Function at 0x425b50
Capabilities:
Connect socket
Create process on windows
Get routing table
Resolve dns

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x47977b
push eax
mov eax, 0x6958
mov dword fs:[0], esp
call fcn.00457d20
mov al, byte [0x493b50]
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov byte [esp + 0x144], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x145]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 4]
push 0x400
stosw word es:[edi], ax
add ecx, 0x1f9fa
lea edx, [esp + 0x148]
push ecx
push edx
mov dword [esp + 0x1c], ebp
stosb byte es:[edi], al
call fcn.00458800
mov eax, dword [ebp + 4]
add esp, 0xc
add eax, 0x1f9fa
lea ecx, [esp + 0x495c]
push 0x48d23c
push eax
mov byte [esp + 0x54b], 0
call fcn.00442a00
mov esi, 0x48f274
lea eax, [esp + 0x144]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x425c0d
test cl, cl
je 0x425c09
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x425c0d
add eax, 2
add esi, 2
test cl, cl
jne 0x425be5
xor eax, eax
jmp 0x425c12
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x425de8
mov eax, dword [0x4940dc]
test eax, eax
je 0x425cb3
mov edi, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0x3c
push 0x40
mov dword [esp + 0x2c], 0
call edi
mov esi, eax
lea eax, [esp + 0x24]
push 0
push eax
push esi
call sub.iphlpapi.dll_GetIpForwardTable
cmp eax, 0x7a
jne 0x425ca9
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call ebx
mov ecx, dword [esp + 0x24]
push ecx
push 0x40
call edi
lea edx, [esp + 0x24]
mov edi, eax
push 0
push edx
push edi
call sub.iphlpapi.dll_GetIpForwardTable
test eax, eax
jne 0x425ca6
mov eax, dword [edi]
xor ebp, ebp
test eax, eax
jbe 0x425ca2
lea esi, [edi + 4]
cmp dword [esi], 0
jne 0x425c98
mov eax, dword [esi + 4]
test eax, eax
jne 0x425c98
push esi
mov dword [esi + 0x24], 1
call sub.iphlpapi.dll_CreateIpForwardEntry
mov eax, dword [edi]
inc ebp
add esi, 0x38
cmp ebp, eax
jb 0x425c7f
mov ebp, dword [esp + 0x10]
push edi
call ebx
mov dword [0x4940dc], 1
xor edi, edi
push edi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
mov al, byte [esp + 0x2b]
xor ecx, ecx
mov byte [esp + 0x14], al
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
cmp esi, ecx
mov dword [esp + 0x6970], ecx
je 0x425d06
mov edx, dword [esi + 0xc]
mov eax, dword [edx]
cmp eax, ecx
je 0x425d06
push eax
mov eax, dword [esp + 0x20]
push 1
push eax
lea ecx, [esp + 0x20]
call fcn.00433e10
mov ecx, dword [esi + 0xc]
inc edi
mov eax, dword [ecx + edi*4]
test eax, eax
jne 0x425ce8
xor ecx, ecx
mov ebx, dword [esp + 0x697c]
xor eax, eax
mov esi, dword [ebx + 0x24]
cmp esi, ecx
jl 0x425d46
mov eax, dword [ebp + 4]
add eax, 0x275c4
mov edx, dword [eax + 4]
cmp edx, ecx
je 0x425d3d
mov ecx, dword [eax + 8]
mov eax, 0x2aaaaaab
sub ecx, edx
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov ecx, edx
mov eax, esi
xor edx, edx
imul eax, edi
div ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + eax*4]
push eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x144]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebx + 0x24]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jl 0x425dd0
mov ecx, dword [ebp + 4]
lea edx, [eax + eax*2]
shl edx, 6
mov ecx, dword [ecx + 0x275c8]
add edx, ecx
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
je 0x425dd0
mov eax, dword [ebp + 4]
push 0x400
mov ecx, dword [eax + 0x275c8]
mov eax, dword [ebx + 0x24]
lea edx, [eax + eax*2]
lea eax, [esp + 0x148]
shl edx, 6
add edx, ecx
push edx
push eax
call fcn.00458800
add esp, 0xc
mov byte [esp + 0x543], 0
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x6970], 0xffffffff
push ecx
call fcn.0046e6a2
add esp, 4
push 0
mov word [esp + 0x30], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 0x144]
mov word [esp + 0x2e], ax
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, dword [esp + 0x6978]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x2c]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
mov eax, dword [ebp + 4]
mov ecx, dword [eax + 0x1b9e0]
test ecx, ecx
je 0x425e8d
add eax, 0x1b9e4
push 0x48d23c
push eax
lea ecx, [esp + 0x94c]
call fcn.00442a00
lea ecx, [esp + 0x944]
call fcn.00442ac0
test eax, eax
je 0x425e8d
lea ecx, [esp + 0x944]
call fcn.00442a60
push eax
call fcn.004584b2
mov ebp, dword [esp + 0x6988]
add esp, 4
cmp ebp, eax
je 0x425f34
lea ecx, [esp + 0x944]
call fcn.00442ac0
test eax, eax
jne 0x425e57
jmp 0x425e94
mov ebp, dword [esp + 0x6984]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x6988]
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x410c]
test edx, edx
jne 0x4260fe
mov edx, dword [eax + edi*4 + 0x5118]
test edx, edx
jne 0x4260fe
mov esi, dword [esp + 0x6980]
xor ecx, ecx
mov dword [esp + 0x14], ecx
push str.reboot.ccproxy
mov dword [esp + 0x1c], ecx
push esi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
call fcn.0045c970
add esp, 8
test eax, eax
jne 0x425f3b
mov dl, byte [0x493b50]
mov ecx, 0x41
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], dl
rep stosd dword es:[edi], eax
push 0x493e40
lea eax, [esp + 0x40]
push str._sCCProxy.exe
push eax
call fcn.00457c43
add esp, 0xc
lea ecx, [esp + 0x3c]
push 5
push 0x493e40
push str._reboot
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
jmp 0x42611c
push esi
mov word [esp + 0x18], 2
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x425f6c
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x42603d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x10]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x1c9e8]
test ecx, ecx
je 0x4260a1
add eax, 0x1c9ec
push 0x48d23c
push eax
lea ecx, [esp + 0x2958]
call fcn.00442a00
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2950]
call fcn.00442ac0
test eax, eax
je 0x42609a
mov ebp, dword [sym.imp.WS2_32.dll_ntohl]
mov al, byte [0x493b50]
mov ecx, 0xff
mov byte [esp + 0x544], al
xor eax, eax
lea edi, [esp + 0x545]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x2950]
stosb byte es:[edi], al
call fcn.00442a60
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x544]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x48d1a8
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x548]
push ecx
call fcn.00457ca0
add esp, 8
test eax, eax
je 0x42604a
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
mov byte [eax], 0
inc eax
push eax
call esi
lea edx, [esp + 0x544]
mov edi, eax
push edx
call esi
mov esi, eax
jmp 0x42605c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
jmp 0x42611c
lea eax, [esp + 0x544]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov esi, eax
mov edi, esi
push edi
call ebp
push ebx
mov edi, eax
call ebp
cmp eax, edi
ja 0x426078
push esi
call ebp
push ebx
mov esi, eax
call ebp
cmp eax, esi
jae 0x425f34
lea ecx, [esp + 0x2950]
call fcn.00442ac0
test eax, eax
jne 0x425fb6
mov edi, dword [esp + 0x6988]
mov ebp, dword [esp + 0x6984]
mov ebx, dword [esp + 0x6978]
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [esp + 0x10]
mov word [esp + 0x16], ax
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x1b9dc]
test eax, eax
je 0x4260e8
cmp edi, 3
je 0x4260d2
cmp edi, 2
je 0x4260d2
cmp ebp, 0x19
je 0x4260d2
cmp ebp, 0x6e
jne 0x4260e8
lea eax, [esp + 0x14]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4260f7
xor eax, eax
jmp 0x42611c
lea edx, [esp + 0x14]
push edx
push ebx
call fcn.0041c910
test eax, eax
je 0x42611c
mov eax, 1
jmp 0x42611c
mov eax, dword [esp + 0x6980]
mov edx, dword [esp + 0x697c]
push edi
push ebp
push eax
push edx
push ebx
call fcn.00426900
dec eax
neg eax
sbb eax, eax
inc eax
mov ecx, dword [esp + 0x6968]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x6964
ret 0x14