Function at 0x414dec
Capabilities:
Create process on windows
Create thread
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xd2
push 0
push 0
dec ecx
jne 0x414df4
push ecx
push ebx
push esi
push edi
mov esi, 0x41c8a4
xor eax, eax
push ebp
push 0x415455
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x415401
lea eax, [ebp - 4]
lea edx, [ebp - 0x65d]
mov ecx, 0x641
call fcn.00404994
lea eax, [ebp - 0x65d]
mov edx, 0x641
call fcn.0040676c
mov edx, dword [ebp - 4]
mov eax, 0x41546c
call fcn.00404d04
test eax, eax
jle 0x414ed3
mov ecx, 0x41547c
mov dl, 1
mov eax, dword [0x413790]
call fcn.00413840
mov ebx, eax
push 0x41548c
lea eax, [ebp - 0x664]
push eax
mov ecx, 0x415498
mov edx, 0x4154a8
mov eax, ebx
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x664]
mov eax, esi
call fcn.00404778
push 0x41548c
lea eax, [ebp - 0x1c]
push eax
mov ecx, 0x4154b8
mov edx, 0x4154a8
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx]
push 0x4154c4
push dword [esi]
push 0x41548c
push dword [ebp - 0x1c]
push 0x4154d4
lea eax, [ebp - 0x668]
mov edx, 5
call fcn.00404a80
mov eax, dword [ebp - 0x668]
call fcn.00414990
mov edx, dword [ebp - 4]
mov eax, 0x4154e0
call fcn.00404d04
test eax, eax
jle 0x414f9e
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4154e0
call fcn.00404d04
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404c20
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4154d4
call fcn.00404d04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404c20
mov eax, dword [ebp - 4]
call fcn.004049c0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0xd
jne 0x414f5c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404c20
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 2
call fcn.00404c60
lea edx, [ebp - 4]
mov ecx, 2
mov eax, 0x4154f0
call fcn.00404ca8
lea eax, [ebp - 0x66c]
mov ecx, 0x4154d4
mov edx, dword [ebp - 4]
call fcn.00404a0c
mov eax, dword [ebp - 0x66c]
call fcn.00414990
mov edx, dword [ebp - 4]
mov eax, 0x4154fc
call fcn.00404d04
test eax, eax
jle 0x414fb9
mov dword [0x41ca5c], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, 0x41550c
call fcn.00404d04
test eax, eax
jle 0x414fd1
xor eax, eax
mov dword [0x41ca5c], eax
mov edx, dword [ebp - 4]
mov eax, 0x415520
call fcn.00404d04
test eax, eax
jle 0x415056
lea eax, [ebp - 0x10]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x415520
call fcn.00404d04
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404c20
mov eax, dword [ebp - 0x10]
mov edx, 0x415530
call fcn.00404b0c
je 0x415020
xor eax, eax
mov dword [0x41b450], eax
jmp 0x41504c
push 0x415540
push dword [esi]
push 0x415554
push 0x4154d4
lea eax, [ebp - 0x670]
mov edx, 4
call fcn.00404a80
mov eax, dword [ebp - 0x670]
call fcn.00414990
mov dword [0x41b450], 0xffffffff
mov edx, dword [ebp - 4]
mov eax, 0x415568
call fcn.00404d04
test eax, eax
jle 0x4150c4
push 0x415540
push dword [esi]
push 0x41557c
lea edx, [ebp - 0x678]
mov eax, dword [0x41ca50]
call fcn.00414904
push dword [ebp - 0x678]
push 0x415598
lea edx, [ebp - 0x67c]
mov eax, dword [0x41ca54]
call fcn.00414904
push dword [ebp - 0x67c]
push 0x4154d4
lea eax, [ebp - 0x674]
mov edx, 7
call fcn.00404a80
mov eax, dword [ebp - 0x674]
call fcn.00414990
mov edx, dword [ebp - 4]
mov eax, 0x4155b4
call fcn.00404d04
test eax, eax
jle 0x415117
push 0x415540
push dword [esi]
push 0x4155c8
lea edx, [ebp - 0x684]
mov eax, dword [0x41ca58]
call fcn.00414904
push dword [ebp - 0x684]
push 0x4154d4
lea eax, [ebp - 0x680]
mov edx, 5
call fcn.00404a80
mov eax, dword [ebp - 0x680]
call fcn.00414990
mov edx, dword [ebp - 4]
mov eax, 0x4155e4
call fcn.00404d04
test eax, eax
jle 0x415269
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4155e4
call fcn.00404d04
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404c20
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x4155f8
call fcn.00404d04
inc eax
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404c20
mov eax, dword [ebp - 4]
call fcn.004049c0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0xa
jne 0x4151a5
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404c20
mov eax, dword [ebp - 4]
call fcn.004049c0
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0xd
jne 0x4151d3
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404c20
mov eax, 0x41c89c
mov edx, dword [ebp - 4]
call fcn.00404778
mov eax, 0x41c8a0
mov edx, 0x415604
call fcn.00404778
mov edx, dword [0x41c8a0]
mov eax, dword [0x41c89c]
call fcn.00414864
test al, al
jne 0x415231
push 0x415540
push dword [esi]
push 0x415628
push 0x4154d4
lea eax, [ebp - 0x688]
mov edx, 4
call fcn.00404a80
mov eax, dword [ebp - 0x688]
call fcn.00414990
jmp 0x41525d
push 0x415540
push dword [esi]
push 0x41565c
push 0x4154d4
lea eax, [ebp - 0x68c]
mov edx, 4
call fcn.00404a80
mov eax, dword [ebp - 0x68c]
call fcn.00414990
push 0
push 0x415678
call sub.kernel32.dll_WinExec
mov edx, dword [ebp - 4]
mov eax, 0x41569c
call fcn.00404d04
test eax, eax
jle 0x4153ac
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x41569c
call fcn.00404d04
add eax, 5
push eax
mov eax, dword [ebp - 4]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 4]
pop edx
call fcn.00404c20
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004049c0
mov ecx, eax
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00404c20
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x41548c
call fcn.00404d04
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.004049c0
mov ecx, eax
mov eax, dword [ebp - 0xc]
pop edx
call fcn.00404c20
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004049c0
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.00404c20
lea eax, [ebp - 0xc]
push eax
mov edx, dword [ebp - 0xc]
mov eax, 0x41548c
call fcn.00404d04
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404c20
mov eax, dword [0x41b630]
mov edx, dword [ebp - 0xc]
call fcn.00404778
mov eax, dword [ebp - 0x14]
call fcn.0041493c
mov edx, dword [0x41b590]
mov dword [edx], eax
mov eax, dword [0x41b5dc]
mov byte [eax], 1
push 0x415540
push dword [esi]
push 0x4156ac
mov eax, dword [0x41b630]
push dword [eax]
push 0x4155f8
push dword [ebp - 0x14]
push 0x4154d4
lea eax, [ebp - 0x690]
mov edx, 7
call fcn.00404a80
mov eax, dword [ebp - 0x690]
call fcn.00414990
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x4146f4
push 0
push 0
call sub.kernel32.dll_CreateThread
lea eax, [ebp - 0x65d]
mov edx, 0x641
call fcn.0040676c
mov edx, dword [ebp - 4]
mov eax, 0x4156c0
call fcn.00404d04
test eax, eax
jle 0x415401
push 0x415540
push dword [esi]
push 0x4156d4
push 0x4154d4
lea eax, [ebp - 0x694]
mov edx, 4
call fcn.00404a80
mov eax, dword [ebp - 0x694]
call fcn.00414990
mov eax, dword [0x41b5dc]
mov byte [eax], 0
lea eax, [ebp - 0x65d]
mov edx, 0x641
call fcn.0040676c
push 0
push 0x640
lea eax, [ebp - 0x65d]
push eax
mov eax, dword [0x41c8b8]
push eax
call sub.wsock32.dll_recv
test eax, eax
jg 0x414e17
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41545c
lea eax, [ebp - 0x694]
mov edx, 0xd
call fcn.00404748
lea eax, [ebp - 0x1c]
call fcn.00404724
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404748
ret