Function at 0x41ab80
Capabilities:
Get session user name
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
sub esp, 0x264
mov ecx, dword [0x45a1ec]
lea eax, [esp + 8]
push ebx
xor ebx, ebx
push eax
push 0x44ed58
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebx
call dword [ecx + 0x44]
cmp eax, ebx
je 0x41abea
mov eax, dword [0x45a1ec]
lea edx, [esp + 0xc]
push edx
push 0x44e440
call dword [eax + 0x44]
cmp eax, ebx
je 0x41abea
push eax
push 0x44ed28
call fcn.004243e0
add esp, 8
xor eax, eax
pop ebx
add esp, 0x264
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [0x45a1ec]
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
push ebx
call dword [edx + 0xc]
cmp eax, ebx
je 0x41ac28
push eax
push 0x44ed00
call fcn.004243e0
add esp, 8
xor eax, eax
pop ebx
add esp, 0x264
ret
push ebp
push esi
lea eax, [esp + 0x20]
push edi
push eax
push 1
push 0xf01ff
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [esp + 0x27c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x13], cl
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
lea eax, [esp + 0x2c]
push 4
lea edx, [esp + 0x30]
push eax
push ebp
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], 1
mov dword [esp + 0x6c], edx
mov dword [esp + 0x3c], 2
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, ebx
je 0x41ae9c
cmp eax, 0xffffffff
je 0x41ae9c
mov ecx, dword [esp + 0x28]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x30], eax
cmp esi, ebx
mov edi, eax
je 0x41ace1
push ebx
push esi
push edi
push ebp
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x41af22
cmp eax, ebx
je 0x41af22
sub esi, eax
add edi, eax
cmp esi, ebx
jne 0x41acbe
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x3c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x40], 2
mov eax, dword [eax + 8]
push eax
push ebx
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x64]
mov dword [esp + 0x44], eax
lea edx, [esp + 0x60]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov al, byte [esp + 0x1f]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x60]
neg al
push ecx
lea ecx, [esp + 0x2c]
sbb eax, eax
push 0x10
push ebx
and eax, ecx
push edx
push eax
mov eax, dword [0x45a1ec]
lea edx, [esp + 0x54]
push edx
call dword [eax + 0x1c]
mov esi, eax
cmp esi, 0x80090311
jg 0x41ada3
je 0x41ad9c
lea eax, [esi + 0x7ff6fd00]
cmp eax, 0xc
ja case.0x41ad6b.2146893050
xor ecx, ecx
mov cl, byte [eax + 0x41b158]
jmp dword [ecx*4 + 0x41b13c]
mov edi, 0x44ecb8
jmp 0x41aded
mov edi, 0x44ec70
jmp 0x41aded
mov edi, 0x44ec38
jmp 0x41aded
mov edi, 0x44ec08
jmp 0x41aded
mov edi, 0x44ebbc
jmp 0x41aded
mov edi, 0x44eb64
jmp 0x41aded
mov edi, 0x44eb0c
jmp 0x41aded
cmp esi, 0x90313
jg 0x41adce
je 0x41adc7
cmp esi, ebx
je 0x41adc0
cmp esi, 0x90312
jne case.0x41ad6b.2146893050
mov edi, 0x44eaf4
jmp 0x41aded
mov edi, 0x44eae8
jmp 0x41aded
mov edi, 0x44ead0
jmp 0x41aded
mov eax, esi
sub eax, 0x90314
je 0x41ade8
dec eax
je 0x41ade1
mov edi, 0x44eac0
jmp 0x41aded
mov edi, 0x44eaac
jmp 0x41aded
mov edi, 0x44ea90
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x41ae00
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x30], ebx
cmp esi, 0x90314
je 0x41ae10
cmp esi, 0x90313
jne 0x41ae44
mov edx, dword [0x45a1ec]
mov eax, dword [edx + 0x20]
cmp eax, ebx
je 0x41ae29
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
cmp esi, 0x90313
jne 0x41ae35
xor esi, esi
jmp 0x41ae48
cmp esi, 0x90314
jne 0x41ae44
mov esi, 0x90312
jmp 0x41ae48
cmp esi, ebx
jl 0x41ae6f
cmp dword [esp + 0x3c], ebx
je 0x41ae6f
push ebx
lea eax, [esp + 0x40]
push 4
push eax
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ecx
push edx
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x41ae7e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x90312
mov dword [esp + 0x44], ebx
je 0x41ae92
cmp esi, 0x90314
jne 0x41aeb9
mov byte [esp + 0x13], 1
jmp 0x41ac61
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0x44ea5c
call fcn.004243e0
add esp, 8
mov dword [esp + 0x14], ebx
jmp 0x41b0be
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
cmp esi, ebx
je 0x41aef6
cmp esi, 0x90315
je 0x41aef6
push edi
lea eax, [esp + 0x70]
push 0x44ea1c
push eax
call ebp
lea ecx, [esp + 0x78]
push esi
push ecx
call fcn.004243e0
add esp, 0x14
cmp esi, 0x90315
mov dword [esp + 0x14], ebx
jne 0x41b08a
call fcn.004237a0
test eax, eax
je 0x41b08a
mov eax, dword [0x45a1ec]
lea edx, [esp + 0x1c]
push edx
call dword [eax + 0x30]
cmp eax, ebx
je 0x41af2b
push eax
push 0x44e898
call fcn.004243e0
add esp, 8
mov dword [esp + 0x14], ebx
jmp 0x41b0be
mov ecx, dword [esp + 0x278]
lea ebx, [ecx + 0x28f4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41af4c
cmp byte [ebx], 0x2e
jne 0x41afe6
mov dl, byte [0x456160]
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x171]
mov byte [esp + 0x170], dl
mov dword [esp + 0x14], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x170]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x104
lea edx, [esp + 0x174]
push ebx
push edx
push 0
call fcn.0041b760
add esp, 0x10
test eax, eax
jne 0x41afe6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov al, byte [0x456160]
mov byte [esp + 0x6c], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x170]
lea edx, [esp + 0x6c]
stosw word es:[edi], ax
push ecx
push 0x44e870
push edx
stosb byte es:[edi], al
call ebp
lea eax, [esp + 0x78]
push esi
push eax
call fcn.004243e0
add esp, 0x14
mov edi, dword [esp + 0x278]
mov dword [0x4563a0], 0
xor esi, esi
mov ecx, dword [esi*4 + 0x44e710]
mov edx, dword [esi*4 + 0x44e6f4]
push ecx
push edx
push edi
call fcn.0041b400
add esp, 0xc
test eax, eax
jne 0x41b072
inc esi
cmp esi, 7
jb 0x41aff9
call fcn.0041b1c0
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x4563bc]
test eax, eax
je 0x41b045
push ebx
push edi
call fcn.0041b7d0
add esp, 8
mov dword [0x4563a8], eax
mov eax, dword [0x456438]
test eax, eax
je 0x41b060
push 0
push 0
push edi
call fcn.0041ba10
add esp, 0xc
mov dword [0x4563ac], eax
mov ecx, dword [0x45a1ec]
lea eax, [esp + 0x1c]
push eax
call dword [ecx + 0x34]
xor ebx, ebx
jmp 0x41b0be
test esi, esi
jne 0x41b080
mov dword [0x4563a0], 1
mov dword [esp + 0x14], 1
jmp 0x41b025
cmp esi, ebx
jne 0x41b0be
cmp dword [0x4563b0], ebx
je 0x41b0b0
mov edx, dword [esp + 0x280]
push edx
call fcn.0041b680
add esp, 4
test eax, eax
jne 0x41b0b0
mov dword [esp + 0x14], ebx
jmp 0x41b0be
mov eax, 1
mov dword [0x4563a0], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [esp + 0x24]
pop edi
pop esi
cmp eax, ebx
pop ebp
je 0x41b0dc
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x41b0f2
mov ecx, dword [0x45a1ec]
push eax
call dword [ecx + pe_nt_image_headers32]
cmp dword [esp + 0x28], ebx
jne 0x41b0fe
cmp dword [esp + 0x2c], ebx
je 0x41b10b
mov eax, dword [0x45a1ec]
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x10]
mov al, byte [esp + 7]
test al, al
je 0x41b12d
cmp dword [esp + 0x10], ebx
jne 0x41b11f
cmp dword [esp + 0x14], ebx
je 0x41b12d
mov edx, dword [0x45a1ec]
lea ecx, [esp + 0x10]
push ecx
call dword [edx + 0x24]
mov eax, dword [esp + 8]
pop ebx
add esp, 0x264
ret