Function at 0x406ec6
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5bc
mov dword [ebp - 0x5bc], 0
push 0
push 0
push 0
push 0x50000002
push 0x190
push 0
lea edx, [ebp - 0x5b0]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
lea edx, [ebp - 0x5b0]
push edx
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
cmp eax, 0
je 0x406f70
push 0xa
push 0xd31203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x20244153
push 0x575f455a
push 0x494c4149
push 0x54494e49
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5bc], 1
jmp 0x40758d
push 0
push 1
push 2
call dword [sym.imp.ws2_32.dll_socket]
cmp eax, 0xffffffff
jne 0x406fdf
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202454
push 0x454b434f
push 0x535f4554
push 0x41455243
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5bc], 1
jmp 0x407587
mov dword [ebp - 0x5b8], eax
push dword [ebp + 8]
call dword [sym.imp.ws2_32.dll_gethostbyname]
cmp eax, 0
jne 0x40705b
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 4], eax
push 0x10
lea edx, [esp + 4]
push edx
push dword [ebp - 0x5b8]
call dword [sym.imp.ws2_32.dll_connect]
cmp eax, 0
je 0x4070e6
push 0
push 0xa0d3220
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
push 0
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x58322e25
push 0x3d660a0d
push 0xa0d6568
push 0x6361632d
push 0x6f6e203a
push 0x6c6f7274
push 0x6e6f432d
push 0x65686361
push 0x430a0d65
push 0x76696c41
push 0x2d706565
push 0x4b203a6e
push 0x6f697463
push 0x656e6e6f
push 0x430a0d38
push 0x31203a68
push 0x74676e65
push 0x4c2d746e
push 0x65746e6f
push 0x430a0d73
push 0x25203a74
push 0x736f480a
push 0xd293932
push 0x3730332e
push 0x302e3320
push 0x524c4320
push 0x54454e2e
push 0x203b3732
push 0x3730352e
push 0x302e3220
push 0x524c4320
push 0x54454e2e
push 0x203b3932
push 0x3730332e
push 0x352e3320
push 0x524c4320
push 0x54454e2e
push 0x203b4330
push 0x2e345445
push 0x4e2e203b
push 0x45302e34
push 0x54454e2e
push 0x203b302e
push 0x372f746e
push 0x65646972
push 0x54203b34
push 0x36574f57
push 0x203b332e
push 0x3620544e
push 0x2073776f
push 0x646e6957
push 0x203b302e
push 0x37204549
push 0x534d203b
push 0x656c6269
push 0x7461706d
push 0x6f632820
push 0x302e342f
push 0x616c6c69
push 0x7a6f4d20
push 0x3a746e65
push 0x67412d72
push 0x6573550a
push 0xd657461
push 0x6c666564
push 0x202c7069
push 0x7a67203a
push 0x676e6964
push 0x6f636e45
push 0x2d747065
push 0x6363410a
push 0xd757220
push 0x3a656761
push 0x75676e61
push 0x4c2d7470
push 0x65636341
push 0xa0d6465
push 0x646f636e
push 0x656c7275
push 0x2d6d726f
push 0x662d7777
push 0x772d782f
push 0x6e6f6974
push 0x6163696c
push 0x70706120
push 0x3a657079
push 0x542d746e
push 0x65746e6f
push 0x430a0d2a
push 0x2f2a203a
push 0x74706563
push 0x63410a0d
push 0x312e312f
push 0x50545448
push 0x20732520
push 0x54534f50
mov ecx, 8
mov edx, dword [ebp + 0x10]
movzx eax, byte [edx + ecx - 1]
push eax
dec ecx
jne 0x4072f3
push dword [ebp + 8]
push dword [ebp + 0xc]
lea edx, [esp + 0x28]
push edx
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x30
add esp, 0x1a0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
push 0
push eax
lea edx, [ebp - 0x420]
push edx
push dword [ebp - 0x5b8]
call dword [sym.imp.ws2_32.dll_send]
cmp eax, 0xffffffff
jne 0x4073ad
push 0
push 0xa0d3320
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
push 0
push 0x400
lea edx, [ebp - 0x420]
push edx
push dword [ebp - 0x5b8]
call dword [sym.imp.ws2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x407434
push 0
push 0xa0d3420
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
mov dword [ebp - 0x5b4], eax
push 0x4b4f20
push 0x30303220
push 0x312e312f
push 0x50545448
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x11], 0
push esp
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
add esp, 0x10
test eax, eax
je 0x4074e9
push 0xa0d31
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x24454c55
push 0x444f4d5f
push 0x54534554
push 0x5f455a49
push 0x524f4854
push 0x55415f4f
push 0x545f454c
push 0x42414e55
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
xor ecx, ecx
cmp ecx, dword [ebp - 0x5b4]
jae 0x407503
cmp dword [ebp + ecx - 0x420], 0xa0d0a0d
je 0x407503
inc ecx
jmp 0x4074eb
cmp ecx, dword [ebp - 0x5b4]
jne 0x407569
push 0xa0d32
push 0x203a2445
push 0x444f435f
push 0x524f5252
push 0x4524202c
push 0x24454c55
push 0x444f4d5f
push 0x54534554
push 0x5f455a49
push 0x524f4854
push 0x55415f4f
push 0x545f454c
push 0x42414e55
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5bc], 1
jmp 0x40757b
push 8
push dword [ebp + 0x14]
lea edx, [ebp + ecx - 0x41c]
push edx
call fcn.00407d95
push dword [ebp - 0x5b8]
call dword [sym.imp.ws2_32.dll_closesocket]
call dword [sym.imp.ws2_32.dll_WSACleanup]
add esp, 0x10
mov eax, dword [ebp - 0x5bc]
leave
ret 0x10