Function at 0x401120
Capabilities:
Create thread
Create udp socket
Initialize winsock library
Read file via mapping
Set socket configuration
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e0
push ebx
push esi
push edi
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x1dc], 0
push 1
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
jne 0x40116a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
xor eax, eax
jmp 0x4014e8
push 0
push 0
push 1
lea eax, [ebp - 0x1bc]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x401198
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
xor eax, eax
jmp 0x4014e8
mov dword [ebp - 0x1d0], 0xc
lea eax, [ebp - 0x1bc]
mov dword [ebp - 0x1cc], eax
mov dword [ebp - 0x1c8], 0
mov word [ebp - 0x1a4], 0x101
lea eax, [ebp - 0x190]
push eax
mov eax, dword [ebp - 0x1a4]
push eax
call sub.WSOCK32.dll_WSAStartup
test eax, eax
je 0x401203
call sub.WSOCK32.dll_WSAGetLastError
mov ecx, dword [ebp - 0x1e0]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x1e0]
mov dword [eax], 0x10
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, 0x403010
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [eax + 0x10], 0
push 0x3e8
push 2
push 6
call sub.WSOCK32.dll_socket
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0xffffffff
jne 0x401263
call sub.WSOCK32.dll_WSAGetLastError
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 4
lea eax, [ebp - 0x1d4]
push eax
push 0x20
push 0xffff
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_setsockopt
lea eax, [ebp - 0x1a0]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov word [eax + 0xc], 0
mov word [ebp - 0x1a0], 6
mov word [ebp - 0x194], 0x5204
push 0xe
lea eax, [ebp - 0x1a0]
push eax
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x4012db
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x1d8]
mov dword [0x403010], eax
push 0
push 0
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x404164], eax
cmp dword [0x404164], 0
jne 0x401322
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x1c4]
push eax
push 4
push 0
push 0x401630
push 0
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x403014], eax
cmp dword [0x403014], 0
jne 0x40136c
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x1a8]
push eax
push 0
push 0
push 0x401bb0
push 0
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x403018], eax
cmp dword [0x403018], 0
jne 0x4013b6
mov eax, dword [ebp - 0x1d8]
push eax
call sub.WSOCK32.dll_closesocket
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.syb_sapexe_common_memory
push 0x24808
push 0
push 4
lea eax, [ebp - 0x1d0]
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x40301c], eax
push 0
push 0
push 0
push 2
mov eax, dword [0x40301c]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x406004], eax
cmp dword [0x406004], 0
jne 0x40140b
mov eax, dword [ebp - 0x1c0]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push str.syb_dll_to_sapexe
push 0
push 0
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [section..bss], eax
cmp dword [section..bss], 0
jne 0x401446
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
xor eax, eax
jmp 0x4014e8
push str.syb_sapexe_to_dll
push 0
push 1
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x403024], eax
cmp dword [0x403024], 0
jne 0x401481
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
xor eax, eax
jmp 0x4014e8
push 0
push 0
push 0
lea eax, [ebp - 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x404160], eax
cmp dword [0x404160], 0
jne 0x4014b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1dc], eax
xor eax, eax
jmp 0x4014e8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x403004], eax
cmp dword [0x403004], 0
jne 0x4014de
xor eax, eax
jmp 0x4014e8
mov eax, 1
jmp 0x4014e8
pop edi
pop esi
pop ebx
leave
ret