Function at 0x401050
Capabilities:
Contain obfuscated stackstrings
Create tcp socket via raw afd driver

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x4c], 0xffffffff
push 1
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0xffffffff
push edi
push 0x2000000
lea eax, [ebp - 0x4c]
movlpd qword [ebp - 0x48], xmm0
push eax
mov ebx, ecx
movlpd qword [ebp - 0x58], xmm0
movups xmmword [ebp - 0x90], xmm0
mov dword [ebp - 0x40], edi
movq qword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x3c], 0x1e0f00
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x38], 0x4f646641
mov dword [ebp - 0x34], 0x506e6570
mov dword [ebp - 0x30], 0x656b6361
mov dword [ebp - 0x2c], 0x585874
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], 0x473def60
mov byte [ebp - 8], 0xfe
call dword [0x4053ec]
mov esi, eax
test esi, esi
jne 0x40123e
push 0x100
push eax
lea eax, [ebp - 0x48]
push eax
push 0x1337
push dword [ebp - 0x4c]
call dword [0x4053f0]
mov esi, eax
test esi, esi
jne 0x40123e
mov ecx, str.DeviceAfdEndpoint
mov dword [ebp - 0x54], str.DeviceAfdEndpoint
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401140
sub ecx, edx
mov dword [ebp - 0x90], 0x18
sar ecx, 1
push 0x39
mov dword [ebp - 0x84], 0x40
lea eax, [ecx + ecx]
mov word [ebp - 0x58], ax
mov word [ebp - 0x56], ax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x40]
push eax
push 0
push 1
push 3
push 0
push 0
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x90]
push eax
push 0x2000000
lea eax, [ebp - 0x50]
push eax
call dword [0x4053f4]
mov esi, eax
test esi, esi
jne 0x40123e
mov eax, dword [ebp - 0x4c]
push 4
push 0x3000
push 0x2000
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x78], eax
call esi
push 4
push 0x3000
push 0x2000
push 0
mov dword [ebp - 0x74], eax
call esi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x68], 1
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x64], 0x5f5e100
mov dword [ebp - 0x6c], ebx
cmp dword [ebp - 0x74], edi
je 0x401236
test eax, eax
je 0x401236
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
test edi, edi
je 0x401236
push 0
push 0
push 0x30
lea eax, [ebp - 0x78]
push eax
push 0x12127
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push edi
push dword [ebp - 0x50]
call dword [0x4053f8]
xor esi, esi
jmp 0x40123e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x4c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 0xffffffff
je 0x40124f
push eax
call ebx
mov eax, dword [ebp - 0x50]
cmp eax, 0xffffffff
je 0x40125a
push eax
call ebx
test edi, edi
je 0x401261
push edi
call ebx
mov eax, dword [ebp - 0x74]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualFree]
test eax, eax
je 0x401278
push 0x8000
push 0
push eax
call edi
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x401289
push 0x8000
push 0
push eax
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a78
mov esp, ebp
pop ebp
ret