, dword [esp + 0x38]
push dword [eax + 0x10]
push dword [eax + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x4047ff
mov ebx, str._MISC_
push ebx
call fcn.00405e7e
add esp, 4
push 0x40a19c
call fcn.00405e7e
add esp, 4
mov esi, 0xa
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push dword [esp + 0x38]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push ebx
call fcn.00405e7e
add esp, 4
push str.mineplug_server_found
call fcn.00405e7e
add esp, 4
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov esi, 0x5d
mov ebx, 0x40a108
test esi, esi
je 0x40478e
push 0
push esi
push ebx
push edi
call dword [sym.imp.WS2_32.dll_send]
sub esi, eax
add ebx, eax
cmp eax, 0xffffffff
jne 0x40476a
lea ebx, [esp + 0x140]
jmp 0x4045e5
xor edx, edx
mov esi, dword [sym.imp.WS2_32.dll_recv]
mov dword [0x41c504], edx
lea eax, [edx + 0x40c504]
mov ecx, 0x10000
sub ecx, edx
push 0
push ecx
push eax
push edi
call esi
mov ecx, dword [0x41c504]
lea edx, [ecx + eax]
test eax, eax
jg 0x404796
lea eax, [ecx + 0x40c4f0]
mov edx, 0x40c504
cmp eax, edx
lea ebx, [esp + 0x140]
jbe 0x4045e5
add ecx, 0xffffffec
mov eax, 0x40c504
cmp byte [eax], 0xd
jne 0x4047f6
cmp byte [eax + 1], 0xa
jne 0x4047f6
cmp byte [eax + 2], 0xd
jne 0x4047f6
cmp byte [eax + 3], 0xa
je 0x404842
inc eax
dec ecx
jne 0x4047df
jmp 0x4045e5
push dword [esp + 0x38]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
push str.SOCK_CHECK_ERR
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
add esp, 4
push str._MISC_
call fcn.00405e7e
add esp, 4
push str.cloudnt_initializate_client_by_DNS
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
xor edi, edi
dec edi
jmp 0x4045e5
movq xmm0, qword [eax + 4]
movq xmm1, qword [eax + 0xc]
movq qword [0x40c49a], xmm1
movq qword [0x40c492], xmm0
mov eax, 0xfffffff0
mov cl, byte [eax + 0x40c4a2]
add cl, 0xaf
cmp cl, 0xf0
jb 0x4045e5
inc eax
jne 0x404861
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
push str._MISC_
call fcn.00405e7e
add esp, 4
push 0x40c492
push 0x10
push str.client_key:__.s
call fcn.00405e7e
add esp, 0xc
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov byte [0x40c4a2], 1
lea edi, [esp + 0x248]
mov esi, 0x41c508
mov eax, 0x10
cmp dword [esi], 0
je 0x4048cd
add esi, 0xc
dec eax
jne 0x4048c0
jmp 0x4048dd
mov ecx, dword [esp + 0x18]
call fcn.004038ce
cmp eax, 0xffffffff
je 0x4048dd
mov dword [esi], eax
push edi
mov esi, dword [esp + 0x20]
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x404a79
push str._PROXY_
call fcn.00405e7e
add esp, 4
push str.incoming_mc_master
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov ecx, esi
call fcn.004038ce
cmp eax, 0xffffffff
je 0x404a32
cmp dword [0x40c4f0], 0
je 0x404a4e
test byte [0x40c4a3], 1
jne 0x404a4e
mov dword [esp + 8], eax
call fcn.00403900
push str._PROXY_
call fcn.00405e7e
add esp, 4
push str.creating_proxy
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov eax, dword [0x40c4f0]
cmp eax, 0x28
mov esi, 2
mov ecx, 0x17
cmove esi, ecx
mov word [esp + 0x140], si
add eax, 0xffffffea
push eax
push 0x40c4db
lea eax, [esp + 0x14a]
push eax
call fcn.0040354f
add esp, 0xc
push 0
push 1
push esi
call dword [sym.imp.WS2_32.dll_socket]
test eax, eax
je 0x4055d4
mov edi, eax
push 0x10
push ebx
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x4055d4
mov dword [0x40c4b0], edi
push str._PROXY_
call fcn.00405e7e
add esp, 4
cmp edi, 0xffffffff
je 0x4055f8
push str.created_proxy
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov eax, dword [esp + 8]
mov dword [0x40c4b4], eax
mov byte [0x40c4a3], 1
xor eax, eax
mov dword [0x40c4fc], eax
mov dword [0x40c4b8], eax
mov byte [0x40c4c4], al
mov dword [0x40c488], eax
mov dword [0x40c48c], eax
mov byte [0x40c490], al
mov byte [0x40c491], al
jmp 0x404a79
push 0xffffffffffffffff
call dword [sym.imp.WS2_32.dll_closesocket]
push str._PROXY_
call fcn.00405e7e
add esp, 4
push str.new_mc_server_is_invalid
jmp 0x404a67
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push str._PROXY_
call fcn.00405e7e
add esp, 4
push str.denied_proxy
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
xor ecx, ecx
mov dword [esp], 0x41c508
mov eax, dword [ecx + 0x41c508]
test eax, eax
je 0x4053d4
mov dword [esp + 8], ecx
lea ecx, [esp + 0x248]
push ecx
push eax
call sub.WS2_32.dll___WSAFDIsSet
mov ecx, dword [esp + 8]
test eax, eax
je 0x4053d4
push 0
push 0x10000
push 0x40c504
push dword [ecx + 0x41c508]
call dword [sym.imp.WS2_32.dll_recv]
mov dword [0x41c504], eax
test eax, eax
jle 0x40538a
mov ecx, dword [esp]
mov ecx, dword [ecx + 4]
cmp ecx, 1
je 0x404d12
test ecx, ecx
jne 0x40538a
mov dword [0x41c504], 0x10000
mov dword [esp + 0x1e8], 0xf1
lea edi, [eax + 0x40c501]
mov eax, 0x40c504
cmp edi, eax
mov ebx, 0
jbe 0x404ccc
mov edx, 0x40c504
mov dword [esp + 4], 0
mov esi, 0x40c504
mov eax, edx
movzx ecx, byte [eax]
cmp ecx, 0xd
mov byte [esi], cl
je 0x404b3f
test ecx, ecx
je 0x404b49
cmp ecx, 0xa
je 0x404b49
inc esi
inc eax
cmp esi, edi
jb 0x404b2b
jmp 0x404ccc
mov byte [esi], 0
mov eax, 0x40c504
sub esi, eax
test esi, esi
jle 0x404ccc
mov dword [esp + 0xc], edx
cmp dword [esp + 4], 0
je 0x404c73
push 0x3a
push 0x40c504
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x404cbb
mov dword [esp + 0x10], edi
mov byte [eax], 0
mov ebx, eax
mov edi, eax
cmp byte [edi + 1], 0x20
lea edi, [edi + 1]
je 0x404b8c
mov eax, dword [0x40c504]
mov ecx, 0x72677055
xor eax, ecx
mov ecx, dword [0x40c508]
mov edx, 0x656461
xor ecx, edx
or ecx, eax
jne 0x404bca
push edi
push str.websocket
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
sete byte [esp + 0x1e5]
movdqu xmm0, xmmword [0x40c504]
pcmpeqb xmm0, xmmword [str.Sec_WebSocket_VeSec_WebSocket_Key]
movdqu xmm1, xmmword [0x40c50a]
pcmpeqb xmm1, xmmword [str.bSocket_Version]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x404c09
push edi
call sub.api_ms_win_crt_convert_l1_1_0.dll_atoi
add esp, 4
mov byte [esp + 0x1e4], al
movdqu xmm0, xmmword [0x40c504]
pcmpeqb xmm0, xmmword [0x409e60]
movzx eax, word [0x40c514]
movd xmm1, eax
pcmpeqb xmm1, xmmword [0x409e70]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x404c68
movsd xmm0, qword [edi + 0x18]
lea eax, [esp + 0x1c4]
movsd qword [eax + 0x18], xmm0
movsd xmm0, qword [edi + 0x10]
movsd qword [eax + 0x10], xmm0
movq xmm0, qword [edi]
movq xmm1, qword [edi + 8]
movq qword [eax + 8], xmm1
movq qword [eax], xmm0
mov byte [ebx], 0x3a
mov edi, dword [esp + 0x10]
xor ebx, ebx
jmp 0x404cbb
push 0x409fec
push 0x40c504
call sub.api_ms_win_crt_string_l1_1_0.dll_strtok
add esp, 8
test eax, eax
je 0x404c92
mov eax, dword [eax]
mov dword [esp + 0x140], eax
push 0x409fec
push 0
call sub.api_ms_win_crt_string_l1_1_0.dll_strtok
add esp, 8
test eax, eax
je 0x404cbb
push 0x80
push eax
lea eax, [esp + 0x14c]
push eax
call fcn.0040354f
add esp, 0xc
inc dword [esp + 4]
mov edx, dword [esp + 0xc]
lea edx, [esi + edx + 2]
jmp 0x404b24
cmp byte [esp + 0x1e4], 0xd
jne 0x404d63
mov dword [esp + 0x1e8], 0xf3
pxor xmm0, xmm0
movdqa xmmword [esp + 0x3a0], xmm0
movdqa xmmword [esp + 0x390], xmm0
movdqa xmmword [esp + 0x380], xmm0
movdqa xmmword [esp + 0x370], xmm0
jmp 0x404d9d
movzx ebx, byte [0x40c504]
and ebx, 0xf
cmp ebx, 0xa
ja 0x40538a
mov ecx, 0x706
bt ecx, ebx
jae 0x40538a
movzx ecx, byte [0x40c505]
mov esi, ecx
and esi, 0x7f
cmp esi, 0x7f
mov dword [esp + 0xc], ecx
je 0x404f1d
cmp esi, 0x7e
jne 0x404f61
mov dword [esp + 4], ebx
mov ecx, 2
jmp 0x404f26
mov eax, dword [esp + 0x1e8]
pxor xmm0, xmm0
movdqa xmmword [esp + 0x3a0], xmm0
movdqa xmmword [esp + 0x390], xmm0
movdqa xmmword [esp + 0x380], xmm0
movdqa xmmword [esp + 0x370], xmm0
cmp eax, 0xf3
jne 0x404f83
lea eax, [esp + 0x1c4]
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
add eax, 0x25
mov esi, 0xf3
cmp eax, 0x40
ja 0x4052bd
push edi
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x378]
push eax
call fcn.0040354f
add esp, 0xc
lea eax, [esp + edi + 0x370]
push 0x25
push str.258EAFA5_E914_47DA_95CA_C5AB0DC85B11
push eax
call fcn.0040354f
add esp, 0xc
mov byte [esp + edi + 0x395], 0
add edi, 0x24
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov word [esp + 0x54], 0
movdqa xmm0, xmmword [0x409e80]
movdqu xmmword [esp + 0x38], xmm0
mov dword [esp + 0x48], 0xc3d2e1f0
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
pcmpeqd xmm7, xmm7
je 0x404ea8
xor eax, eax
lea esi, [esp + 0x370]
test eax, eax
jne 0x4051d8
mov al, byte [esi]
movsx ecx, word [esp + 0x54]
lea edx, [ecx + 1]
mov word [esp + 0x54], dx
mov byte [esp + ecx + 0x56], al
add dword [esp + 0x4c], 8
jne 0x404e70
inc dword [esp + 0x50]
jne 0x404e70
mov dword [esp + 0x9c], 1
cmp word [esp + 0x54], 0x40
jne 0x404e85
lea ecx, [esp + 0x38]
call fcn.0040365e
pcmpeqd xmm7, xmm7
dec edi
inc esi
mov eax, dword [esp + 0x9c]
test edi, edi
jne 0x404e3d
test eax, eax
jne 0x4051d8
cmp dword [esp + 0x98], 0
jne 0x405144
movsx eax, word [esp + 0x54]
lea ecx, [eax + 1]
cmp eax, 0x38
mov word [esp + 0x54], cx
mov byte [esp + eax + 0x56], 0x80
movzx eax, word [esp + 0x54]
jl 0x4050bc
cmp ax, 0x3f
jg 0x404ee7
movsx ecx, ax
inc eax
mov word [esp + 0x54], ax
mov byte [esp + ecx + 0x56], 0
movzx eax, word [esp + 0x54]
cmp ax, 0x40
jl 0x404ece
lea ecx, [esp + 0x38]
call fcn.0040365e
movzx eax, word [esp + 0x54]
cmp ax, 0x37
jg 0x4050db
movsx ecx, ax
inc eax
mov word [esp + 0x54], ax
mov byte [esp + ecx + 0x56], 0
movzx eax, word [esp + 0x54]
cmp ax, 0x38
jl 0x404eff
jmp 0x4050db
mov dword [esp + 4], ebx
mov ecx, 8
movzx esi, byte [ecx + 0x40c505]
lea ebx, [ecx + 1]
mov dword [esp + 0x10], ecx
lea edx, [ecx*8 + 0x7f8]
movzx edi, byte [ebx + 0x40c503]
mov ecx, edx
and cl, 0xf8
shl edi, cl
or esi, edi
dec ebx
add edx, 0xfffffff8
cmp ebx, 2
ja 0x404f3b
mov edi, dword [esp + 0x10]
lea ecx, [edi + 2]
mov ebx, dword [esp + 4]
jmp 0x404f68
xor edi, edi
mov ecx, 2
lea edx, [ecx + esi + 4]
cmp edx, eax
jne 0x40538a
cmp byte [esp + 0xc], 0
js 0x404fac
lea eax, [edi + 0x40c50a]
jmp 0x404ff1
push 0xd
push str.Sec_WebSocket_Version
push str.HTTP_1.1_400_Bad_Request_r_n_s:__d_r_n_r_nBad_request
push dword [0x41c504]
push 0x40c504
call fcn.00405ea9
add esp, 0x14
mov dword [0x41c504], eax
jmp 0x40538a
mov eax, dword [ecx + 0x40c504]
mov dword [esp + 0x140], eax
lea eax, [edi + 0x40c50a]
test esi, esi
je 0x404ff1
mov dword [esp + 4], ebx
xor ecx, ecx
xor edx, edx
mov edi, esi
mov ebx, ecx
and ebx, 3
mov bl, byte [esp + ebx + 0x140]
xor byte [eax + ecx], bl
sar edi, 0x1f
add ecx, 1
adc edx, 0
cmp ecx, esi
mov ebx, edx
sbb ebx, edi
jb 0x404fcb
mov ebx, dword [esp + 4]
cmp bl, 1
je 0x405065
movzx ecx, bl
cmp ecx, 2
jne 0x40538a
mov ecx, dword [esp]
cmp byte [ecx + 8], 0
mov ecx, dword [esp + 8]
je 0x4053d4
test esi, esi
je 0x405025
cmp esi, 0x28
je 0x405025
cmp esi, 0x1c
jne 0x4053d4
mov dword [0x40c4f0], esi
push esi
push eax
push 0x40c4c5
call fcn.0040354f
add esp, 0xc
test esi, esi
je 0x4054e0
cmp esi, 0x28
lea edi, [esp + 0x140]
je 0x4054d9
cmp esi, 0x1c
jne 0x405513
mov esi, str.join_room__ipv4_
jmp 0x4054ec
cmp esi, 0x10
jne 0x405089
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [0x40c492]
pcmpeqb xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x40542d
push str._WS_
call fcn.00405e7e
add esp, 4
mov eax, dword [esp + 8]
push dword [eax + 0x41c508]
push str.no_allow__sock___d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
jmp 0x40538a
cmp ax, 0x37
jg 0x4050db
movsx ecx, ax
inc eax
mov word [esp + 0x54], ax
mov byte [esp + ecx + 0x56], 0
movzx eax, word [esp + 0x54]
cmp ax, 0x38
jl 0x4050c2
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
bswap ecx
mov dword [esp + 0x8e], ecx
bswap eax
mov dword [esp + 0x92], eax
lea ecx, [esp + 0x38]
call fcn.0040365e
lea eax, [esp + 0x56]
pxor xmm0, xmm0
movq qword [eax + 0x38], xmm0
movq qword [eax + 0x30], xmm0
movq qword [eax + 0x28], xmm0
movq qword [eax + 0x20], xmm0
movq qword [eax + 0x18], xmm0
movq qword [eax + 0x10], xmm0
movq qword [eax + 8], xmm0
movq qword [eax], xmm0
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x98], 1
pcmpeqd xmm7, xmm7
mov eax, 0xffffffec
movdqa xmm0, xmmword [0x409e90]
movd xmm1, dword [esp + eax + 0x4c]
pshufd xmm1, xmm1, 0
movdqa xmm3, xmm0
pxor xmm3, xmm7
pslld xmm3, 3
pand xmm3, xmmword [0x409ea0]
pshuflw xmm2, xmm3, 0xfe
movdqa xmm4, xmm1
psrld xmm4, xmm2
pshuflw xmm5, xmm3, 0x54
movdqa xmm2, xmm1
psrld xmm2, xmm5
pshufd xmm3, xmm3, 0xee
pshuflw xmm5, xmm3, 0xfe
movdqa xmm6, xmm1
psrld xmm6, xmm5
punpcklqdq xmm2, xmm4
pshuflw xmm3, xmm3, 0x54
psrld xmm1, xmm3
punpckhqdq xmm1, xmm6
shufps xmm2, xmm1, 0xcc
andps xmm2, xmmword [0x409eb0]
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd dword [esp + eax + 0x34], xmm2
paddd xmm0, xmmword [0x409ec0]
add eax, 4
jne 0x405151
xor ecx, ecx
mov edx, 0xfffffffd
lea eax, [esp + 0x370]
movzx esi, byte [esp + edx + 0x23]
shr esi, 2
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax], bl
movzx esi, byte [esp + edx + 0x23]
shl esi, 4
and esi, 0x30
movzx edi, byte [esp + edx + 0x24]
shr edi, 4
mov bl, byte [esi + edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax + 1], bl
movzx esi, byte [esp + edx + 0x24]
and esi, 0xf
movzx edi, byte [esp + edx + 0x25]
shr edi, 6
mov bl, byte [edi + esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax + 2], bl
movzx esi, byte [esp + edx + 0x25]
and esi, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax + 3], bl
cmp ecx, 0x44
jge 0x40524b
add eax, 4
add ecx, 4
jmp 0x405254
mov byte [eax + 4], 0xa
add eax, 5
xor ecx, ecx
add edx, 3
cmp edx, 0xf
jb 0x4051e6
movzx edx, byte [esp + 0x32]
shr edx, 2
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax], dl
movzx edx, byte [esp + 0x32]
shl edx, 4
and edx, 0x30
movzx esi, byte [esp + 0x33]
shr esi, 4
mov dl, byte [edx + esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax + 1], dl
movzx edx, byte [esp + 0x33]
and edx, 0xf
mov dl, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_POST__client_key_HTTP_1.1_nHost:_localhost_nContent_Type:_application_json_nContent_Length:_0_n_n]
mov byte [eax + 2], dl
mov byte [eax + 3], 0x3d
cmp ecx, 0xfffffffc
jne 0x4052a9
add eax, 4
jmp 0x4052b0
mov byte [eax + 4], 0xa
add eax, 5
mov word [eax - 1], 0
mov esi, dword [esp + 0x1e8]
lea eax, [esp + 0x370]
push eax
push str.Sec_WebSocket_Accept
mov eax, str.Upgrade
push eax
push str.Connection
push str.websocket
push eax
push str.HTTP_1.1_101_Switching_Protocols_r_n_s:__s_r_n_s:__s_r_n_s:__s_r_n_r_n
push dword [0x41c504]
push 0x40c504
call fcn.00405ea9
add esp, 0x24
mov dword [0x41c504], eax
cmp esi, 0xf3
jne 0x40538a
mov edi, eax
mov eax, dword [esp + 8]
mov esi, dword [eax + 0x41c508]
mov ebx, 0x40c504
test edi, edi
je 0x40532f
push 0
push edi
push ebx
push esi
call dword [sym.imp.WS2_32.dll_send]
sub edi, eax
add ebx, eax
cmp eax, 0xffffffff
jne 0x405315
jmp 0x40538a
mov dword [0x41c504], 0x10000
xor eax, eax
inc eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x40], 0x40a230
mov dword [esp + 0x50], eax
lea ecx, [esp + 0x38]
call fcn.004035a0
mov eax, dword [esp + 8]
mov esi, dword [eax + 0x41c508]
mov edi, 0x40c504
mov ebx, dword [0x41c504]
test ebx, ebx
je 0x4053f1
push 0
push ebx
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
sub ebx, eax
add edi, eax
cmp eax, 0xffffffff
jne 0x405372
push str._WS_
call fcn.00405e7e
add esp, 4
mov esi, dword [esp + 8]
push dword [esi + 0x41c508]
push str.close__sock___d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov edi, dword [esp]
push dword [edi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, esi
pxor xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
lea eax, [ecx + 0x41c514]
mov dword [esp], eax
cmp ecx, 0xb4
lea ecx, [ecx + 0xc]
jb 0x404a82
jmp 0x403d92
mov eax, dword [esp]
mov dword [eax + 4], 1
push str._WS_
call fcn.00405e7e
add esp, 4
mov esi, dword [esp + 8]
push dword [esi + 0x41c508]
push str.open__sock___d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
mov ecx, esi
add esp, 4
jmp 0x4053d4
mov esi, dword [esp]
mov byte [esi + 8], 1
push str._WS_
call fcn.00405e7e
add esp, 4
mov eax, dword [esp + 8]
push dword [eax + 0x41c508]
push str.allow__sock___d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov dword [0x41c504], 0x10000
movzx eax, word [0x40c4f0]
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], 0
mov dword [esp + 0x148], 0x40c4c5
mov dword [esp + 0x158], 2
lea ecx, [esp + 0x140]
call fcn.004035a0
mov esi, dword [esi]
mov edi, 0x40c504
mov ebx, dword [0x41c504]
test ebx, ebx
mov ecx, dword [esp + 8]
je 0x4053d4
push 0
push ebx
push edi
push esi
call dword [sym.imp.WS2_32.dll_send]
sub ebx, eax
add edi, eax
cmp eax, 0xffffffff
jne 0x4054b4
jmp 0x40538a
mov esi, str.join_room__ipv6_
jmp 0x4054ec
mov esi, str.leave_room
lea edi, [esp + 0x140]
push str._WS_
call fcn.00405e7e
add esp, 4
push esi
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
movzx esi, word [0x40c4f0]
mov dword [0x41c504], 0x10000
movzx eax, si
mov dword [esp + 0x150], eax
mov dword [esp + 0x154], 0
mov dword [esp + 0x148], 0x40c4c5
mov dword [esp + 0x158], 2
mov ecx, edi
call fcn.004035a0
xor ecx, ecx
mov edx, 0x41c508
mov eax, dword [0x41c504]
mov dword [esp + 0xc], eax
mov dword [esp + 4], edx
mov dword [esp], ecx
mov ebx, dword [ecx + 0x41c508]
test ebx, ebx
je 0x4055b3
mov esi, 0x40c504
mov edi, dword [esp + 0xc]
test edi, edi
je 0x4055b3
push 0
push edi
push esi
push ebx
call dword [sym.imp.WS2_32.dll_send]
sub edi, eax
add esi, eax
cmp eax, 0xffffffff
jne 0x405579
mov eax, dword [esp]
push dword [eax + 0x41c508]
call dword [sym.imp.WS2_32.dll_closesocket]
pxor xmm0, xmm0
mov eax, dword [esp + 4]
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov eax, dword [esp]
lea edx, [eax + 0x41c514]
cmp eax, 0xb4
lea ecx, [eax + 0xc]
jb 0x40555f
call fcn.00403900
mov ecx, dword [esp + 8]
jmp 0x4053d4
push str.SOCK_CHECK_ERR
call sub.api_ms_win_crt_runtime_l1_1_0.dll_perror
add esp, 4
mov dword [0x40c4b0], 0xffffffff
push str._PROXY_
call fcn.00405e7e
add esp, 4
push str.proxy_is_invalid
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push dword [esp + 8]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x404a79
mov esi, str.Failed_to_take_snapshot_of_processes
jmp 0x405631
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, str.didnt_killed_Mineplug
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
push esi
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov esi, 0xfffffe0d
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0
lea eax, [esp + 0x374]
push eax
lea eax, [esp + 0x148]
push eax
call edi
test eax, eax
jne 0x405698
push 0xa
call ebx
inc esi
jne 0x405662
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
push str.couldnt_copy_the_file_to_startup_folder
jmp 0x403c33
xorps xmm0, xmm0
lea eax, [esp + 0x248]
movsd qword [eax + 4], xmm0
movsd qword [eax + 0xc], xmm0
movsd qword [eax + 0x14], xmm0
movsd qword [eax + 0x1c], xmm0
movsd qword [eax + 0x24], xmm0
movsd qword [eax + 0x2c], xmm0
movsd qword [eax + 0x34], xmm0
movsd qword [eax + 0x3c], xmm0
mov dword [eax], 0x44
xorps xmm0, xmm0
lea ecx, [esp + 0x20]
movaps xmmword [ecx], xmm0
xor edx, edx
push ecx
push eax
push edx
push edx
push 0x10
push edx
push edx
push edx
lea eax, [esp + 0x390]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
test eax, eax
je 0x405713
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
mov esi, str.client_installed_in_startup
jmp 0x405743
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed__d
call fcn.00405e7e
add esp, 8
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov esi, str.couldnt_run_installed_Mineplug_instance
push str._SELF_INSTALL_
call fcn.00405e7e
add esp, 4
push esi
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
push str._MISC_
call fcn.00405e7e
add esp, 4
test edi, edi
je 0x403c52
push str.installation_finished
call fcn.00405e7e
add esp, 4
push 0xa
call sub.api_ms_win_crt_stdio_l1_1_0.dll_putchar
add esp, 4
mov edi, 2
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret