Function at 0x401480
Capabilities:
Create process on windows
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x40a054]
mov dword [esp + 0x118], eax
xor eax, eax
mov dword [esp + 5], eax
push ebx
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
push esi
push edi
mov byte [esp + 0x20], al
mov word [esp + 0x1d], ax
mov ecx, 0x1f
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0x10]
cmp ax, 0x10
mov byte [esp + 0x10], 0
jne 0x40153f
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x40afc8]
push 0xd9
push 0x2e
lea edx, [esp + 0x18]
push 0xf
push edx
mov dword [esp + 0x20], eax
mov byte [esp + 0x28], 0x11
mov byte [esp + 0x29], 0x34
mov dword [esp + 0x2a], ecx
call fcn.00401300
mov esi, dword [ebp + 0xc]
add esp, 0x10
push 0
push 0xf
lea eax, [esp + 0x18]
push eax
push esi
call sub.WS2_32.dll_send
cmp eax, 0xffffffff
je 0x401563
mov edx, dword [ebp + 8]
push 0x21
push 0x464
push edx
push esi
call sub.WS2_32.dll_WSAAsyncSelect
xor eax, eax
mov ecx, dword [esp + 0x124]
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 1
jne 0x4017fb
mov esi, dword [ebp + 0xc]
push 0
push 0x80
lea eax, [esp + 0x28]
push eax
push esi
call sub.WS2_32.dll_recv
cmp eax, 0xffffffff
jne 0x401592
mov ecx, dword [ebp + 8]
push 0
push 0x464
push ecx
push esi
call sub.WS2_32.dll_WSAAsyncSelect
push esi
call sub.WS2_32.dll_closesocket
mov eax, 1
mov ecx, dword [esp + 0x124]
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xd9
push 0x2e
lea edx, [esp + 0x28]
push 0x80
push edx
call fcn.00401280
mov ebx, dword [ebp + 8]
add esp, 0x10
push 0
push 0x464
push ebx
push esi
call sub.WS2_32.dll_WSAAsyncSelect
push esi
call sub.WS2_32.dll_closesocket
mov eax, dword [esp + 0x2a]
mov dl, byte [esp + 0x29]
mov cx, word [esp + 0x2e]
mov dword [0x40af88], eax
mov ax, word [esp + 0x44]
mov word [0x40afd0], ax
cmp byte [esp + 0x28], 1
mov byte [esp + 0xf], dl
mov word [0x40af8c], cx
jne 0x40161b
test dl, 2
je 0x4017d1
test dl, 0x10
je 0x4017d1
push 0x40
push 0x4082e8
lea ecx, [esp + 0x50]
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4017d1
test dl, 2
je 0x401648
test dl, 0x10
je 0x401638
push 0x40
push 0x4082e8
lea edx, [esp + 0x50]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
test byte [esp + 0xf], 8
jne 0x40181b
jmp 0x4017d1
test dl, 4
je 0x40181b
mov ecx, 8
mov esi, 0x4082c4
lea edi, [esp + 0xa0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
test dl, 0x10
mov ecx, 0x17
lea edi, [esp + 0xc1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x40175d
lea eax, [esp + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x50
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + eax + 0xa8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
push 0x4082e8
lea eax, [esp + 0xa8]
push eax
push ebx
call esi
cmp eax, 6
jne 0x40172b
push 5
push 0x40b1f0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x401709
push 0
push 0x4082c0
push 0x40b1f0
push ebx
call esi
push 0x30
push 0x4082b8
push 0x408284
push ebx
call esi
push 0
push 0
push 0
push str.http:__www.bywg.com_xiazai.htm
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [esp + 0x124]
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [esp + 0xf], 8
je 0x4017d1
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
push str.http:__www.bywg.com_xiazai.htm
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4017d1
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
push 0x4082e8
lea ecx, [esp + 0xa8]
push ecx
push ebx
call esi
cmp eax, 6
jne 0x4017bd
push 5
push 0x40b1f0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x40179b
push 0x30
push 0x4082b8
push 0x408284
push ebx
call esi
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
mov ecx, dword [esp + 0x124]
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test byte [esp + 0xf], 8
je 0x4017d1
push 0
push 0
push 0x10
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x3fa
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
mov ecx, dword [esp + 0x124]
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ax, 0x20
jne 0x40181b
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0
push 0x464
push edx
push esi
call sub.WS2_32.dll_WSAAsyncSelect
push esi
call sub.WS2_32.dll_closesocket
mov ecx, dword [esp + 0x124]
xor eax, eax
call fcn.00402837
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret