Function at 0x41acc0
Capabilities:
Get session user name
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
sub esp, 0x264
mov ecx, dword [0x45b280]
lea eax, [esp + 8]
push ebx
xor ebx, ebx
push eax
push 0x44fd64
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], ebx
call dword [ecx + 0x44]
cmp eax, ebx
je 0x41ad2a
mov eax, dword [0x45b280]
lea edx, [esp + 0xc]
push edx
push 0x44f44c
call dword [eax + 0x44]
cmp eax, ebx
je 0x41ad2a
push eax
push 0x44fd34
call fcn.00424580
add esp, 8
xor eax, eax
pop ebx
add esp, 0x264
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [eax + 0xc]
push edx
mov edx, dword [0x45b280]
push ebx
push ebx
push ebx
push ebx
push 1
push ecx
push ebx
call dword [edx + 0xc]
cmp eax, ebx
je 0x41ad68
push eax
push 0x44fd0c
call fcn.00424580
add esp, 8
xor eax, eax
pop ebx
add esp, 0x264
ret
push ebp
push esi
lea eax, [esp + 0x20]
push edi
push eax
push 1
push 0xf01ff
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov ebp, dword [esp + 0x27c]
xor ecx, ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov byte [esp + 0x13], cl
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
lea eax, [esp + 0x2c]
push 4
lea edx, [esp + 0x30]
push eax
push ebp
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], 1
mov dword [esp + 0x6c], edx
mov dword [esp + 0x3c], 2
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, ebx
je 0x41afdc
cmp eax, 0xffffffff
je 0x41afdc
mov ecx, dword [esp + 0x28]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [esp + 0x28]
mov dword [esp + 0x30], eax
cmp esi, ebx
mov edi, eax
je 0x41ae21
push ebx
push esi
push edi
push ebp
call dword [sym.imp.WSOCK32.dll_recv]
cmp eax, 0xffffffff
je 0x41b062
cmp eax, ebx
je 0x41b062
sub esi, eax
add edi, eax
cmp esi, ebx
jne 0x41adfe
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x3c]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], edx
mov dword [esp + 0x40], 2
mov eax, dword [eax + 8]
push eax
push ebx
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [esp + 0x64]
mov dword [esp + 0x44], eax
lea edx, [esp + 0x60]
push ecx
lea eax, [esp + 0x4c]
push edx
push eax
mov al, byte [esp + 0x1f]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x60]
neg al
push ecx
lea ecx, [esp + 0x2c]
sbb eax, eax
push 0x10
push ebx
and eax, ecx
push edx
push eax
mov eax, dword [0x45b280]
lea edx, [esp + 0x54]
push edx
call dword [eax + 0x1c]
mov esi, eax
cmp esi, 0x80090311
jg 0x41aee3
je 0x41aedc
lea eax, [esi + 0x7ff6fd00]
cmp eax, 0xc
ja case.0x41aeab.2146893050
xor ecx, ecx
mov cl, byte [eax + 0x41b298]
jmp dword [ecx*4 + 0x41b27c]
mov edi, 0x44fcc4
jmp 0x41af2d
mov edi, 0x44fc7c
jmp 0x41af2d
mov edi, 0x44fc44
jmp 0x41af2d
mov edi, 0x44fc14
jmp 0x41af2d
mov edi, 0x44fbc8
jmp 0x41af2d
mov edi, 0x44fb70
jmp 0x41af2d
mov edi, 0x44fb18
jmp 0x41af2d
cmp esi, 0x90313
jg 0x41af0e
je 0x41af07
cmp esi, ebx
je 0x41af00
cmp esi, 0x90312
jne case.0x41aeab.2146893050
mov edi, 0x44fb00
jmp 0x41af2d
mov edi, 0x44faf4
jmp 0x41af2d
mov edi, 0x44fadc
jmp 0x41af2d
mov eax, esi
sub eax, 0x90314
je 0x41af28
dec eax
je 0x41af21
mov edi, 0x44facc
jmp 0x41af2d
mov edi, 0x44fab8
jmp 0x41af2d
mov edi, 0x44fa9c
mov eax, dword [esp + 0x30]
cmp eax, ebx
je 0x41af40
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x30], ebx
cmp esi, 0x90314
je 0x41af50
cmp esi, 0x90313
jne 0x41af84
mov edx, dword [0x45b280]
mov eax, dword [edx + 0x20]
cmp eax, ebx
je 0x41af69
lea ecx, [esp + 0x48]
lea edx, [esp + 0x1c]
push ecx
push edx
call eax
cmp esi, 0x90313
jne 0x41af75
xor esi, esi
jmp 0x41af88
cmp esi, 0x90314
jne 0x41af84
mov esi, 0x90312
jmp 0x41af88
cmp esi, ebx
jl 0x41afaf
cmp dword [esp + 0x3c], ebx
je 0x41afaf
push ebx
lea eax, [esp + 0x40]
push 4
push eax
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ecx
push edx
push ebp
call dword [sym.imp.WSOCK32.dll_send]
mov eax, dword [esp + 0x44]
cmp eax, ebx
je 0x41afbe
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp esi, 0x90312
mov dword [esp + 0x44], ebx
je 0x41afd2
cmp esi, 0x90314
jne 0x41aff9
mov byte [esp + 0x13], 1
jmp 0x41ada1
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push 0x44fa68
call fcn.00424580
add esp, 8
mov dword [esp + 0x14], ebx
jmp 0x41b1fe
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
cmp esi, ebx
je 0x41b036
cmp esi, 0x90315
je 0x41b036
push edi
lea eax, [esp + 0x70]
push 0x44fa28
push eax
call ebp
lea ecx, [esp + 0x78]
push esi
push ecx
call fcn.00424580
add esp, 0x14
cmp esi, 0x90315
mov dword [esp + 0x14], ebx
jne 0x41b1ca
call fcn.00423940
test eax, eax
je 0x41b1ca
mov eax, dword [0x45b280]
lea edx, [esp + 0x1c]
push edx
call dword [eax + 0x30]
cmp eax, ebx
je 0x41b06b
push eax
push 0x44f8a4
call fcn.00424580
add esp, 8
mov dword [esp + 0x14], ebx
jmp 0x41b1fe
mov ecx, dword [esp + 0x278]
lea ebx, [ecx + 0x28f4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x41b08c
cmp byte [ebx], 0x2e
jne 0x41b126
mov dl, byte [0x4571f0]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x171]
mov byte [esp + 0x170], dl
mov dword [esp + 0x14], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x170]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x104
lea edx, [esp + 0x174]
push ebx
push edx
push 0
call fcn.0041b8a0
add esp, 0x10
test eax, eax
jne 0x41b126
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov al, byte [0x4571f0]
mov byte [esp + 0x6c], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x6d]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x170]
lea edx, [esp + 0x6c]
stosw word es:[edi], ax
push ecx
push 0x44f87c
push edx
stosb byte es:[edi], al
call ebp
lea eax, [esp + 0x78]
push esi
push eax
call fcn.00424580
add esp, 0x14
mov edi, dword [esp + 0x278]
mov dword [0x457430], 0
xor esi, esi
mov ecx, dword [esi*4 + 0x44f71c]
mov edx, dword [esi*4 + 0x44f700]
push ecx
push edx
push edi
call fcn.0041b540
add esp, 0xc
test eax, eax
jne 0x41b1b2
inc esi
cmp esi, 7
jb 0x41b139
call fcn.0041b300
mov dword [esp + 0x14], eax
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x45744c]
test eax, eax
je 0x41b185
push ebx
push edi
call fcn.0041b910
add esp, 8
mov dword [0x457438], eax
mov eax, dword [0x4574c8]
test eax, eax
je 0x41b1a0
push 0
push 0
push edi
call fcn.0041bb50
add esp, 0xc
mov dword [0x45743c], eax
mov ecx, dword [0x45b280]
lea eax, [esp + 0x1c]
push eax
call dword [ecx + 0x34]
xor ebx, ebx
jmp 0x41b1fe
test esi, esi
jne 0x41b1c0
mov dword [0x457430], 1
mov dword [esp + 0x14], 1
jmp 0x41b165
cmp esi, ebx
jne 0x41b1fe
cmp dword [0x457440], ebx
je 0x41b1f0
mov edx, dword [esp + 0x280]
push edx
call fcn.0041b7c0
add esp, 4
test eax, eax
jne 0x41b1f0
mov dword [esp + 0x14], ebx
jmp 0x41b1fe
mov eax, 1
mov dword [0x457430], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
mov eax, dword [esp + 0x24]
pop edi
pop esi
cmp eax, ebx
pop ebp
je 0x41b21c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], ebx
cmp eax, ebx
je 0x41b232
mov ecx, dword [0x45b280]
push eax
call dword [ecx + 0x40]
cmp dword [esp + 0x28], ebx
jne 0x41b23e
cmp dword [esp + 0x2c], ebx
je 0x41b24b
mov eax, dword [0x45b280]
lea edx, [esp + 0x28]
push edx
call dword [eax + 0x10]
mov al, byte [esp + 7]
test al, al
je 0x41b26d
cmp dword [esp + 0x10], ebx
jne 0x41b25f
cmp dword [esp + 0x14], ebx
je 0x41b26d
mov edx, dword [0x45b280]
lea ecx, [esp + 0x10]
push ecx
call dword [edx + 0x24]
mov eax, dword [esp + 8]
pop ebx
add esp, 0x264
ret