Function at 0x402ec0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Query or enumerate registry value
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1798
call fcn.0042d850
mov eax, dword [0x445824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x177c], edi
call edx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, 0xa
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
push 0x534
push eax
lea eax, [ebp - 0x1750]
push eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov byte [esi + 0x28], 0xca
call fcn.00422ed0
push edi
lea ecx, [ebp - 0x1750]
push 0x29a
push ecx
call fcn.00420322
add esp, 0x18
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
call edi
mov ebx, eax
push ebx
call fcn.0041de98
mov edx, dword [ebp - 0x177c]
add esp, 4
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push edx
push 0
push 0
mov dword [ebp - 0x1774], eax
call edi
mov eax, dword [ebp - 0x1774]
push 0x7c
push eax
call fcn.004203c0
add esp, 8
test eax, eax
jne 0x403390
push 0x208
push eax
lea ecx, [ebp - 0x1014]
push ecx
mov dword [ebp - 0x1770], eax
call fcn.00422ed0
push 0x208
lea edx, [ebp - 0x121c]
push 0
push edx
call fcn.00422ed0
push 0x208
lea eax, [ebp - 0xe0c]
push 0
push eax
call fcn.00422ed0
add esp, 0x24
lea ecx, [ebp - 0x1770]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1784], 0x104
mov dword [ebp - 0x1774], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x1784]
push edx
mov edx, dword [ebp - 0x1770]
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1774]
push ecx
push 0
push 0x43da8c
push edx
call ebx
test eax, eax
jne 0x40336e
lea eax, [ebp - 0x1784]
push eax
mov eax, dword [ebp - 0x1770]
lea ecx, [ebp - 0x121c]
push ecx
lea edx, [ebp - 0x1774]
push edx
push 0
push 0x43da94
push eax
call ebx
lea ecx, [ebp - 0x1784]
push ecx
mov ecx, dword [ebp - 0x1770]
lea edx, [ebp - 0xe0c]
push edx
lea eax, [ebp - 0x1774]
push eax
push 0
push 0x43da9c
push ecx
call ebx
push 0x3ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1014]
push eax
push 0
push 0
call edi
push 0
push 0
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x1014]
push edx
push 0
push 0
call edi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4030e7
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00403da0
add esp, 4
cmp byte [ebp - 0x404], 0
lea ebx, [ebp - 0x404]
je 0x40312a
movzx edx, byte [ebx]
push edx
call fcn.0042084f
add esp, 4
test eax, eax
je 0x40337b
inc ebx
cmp byte [ebx], 0
jne 0x403110
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403133
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403164
sub ecx, dword [ebp - 0x1778]
push eax
push 0x44f080
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call ebx
push 0x3ff
lea ecx, [ebp - 0x803]
push 0
push ecx
mov byte [ebp - 0x804], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x121c]
push edx
push 0
push 0
call edi
push 0
push 0
push eax
lea eax, [ebp - 0x804]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x121c]
push ecx
push 0
push 0
call edi
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031e0
sub eax, edx
lea edx, [ebp - 0x804]
push edx
mov edx, eax
call fcn.00403da0
add esp, 4
lea eax, [ebp - 0x804]
call fcn.00403e20
test al, al
je 0x40337b
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403216
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x804]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403241
sub ecx, dword [ebp - 0x1778]
push eax
push 0x44faf0
inc ecx
push ecx
lea eax, [ebp - 0x804]
push eax
push 0
push 0
call ebx
push 0x3ff
lea ecx, [ebp - 0xc03]
push 0
push ecx
mov byte [ebp - 0xc04], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0xe0c]
push edx
push 0
push 0
call edi
push 0
push 0
push eax
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xe0c]
push ecx
push 0
push 0
call edi
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
jmp 0x4032c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032c0
sub eax, edx
lea edx, [ebp - 0xc04]
push edx
mov edx, eax
call fcn.00403da0
add esp, 4
lea eax, [ebp - 0xc04]
call fcn.00403e20
test al, al
je 0x40337b
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4032f6
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0xc04]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403321
sub ecx, dword [ebp - 0x1778]
push eax
push 0x450560
inc ecx
push ecx
lea eax, [ebp - 0xc04]
push eax
push 0
push 0
call ebx
mov ecx, dword [ebp - 0x1770]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x177c]
push edx
push 0x29a
push 0x450a98
call fcn.00420322
add esp, 0xc
jmp 0x4033eb
mov eax, dword [ebp - 0x1770]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x450a98
lea ecx, [ebp - 0x1750]
push 0x43daa4
push ecx
call fcn.00402de0
push 0x44f080
lea edx, [ebp - 0x1750]
push 0x43daac
push edx
call fcn.00402de0
push 0x44faf0
lea eax, [ebp - 0x1750]
push 0x43dab4
push eax
call fcn.00402de0
push 0x450560
lea ecx, [ebp - 0x1750]
push 0x43dabc
push ecx
call fcn.00402de0
add esp, 0x30
push 6
push 1
push 2
mov byte [esi + 0x29], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x64], eax
cmp eax, 0xffffffff
je 0x40337b
push 0
push 0
push 0
push 0
push 0x450a98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x450a98
push 0
push 0
call edi
mov dword [ebp - 0x177c], eax
inc eax
push eax
call fcn.0041de98
mov edx, dword [ebp - 0x177c]
add esp, 4
push 0
push 0
push edx
mov ebx, eax
push ebx
push 0x450a98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x450a98
push 0
push 0
call edi
mov eax, dword [ebp - 0x177c]
push ebx
mov byte [ebx + eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
mov edi, eax
call fcn.0041fa53
add esp, 4
test edi, edi
je 0x40337b
mov edx, dword [ebp + 0xc]
mov ecx, 2
push edx
mov word [ebp - 0x176c], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x176a], ax
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [esi + 0x64]
push 0x10
lea eax, [ebp - 0x176c]
push eax
push ecx
mov dword [ebp - 0x1768], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40337b
mov eax, dword [esi + 0x64]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 0x1780]
push edx
push 0x1001
push 0xffff
mov ebx, 0x40000
push eax
mov dword [ebp - 0x1780], ebx
call edi
mov edx, dword [esi + 0x64]
push 4
lea ecx, [ebp - 0x1780]
push ecx
push 0x1002
push 0xffff
push edx
mov dword [ebp - 0x1780], ebx
call edi
mov ecx, dword [esi + 0x64]
push 4
lea eax, [ebp - 0x178c]
push eax
push 0x1006
push 0xffff
push ecx
mov dword [ebp - 0x178c], 0x7530
call edi
mov eax, dword [esi + 0x64]
push 4
lea edx, [ebp - 0x1790]
push edx
push 8
push 0xffff
mov ebx, 1
push eax
mov dword [ebp - 0x1790], ebx
call edi
test eax, eax
jne 0x403593
push eax
push eax
lea ecx, [ebp - 0x1794]
push ecx
push eax
push eax
mov eax, dword [esi + 0x64]
push 0xc
lea edx, [ebp - 0x175c]
push edx
push 0x98000004
push eax
mov dword [ebp - 0x175c], ebx
mov dword [ebp - 0x1758], 0x2bf20
mov dword [ebp - 0x1754], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebp - 0x1788]
push ecx
push 0
push esi
push 0x403600
push 0
push 0
mov dword [ebp - 0x1788], 0
call fcn.004205ce
lea edx, [ebp - 0x1798]
push edx
push 0
push esi
push 0x403710
push 0
push 0
mov dword [esi + 0x5c], eax
call fcn.004205ce
mov ecx, dword [ebp - 4]
add esp, 0x30
pop edi
mov dword [esi + 0x60], eax
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8