Function at 0x43a460
Capabilities:
Create tcp socket
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x55d68c]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x248], ecx
push 0x56bcb8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x56bca0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x56bcd0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call fcn.0043f7e0
push 0
push 0
push 0x439ec0
call fcn.00457fcd
add esp, 0xc
cmp eax, 0xffffffff
jne 0x43a4bf
mov eax, 4
jmp 0x43a811
call fcn.0042e2b0
cmp eax, 0xffffffff
jne 0x43a4d3
mov eax, 5
jmp 0x43a811
call fcn.004d7a80
call fcn.00476bb0
call fcn.004d7c30
mov dword [ebp - 0x10], 0
call fcn.004d5a50
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004d48f0
add esp, 4
mov ecx, dword [ebp - 0x248]
mov dword [ecx + 0x150], eax
mov dword [ebp - 4], 0
push 0
push 0
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x150]
push eax
call fcn.004d3a40
add esp, 0xc
push 0x54ed94
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
push eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 0x150]
push edx
call fcn.004d3a30
add esp, 8
push str._____BEGIN_CERTIFICATE______nMIID6TCCAtGgAwIBAgIUclGVDzNzVa2PXLPcSDa_rFPLpwwDQYJKoZIhvcNAQEL_nBQAwWjELMAkGA1UEBhMCQ04xEDAOBgNVBAcMB0JlaUppbmcxEjAQBgNVBAoMCU1p_nY3JvZG9uZTENMAsGA1UECwwEdGVjaDEWMBQGA1UEAwwNU2VjdXJpdHkgUm9vdDAg_nFw0yMzAzMTcwNDAzNTVaGA8yMTIzMDIyMTA0MDM1NVowYjELMAkGA1UEBhMCQ04x_nEDAOBgNVBAgMB0JlaWppbmcxEDAOBgNVBAcMB0JlaWppbmcxEjAQBgNVBAoMCU1p_nY3JvZG9uZTENMAsGA1UECwwEdGVjaDEMMAoGA1UEAwwDU1NMMIIBIjANBgkqhkiG_n9w0BAQEFAAOCAQ8AMIIBCgKCAQEAoAmvzZoNnbBsVVjGcR_efYoRSq0X82BwdlnE_nNlh2iQILLpH8sY3SVydct6nuGhVVZ_tmbRDd_qk_BBvik2OTyCsNT9oeBiIhRX_nzDWc7UrALil9kfaZSvxu50x1g2jAsAqRw79t72SJmXSnSoKtEpXCXk37kkQ_mZ_nWrt_u2Psu4hgzmg1eLxSJFhhMHVEsJZij1qADOwXeUCf50G7oEdQgRDUpdyhCZkh_nPlz9wTdvoauF2BbpeF3mr2qZf1rS6WeuQDDooQyGBKc91mCdooae2hDjlasAz8_n2q8znmM7JIfpmtRMtgQGZqUIPdEPn2uKRT6mV9W2SinoE_EN2QIDAQABo4GcMIGZ_nMB8GA1UdIwQYMBaAFMWH7O3QMHzpQq5XoilELl10KqhEMAkGA1UdEwQCMAAwCwYD_nVR0PBAQDAgTwMD8GA1UdEQQ4MDaCCWxvY2FsaG9zdIIBKoIJMTI3LjAuMC4xggM6_nOjGHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwHQYDVR0OBBYEFBFwOO_5m_WNgdWQ_nPX1MYm1KtmxNMA0GCSqGSIb3DQEBCwUAA4IBAQCRBh1dZS5UsARbEWyj8SLMb6a_nddL98lzbYAA3oDey7ChKEZ2Jd43ysQQmvV7V7aqS12NbNTZdHhz1pSlOCi1jisCE_nriJl_AQcrPMiwxFAzRDkdtXUgM9H4nsizcBCKJ_tENrRdCWM4MiqaY0AtAg8tqAy_nF5sq9qbLSCGApjde9XRi8XG7yHnS7TNhRHd8MTMZBf7mYEXov8cBi4yRZ9NWqP_njw0_79Wm3WP08y_uY2Mk7XjOhAcKlGJ0mlDtqHl9Pgzpc56a91qBWXnapBuO4Uw_nlAO0ftMwYJAlA0jpA5DmXbIcmLYgTGygyuikgdU9CRbtLxwFsgWdtBjD7jQ_n_____END_CERTIFICATE_____
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
mov dword [ebp - 0x3c], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x3c]
push eax
call fcn.00472640
add esp, 8
mov dword [ebp - 0x34], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.0046fd20
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x150]
push ecx
call fcn.004d7a10
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 0x34], 0
je 0x43a5b3
mov edx, dword [ebp - 0x34]
push edx
call fcn.0046de40
add esp, 4
mov dword [ebp - 0x34], 0
push str._____BEGIN_ENCRYPTED_PRIVATE_KEY______nMIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIj3qdK1wKjzACAggA_nMAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBDawGnGD4nkwta0gq0qSCK6BIIE_n0GmhRyLdH650ca8j5K18UK_qEplKqzybwHPmcpbgtX2110hTdfQ1KTEEgk5lDEd_n9cdRPTGX35ZybM8rPwW6QqmkWkWvrcVjaoARO56DDDdRAbAlev1RbDTra7TIYRt_nnYMMwzpQBWcYFGEUrSQ0VBtoAvEc7AZpoYu0ZdgcFXdE1l3h4nY2jNArK8G_Wia_n2z_MvDIakSshjsA7gt10PPPvhadM_MmInzAgzi4qQzA6E2a5Khpmx4BJ2VG943F_nyFC090GmK5xk6BvTluy3HUb620KA2vMuxhgfpZ4XsfYM2skJjuzcGuk2yR1J9x3_npcfe6Pm44j8GCtoxNd4bZTX5RXProjHj2ScNckfps8qUKNj76sKWN_8UcuXl_V6N_nB6bw6QOJVsS108rDsCCVMZXB6daB0m_dDBOmFOpHj0CyztRrP1XZyOyb52ZcAP0_nssJQjLndVFL5qAefee3TjbLTgg1DdfPujVltHSRzB_GqeMTHUAUMeBqKhl8NHgn_nzaVAt8fqyj9ELOAv9LO0bP0yHG9ulNbpev4APiMCefoAFhAF3vSOXJXVxgwwtn_n4JyVoIQYjAohWVzFbvEnX7NZpAlIkyuqhDPjP4R4qxoeW7e_mFG4_sJwRdaTcwAM_nqZ3OpUeIYiuNkX_aL4r37ZxFw9FilluZrY8RP_GXqCXOvyDACYegpXjnIU2ZwwL_n5IDVp8txNcENuFsk2F9XvJs8XLLnZfaWfzQmCNfMcSPaIlgsee71hFmXY9idtRZt_nSCCb8XjC5ssEshNyLd0H0cIWdBumKaYo7b_or7tLguqusyBgOrhk2qFFFCsMruH_nIZMzshEWy5RMMT0G23udfOP9oBGJjp0GFO0rcsSHvdc9QNRLtnN2BIwKgPbJOQ_nL_vUFtvDW0HJ0EfOPrvEO1a8V6ou4WcN1IldAY9uwwlpjJWQqbAwnDzyV_HBVlR_nvxXQ6zO7waxEVf6ApkAcguQslkPmRPTt1zbm2yzMrcwzUOT2rUFKJFUQ6dKPgB_n948TTzs6BTDTMibVRu03z0SFan4mOCQZFCLXMxarbv71k2IoX2ok5K4q15kfa5P_nA_WET23d4e3iTBwGFTcqad5y3ViTP1CaokTGLTH8TvLyVx8vdt6D3rtF9PsBxKH_nSzyM6sLMJ4l6BsUytX1PQRmWk1R4GG2DQJ0cvt64ggVQ6i3C4IDVXQ9nDsE2uu3I_nqLd7abdpNLuX4uKVFR0f8cfs65XblN2YwazT0PqvGfFQLWZAF2li6o0Xxa2MA7_nMIWpBrJZAATLdz6MNk6qx3rvZ4FTAYmhDjxVNIJb_jlfYdbtRHd3DjRIXe5ACU_nFqsXaQAr62vEq7w6RjuafsUPA7JgKTWnRjawGecXOkB4EG0wwSCPwvqosIr4NVeO_nPCAvRLCd6dUGOcoUNULlnLzvsxdMr7elknAnLNZNl5jJGSCPdrxTLi4W10sRYV_nQuX6WOljU_jGm9H8CUuhczk1OqZ4n1vkgJdfGtailRmYPSc30QX4QEsHrtjnS9_n9AOMnwWDm8cAf0IBeIjHp7gTAeXn6yk_1JQufFHKogDnng6a8yzMKmGy9VLmAAes_nI2iwxg0_m4kOAQU07aB3p92iTrHa2cQcGf2k_OFrNWKh_n_____END_ENCRYPTED_PRIVATE_KEY_____
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
mov dword [ebp - 0xc], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
call fcn.00472640
add esp, 8
mov dword [ebp - 0x38], eax
push str.19052fb0
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.00476dd0
add esp, 0x10
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x38], 0
je 0x43a60a
mov edx, dword [ebp - 0x38]
push edx
call fcn.0046de40
add esp, 4
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 0x150]
push edx
call fcn.004d78d0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x150]
push ecx
call fcn.004d2e30
add esp, 4
mov dword [ebp - 4], eax
push str.ECDHE_RSA_AES256_GCM_SHA384:ECDHE_ECDSA_AES256_GCM_SHA384:ECDHE_RSA_AES256_SHA384:ECDHE_ECDSA_AES256_SHA384:ECDHE_RSA_AES256_SHA:ECDHE_ECDSA_AES256_SHA:SRP_DSS_AES_256_CBC_SHA:SRP_RSA_AES_256_CBC_SHA:DHE_DSS_AES256_GCM_SHA384:DHE_RSA_AES256_GCM_SHA384:DHE_RSA_AES256_SHA256:DHE_DSS_AES256_SHA256:DHE_RSA_AES256_SHA:DHE_DSS_AES256_SHA:DHE_RSA_CAMELLIA256_SHA:DHE_DSS_CAMELLIA256_SHA:ECDH_RSA_AES256_GCM_SHA384:ECDH_ECDSA_AES256_GCM_SHA384:ECDH_RSA_AES256_SHA384:ECDH_ECDSA_AES256_SHA384:ECDH_RSA_AES256_SHA:ECDH_ECDSA_AES256_SHA:AES256_GCM_SHA384:AES256_SHA256:AES256_SHA:CAMELLIA256_SHA:PSK_AES256_CBC_SHA:ECDHE_RSA_DES_CBC3_SHA:ECDHE_ECDSA_DES_CBC3_SHA:SRP_DSS_3DES_EDE_CBC_SHA:SRP_RSA_3DES_EDE_CBC_SHA:EDH_RSA_DES_CBC3_SHA:EDH_DSS_DES_CBC3_SHA:ECDH_RSA_DES_CBC3_SHA:ECDH_ECDSA_DES_CBC3_SHA:DES_CBC3_SHA:PSK_3DES_EDE_CBC_SHA:ECDHE_RSA_AES128_GCM_SHA256:ECDHE_ECDSA_AES128_GCM_SHA256:ECDHE_RSA_AES128_SHA256:ECDHE_ECDSA_AES128_SHA256:ECDHE_RSA_AES128_SHA:ECDHE_ECDSA_AES128_SHA:SRP_DSS_AES_128_CBC_SHA:SRP_RSA_AES_128_CBC_SHA:DHE_DSS_AES128_GCM_SHA256:DHE_RSA_AES128_GCM_SHA256:DHE_RSA_AES128_SHA256:DHE_DSS_AES128_SHA256:DHE_RSA_AES128_SHA:DHE_DSS_AES128_SHA:DHE_RSA_SEED_SHA:DHE_DSS_SEED_SHA:DHE_RSA_CAMELLIA128_SHA:DHE_DSS_CAMELLIA128_SHA:ECDH_RSA_AES128_GCM_SHA256:ECDH_ECDSA_AES128_GCM_SHA256:ECDH_RSA_AES128_SHA256:ECDH_ECDSA_AES128_SHA256:ECDH_RSA_AES128_SHA:ECDH_ECDSA_AES128_SHA:AES128_GCM_SHA256:AES128_SHA256:AES128_SHA:SEED_SHA:CAMELLIA128_SHA:PSK_AES128_CBC_SHA:ECDHE_RSA_RC4_SHA:ECDHE_ECDSA_RC4_SHA:ECDH_RSA_RC4_SHA:ECDH_ECDSA_RC4_SHA:RC4_SHA:RC4_MD5:PSK_RC4_SHA:EDH_RSA_DES_CBC_SHA:EDH_DSS_DES_CBC_SHA:DES_CBC_SHA:EXP_EDH_RSA_DES_CBC_SHA:EXP_EDH_DSS_DES_CBC_SHA:EXP_DES_CBC_SHA:EXP_RC2_CBC_MD5:EXP_RC4_MD5
mov edx, dword [ebp - 0x248]
mov eax, dword [edx + 0x150]
push eax
call fcn.004d3440
add esp, 8
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ecx, dword [ebp - 0x248]
mov dword [ecx + 0x104], eax
mov edx, dword [ebp - 0x248]
cmp dword [edx + 0x104], 0xffffffff
jne 0x43a6a6
push 0x550144
call fcn.0043c740
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0xfffffffe
jmp 0x43a811
mov eax, 2
mov word [ebp - 0x24], ax
mov dword [ebp - 0x20], 0
movzx ecx, word [ebp + 0xc]
push ecx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
push 0x10
lea edx, [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x104]
push ecx
call dword [sym.imp.WS2_32.dll_bind]
mov dword [ebp - 0x28], eax
call fcn.00457ebd
mov dword [eax], 0
cmp dword [ebp - 0x28], 0xffffffff
jne 0x43a7ca
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2740
jne 0x43a794
mov byte [ebp - 0x240], 0
push 0xff
push 0
lea edx, [ebp - 0x23f]
push edx
call fcn.004611e0
add esp, 0xc
mov byte [ebp - 0x140], 0
push 0xff
push 0
lea eax, [ebp - 0x13f]
push eax
call fcn.004611e0
add esp, 0xc
lea ecx, [ebp - 0x140]
push ecx
lea edx, [ebp - 0x240]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
call fcn.004400b0
add esp, 0x10
mov dword [ebp - 0x244], eax
lea ecx, [ebp - 0x240]
push ecx
mov edx, dword [ebp - 0x244]
push edx
push 0x550154
call fcn.0043c740
add esp, 0xc
cmp dword [ebp - 0x244], 0
jle 0x43a794
push 0x5501a0
call fcn.0043c740
add esp, 4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00457ebd
mov eax, dword [eax]
push eax
push str.binding_failure_cruntime_errno__d__wsock_errno__d
call fcn.0043c740
add esp, 0xc
mov ecx, dword [ebp - 0x248]
mov edx, dword [ecx + 0x104]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, 0xfffffffd
jmp 0x43a811
push 0xa
mov eax, dword [ebp - 0x248]
mov ecx, dword [eax + 0x104]
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
jne 0x43a7eb
mov eax, 0xfffffffc
jmp 0x43a811
mov edx, dword [ebp - 0x248]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x248]
mov edx, dword [eax + 0x18]
call edx
mov eax, dword [ebp + 0xc]
push eax
push str.Listening__d_..._n
call fcn.00456d47
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00455328
mov esp, ebp
pop ebp
ret 0xc