Function at 0x401b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x32c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x33c]
push edi
mov ebp, ecx
mov eax, dword [esi + 0xc]
mov edi, dword [esi + 0x18]
cmp eax, reloc.WSOCK32.dll_closesocket
mov dword [esp + 0x1c], edi
je 0x401ca3
cmp eax, reloc.WSOCK32.dll_connect
je 0x401bbe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x32c
ret 4
mov eax, dword [esp + 0x340]
mov ebx, dword [ebp + 0xd0]
lea esi, [ebp + 0xcc]
lea edi, [eax + 8]
mov ecx, esi
push edi
call fcn.004044e0
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x401bf4
mov edx, dword [edi]
cmp edx, dword [eax + 0xc]
jb 0x401bf4
lea eax, [esp + 0x14]
jmp 0x401bfc
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x20]
cmp dword [eax], ebx
je 0x401c87
mov eax, dword [edi]
lea ecx, [esp + 0x40]
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
call fcn.00402d40
mov ecx, eax
push 0xcc
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
mov edx, dword [ecx + 4]
push eax
mov ecx, ebp
mov dword [esp + 0x20], edx
call fcn.00402640
push edi
mov ecx, esi
call fcn.004048b0
push edi
mov ecx, esi
mov dword [esp + 0x20], eax
call fcn.004044e0
mov ebx, eax
mov eax, dword [esp + 0x1c]
cmp ebx, eax
mov dword [esp + 0x20], ebx
je 0x401c75
lea ecx, [esp + 0x20]
call fcn.00403430
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
jne 0x401c60
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x40]
push edx
push ebx
push eax
mov ecx, esi
call fcn.004029e0
mov ecx, dword [edi]
push ecx
mov ecx, ebp
call fcn.00402730
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x32c
ret 4
mov edx, dword [esi + 8]
lea eax, [esp + 0x40]
lea ecx, [esp + 0x30]
push eax
push ecx
lea ecx, [ebp + 0xac]
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], 0
call fcn.00402d40
mov edx, eax
mov eax, dword [edx]
mov ecx, dword [edx + 4]
mov eax, dword [eax + 0x10]
lea edx, [esp + 0x70]
mov dword [esp + 0x18], ecx
push edx
push eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x78], 0x10007
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov ebx, dword [ebp + 0xc0]
mov dword [esp + 0x4c], edi
lea edi, [ebp + 0xbc]
lea eax, [esp + 0x4c]
push eax
mov ecx, edi
call fcn.00404840
mov ecx, dword [edi + 4]
mov dword [esp + 0x14], eax
cmp eax, ecx
je 0x401d23
mov edx, dword [esp + 0x4c]
cmp edx, dword [eax + 0xc]
jb 0x401d23
lea eax, [esp + 0x14]
jmp 0x401d2b
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x20]
cmp dword [eax], ebx
je 0x402626
mov eax, dword [esi + 8]
mov ecx, ebp
push eax
call fcn.004026e0
mov ecx, dword [esp + 0x130]
mov edx, dword [esp + 0x128]
mov esi, dword [esp + 0x1c]
or ch, 1
dec edx
mov dword [esp + 0x130], ecx
mov dword [esp + 0x128], edx
lea ecx, [esp + 0x30]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x38], esi
mov byte [esp + 0x3c], 0
call fcn.004034e0
mov ecx, eax
mov eax, dword [ecx]
mov al, byte [eax + 0x10]
mov edx, dword [ecx + 4]
push eax
push esi
mov ecx, ebp
mov dword [esp + 0x2c], edx
call fcn.00402640
mov eax, dword [0x408030]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, esi
jne 0x4020aa
mov al, byte [ebp + 0x7c]
test al, al
je 0x4020aa
mov eax, dword [esp + 0x11c]
cmp eax, 0x2f1
jae 0x401df1
cmp eax, 0x210
jbe 0x401df1
mov ecx, dword [0x408308]
mov edx, eax
and edx, 0xff
mov dword [ecx*4 + 0x4082a8], edx
inc ecx
cmp ecx, 5
mov dword [0x408308], ecx
jne 0x401df1
mov dword [0x408308], 0
cmp eax, 0xf1
jae 0x4020aa
cmp eax, 0x10
jbe 0x4020aa
mov ecx, dword [0x408304]
test ecx, ecx
jne 0x401e43
and eax, 0xff
mov dword [0x408304], 1
mov dword [0x4082bc], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x18], 0x14e
mov dword [esp + 0x1c], 0x1e
push 8
lea ecx, [esp + 0x1c]
jmp 0x402098
cmp ecx, 1
jne 0x401ed0
mov eax, dword [0x4082bc]
mov edi, 0xa0
and eax, 0xf0
cmp eax, 0xa0
jge 0x401e64
sub edi, eax
mov edx, 1
lea ecx, [edx + edi]
mov eax, 0x4082a8
cmp ecx, dword [eax]
je 0x401e81
add eax, 4
cmp eax, 0x4082c4
jge 0x401e89
jmp 0x401e71
inc edx
cmp edx, 5
jge 0x401e96
jmp 0x401e69
mov dword [0x4082c4], ecx
mov dword [esp + 0x11c], ecx
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x18]
mov dword [0x408304], 2
mov ecx, dword [ebp + 0x70]
push 8
add eax, 0xffffffa0
push edx
push eax
mov dword [esp + 0x24], 0x15d
mov dword [esp + 0x28], 0x1e
push ecx
jmp 0x4020a8
cmp ecx, 2
jne 0x401f19
mov ecx, dword [esp + 0x124]
and eax, 0xff
lea edx, [esp + 0x30]
mov dword [0x4082c0], eax
push edx
lea eax, [esp + 0x18]
mov dword [0x408304], 3
mov edx, dword [ebp + 0x70]
push 8
add ecx, 0xffffffa0
push eax
push ecx
mov dword [esp + 0x24], 0x147
mov dword [esp + 0x28], 0x46
push edx
jmp 0x4020a8
cmp ecx, 3
jne 0x402061
mov eax, dword [0x4082c0]
and eax, 0xf0
cmp eax, 0xa0
mov dword [esp + 0x48], eax
jle 0x401f40
mov eax, 0xa0
mov dword [esp + 0x48], eax
mov ebx, 1
mov byte [esp + 0x10], 1
mov dword [esp + 0x20], ebx
mov cl, byte [esp + 0x10]
test cl, cl
je 0x40201e
mov edi, 1
mov dword [esp + 0x14], edi
mov cl, byte [esp + 0x10]
test cl, cl
je 0x402010
cmp ebx, 0xa
mov esi, ebx
mov ecx, edi
jle 0x401f7d
mov esi, 0xa
cmp edi, 0xa
jle 0x401f87
mov ecx, 0xa
cdq
and edx, 0xf
add eax, edx
sar eax, 4
add eax, ecx
mov ecx, 0xa
add eax, esi
cdq
idiv ecx
test edx, edx
jne 0x401ff6
mov eax, edi
mov edx, 1
shl ebx, 4
shl eax, 4
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
lea esi, [ebx + edx]
lea edi, [eax + edx]
mov eax, 0x4082a8
mov ecx, dword [eax]
cmp esi, ecx
je 0x401fd6
cmp edi, ecx
je 0x401fd6
add eax, 4
cmp eax, 0x4082c8
jge 0x401fde
jmp 0x401fc0
inc edx
cmp edx, 5
jge 0x401ff6
jmp 0x401fb1
mov dword [0x4082c8], esi
mov dword [esp + 0x11c], esi
mov dword [0x4082cc], edi
mov byte [esp + 0x10], 0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x48]
inc edi
cmp edi, 0xf
mov dword [esp + 0x14], edi
jl 0x401f63
inc ebx
cmp ebx, 0xf
mov dword [esp + 0x20], ebx
jl 0x401f4e
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x18]
mov dword [0x408304], 4
mov ecx, dword [ebp + 0x70]
push 8
add eax, 0xffffffa0
push edx
push eax
push ecx
mov dword [esp + 0x28], 0x156
mov dword [esp + 0x2c], 0x46
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x4020aa
cmp ecx, 4
jne 0x4020aa
mov edx, dword [0x4082cc]
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x120], edx
mov dword [0x408304], 0
mov dword [esp + 0x18], 0x165
mov dword [esp + 0x1c], 0x46
push 8
lea ecx, [esp + 0x1c]
mov edx, dword [esp + 0x12c]
mov eax, dword [ebp + 0x70]
add edx, 0xffffffa0
push ecx
push edx
push eax
call ebx
mov edi, dword [esp + 0x1c]
mov eax, dword [0x408034]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, edi
jne 0x40212f
mov al, byte [ebp + 0x7c]
test al, al
je 0x40212f
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x18]
push 4
add eax, 0xc
push edx
push eax
push ecx
call esi
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x30]
push edx
mov edx, dword [ebp + 0x70]
lea eax, [esp + 0x24]
push 0x10
add ecx, 0x6c
push eax
push ecx
push edx
call esi
cmp dword [esp + 0x20], 0xcf
jne 0x40212f
cmp dword [esp + 0x24], 0x35
jne 0x40212f
cmp dword [esp + 0x28], 0x133
jne 0x40212f
cmp dword [esp + 0x2c], 0x67
jne 0x40212f
mov dword [esp + 0x11c], 0xa
mov byte [0x408300], 1
cmp dword [0x408038], edi
jne 0x40216b
mov al, byte [ebp + 0x7c]
test al, al
je 0x40214a
mov byte [esp + 0x10], 0xeb
mov byte [esp + 0x11], 0
jmp 0x402154
mov byte [esp + 0x10], 0x75
mov byte [esp + 0x11], 0x63
mov edx, dword [ebp + 0x70]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
push 2
push ecx
push 0x4068ec
push edx
call ebx
cmp dword [0x40804c], edi
jne 0x4022bf
mov al, byte [ebp + 0x7c]
test al, al
je 0x4022bf
mov edx, dword [esp + 0x124]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0x70]
lea ecx, [esp + 0x34]
push 0x10
add edx, 0xffffffa4
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esp + 0x30], 0x14d
jne 0x4022bf
cmp dword [esp + 0x38], 0x1a7
jne 0x4022bf
mov edi, dword [0x40830c]
mov esi, dword [esp + 0x34]
cmp edi, esi
jae 0x4021d5
mov edi, esi
mov dword [0x40830c], edi
mov eax, dword [0x408310]
mov ecx, dword [esp + 0x3c]
cmp eax, ecx
jae 0x4021e9
mov eax, ecx
mov dword [0x408310], eax
cmp edi, esi
jbe 0x40225e
cmp eax, ecx
jbe 0x40225e
mov dl, byte [0x408300]
test dl, dl
je 0x40225e
mov ecx, dword [esp + 0x11c]
mov edx, dword [ebp + 0x80]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea eax, [esp + 0x10]
lea edi, [ecx + 0xb8]
push eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov edx, dword [ebp + 0x70]
push 4
push ecx
push edi
push edx
call ebx
mov edx, dword [ebp + 0x70]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
push 4
add edi, 4
push ecx
push edi
push edx
mov dword [esp + 0x34], 0
call ebx
mov edi, dword [0x40830c]
mov eax, dword [0x408310]
mov ecx, dword [esp + 0x3c]
mov esi, dword [esp + 0x34]
jmp 0x402264
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp edi, esi
jne 0x4022bf
cmp eax, ecx
jne 0x4022bf
mov al, byte [0x408300]
test al, al
je 0x4022bf
mov eax, dword [esp + 0x11c]
mov ecx, dword [ebp + 0x80]
lea edx, [esp + 0x10]
lea edi, [eax + 0xb8]
push edx
neg ecx
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ecx
mov ecx, dword [ebp + 0x70]
push 4
push eax
push edi
push ecx
call ebx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push 4
add edi, 4
push eax
push edi
push ecx
mov dword [esp + 0x34], 0xffffffff
call ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [0x40803c]
cmp eax, ebx
jne 0x4023eb
mov al, byte [ebp + 0x7c]
test al, al
je 0x4023eb
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x50]
mov esi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x124]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ebp + 0x70]
lea eax, [esp + 0x34]
push 4
add ecx, 0xffffffc0
push eax
push ecx
push edx
call esi
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0x70]
lea ecx, [esp + 0x54]
push 0x20
push ecx
push edx
push eax
call esi
lea edi, [esp + 0x50]
lea eax, [ebp + 0x88]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [edi]
jne 0x402350
test cl, cl
je 0x40234c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [edi + 1]
jne 0x402350
add eax, 2
add edi, 2
test cl, cl
jne 0x40232c
xor eax, eax
jmp 0x402355
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [ebp + 0x80]
jne 0x40239d
neg eax
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x18]
push 4
add eax, 0xffffffcc
push edx
push eax
push ecx
mov dword [esp + 0x34], 0xffffffff
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push 4
jmp 0x4023d7
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x18]
push 4
add eax, 0xffffffcc
push edx
push eax
push ecx
mov dword [esp + 0x34], 0
call esi
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push 4
mov ecx, dword [esp + 0x12c]
mov edx, dword [ebp + 0x70]
add ecx, 0xffffffd0
push eax
push ecx
push edx
call esi
jmp 0x4023f1
mov esi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [0x408044], ebx
jne 0x4024b5
mov edx, dword [esp + 0x134]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [ebp + 0x70]
push 8
push ecx
push edx
push eax
mov dword [esp + 0x44], 0
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x40246e
mov al, byte [ebp + 0x7c]
test al, al
je 0x402450
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x34]
push 4
add eax, 0x30
push edx
push eax
push ecx
call esi
jmp 0x4024bb
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x10]
push edx
mov edx, dword [ebp + 0x70]
lea eax, [ebp + 0x80]
push 4
add ecx, 0x30
push eax
push ecx
push edx
call ebx
jmp 0x4024bb
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp + 0x70]
lea eax, [esp + 0x10]
lea edi, [ebp + 0x84]
push eax
push 4
add ecx, 0x30
push edi
push ecx
push edx
call ebx
mov eax, dword [ebp + 0x80]
mov ecx, dword [edi]
add ecx, eax
mov al, byte [ebp + 0x7c]
test al, al
mov dword [edi], ecx
je 0x4024bb
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 0x70]
lea ecx, [esp + 0x10]
add edx, 0x30
push ecx
push 4
push edi
push edx
push eax
call esi
jmp 0x4024bb
mov ebx, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, dword [esp + 0x1c]
mov eax, dword [0x408048]
cmp eax, edi
jne 0x40256e
mov eax, dword [esp + 0x134]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x24]
push 4
add eax, 8
push edx
push eax
push ecx
call ebx
mov eax, dword [esp + 0x120]
test eax, eax
mov al, byte [ebp + 0x7c]
jne 0x402514
test al, al
je 0x40256e
mov eax, dword [esp + 0x20]
mov ecx, dword [ebp + 0x70]
lea edx, [esp + 0x14]
push edx
push 8
push 0x4081d8
push eax
push ecx
call esi
jmp 0x40256e
test al, al
je 0x40256e
mov edx, dword [ebp + 0x84]
xor ecx, ecx
xor edi, edi
mov eax, 0x4081f4
cmp edx, dword [0x4082a4]
jae 0x402545
cmp edx, dword [eax - 0x10]
jb 0x402538
cmp edx, dword [eax]
jb 0x40254c
add eax, 0x10
inc edi
cmp eax, 0x4082b4
jl 0x402527
jmp 0x40254e
mov ecx, 0xc
jmp 0x40254e
mov ecx, edi
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
shl ecx, 4
push edx
add ecx, 0x4081d8
push 8
push ecx
mov ecx, dword [ebp + 0x70]
push eax
push ecx
call esi
mov edi, dword [esp + 0x1c]
cmp dword [0x408040], edi
jne 0x4025dd
mov al, byte [ebp + 0x7c]
test al, al
jne 0x4025bf
mov al, byte [0x4082ff]
test al, al
je 0x40259f
mov eax, dword [ebp + 0x70]
lea edx, [esp + 0x14]
push edx
push 0x17
push 0x4082e8
push 0x420598
push eax
call esi
jmp 0x4025dd
mov edx, dword [ebp + 0x70]
lea ecx, [esp + 0x14]
push ecx
push 0x17
push 0x4082e8
push 0x420598
push edx
call ebx
mov byte [0x4082ff], 1
jmp 0x4025dd
mov ecx, dword [ebp + 0x70]
lea eax, [esp + 0x14]
push eax
push 0x17
push 0x4082d0
push 0x420598
push ecx
call esi
mov byte [ebp + 0xa8], 1
mov edx, dword [esp + 0x340]
lea ecx, [esp + 0x30]
push ecx
lea ecx, [ebp + 0xcc]
mov eax, dword [edx + 8]
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0
call fcn.00402d40
mov ecx, eax
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x40]
mov dword [eax + 0x10], edi
lea eax, [esp + 0x70]
push eax
push ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x32c
ret 4