Function at 0x4161b0
Capabilities:
Create thread

Disassembly:
sub esp, 0x4c8
push ebx
mov ebx, dword [esp + 0x4d4]
push ebp
mov ebp, dword [esp + 0x4dc]
push esi
mov esi, dword [esp + 0x4e8]
push edi
mov edi, dword [esp + 0x4e8]
push esi
push edi
push ebp
push ebx
lea eax, [esp + 0xe8]
push str.SSLTray:_tcpRelay_dst_is__s:_d_fromType_is__d_fromPort_is__d
push eax
call fcn.0044dd9b
lea ecx, [esp + 0xf0]
push ecx
call fcn.00402a90
add esp, 0x1c
test esi, esi
mov eax, ebx
lea edx, [eax + 1]
jne 0x416213
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416205
push 1
sub eax, edx
push ebp
jmp 0x416225
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416213
sub eax, edx
xor edx, edx
test edi, edi
sete dl
push edx
push esi
push eax
push ebx
call fcn.00408c50
add esp, 0x10
cmp eax, 0xffffffff
mov byte [esp + 0x13], 0
jne 0x4162ed
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416242
sub eax, edx
push eax
push ebx
call fcn.00408db0
add esp, 8
test al, al
jne 0x416282
mov esi, dword [esp + 0x4dc]
mov eax, dword [esi + 4]
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
push ebp
push ebx
push str.SSLTray:_tcpRelay_dst__s:_d_is_not_Internet_or_Protected
jmp 0x416c6d
mov edx, dword [0x47eb38]
push 1
xor eax, eax
push 0x4ac7c8
mov ecx, 0x2e
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov ecx, dword [str.INTERNET]
push 0x438
push 0x4d3ed0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x70], 8
mov byte [esp + 0x23], 1
call fcn.00401d30
add esp, 0x10
test eax, eax
jne 0x41637f
push 2
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
push 0
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov esi, eax
mov eax, dword [0x49f060]
imul esi, esi, 0xb8
push 1
push 0x4ac7c8
push eax
add esi, 0x4d4e30
mov ecx, 0x2e
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4ac7a4]
push 0x4d3ed0
push ecx
call fcn.00401e90
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x416379
mov esi, dword [esp + 0x4dc]
mov edx, dword [esi + 4]
push 2
push edx
call dword [sym.imp.WS2_32.dll_shutdown]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push ebp
push ebx
lea ecx, [esp + 0xe0]
push str.SSLTray:_tcpRelay_dst__s:_d_ConnectGate_failed.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0xe8]
push edx
call fcn.00402ab0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov eax, dword [esp + 0x1c]
jmp 0x416383
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x4ec]
mov ebp, dword [esp + 0x4dc]
test edx, edx
setne cl
mov byte [esp + 0x14], cl
mov cl, byte [esp + 0x13]
test cl, cl
lea ebx, [ebp + 0xc]
mov dword [ebp + 8], esi
mov dword [ebx], eax
push 1
je 0x4163f3
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0041b340
add esp, 0xc
test eax, eax
je 0x416450
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push eax
call esi
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [ebx]
push 2
push edx
call esi
mov eax, dword [ebx]
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov edx, dword [esi + 4]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x416450
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push eax
call esi
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push 2
push eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call edi
mov eax, dword [esp + 0x4e4]
mov ecx, dword [esp + 0x4e0]
push eax
push ecx
push str.SSLTray:_tcpRelay_dst__s:_d_failed_01.
jmp 0x416c6d
mov eax, dword [esp + 0x80]
mov ecx, 3
mov edi, 0x47b258
lea esi, [esp + 0x90]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov dword [esp + 0x18], eax
je 0x41648a
mov ecx, 3
mov edi, str.ORACLE
lea esi, [esp + 0x90]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x416496
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov byte [esp + 0x14], al
mov al, byte [esp + 0x13]
test al, al
push 1
lea eax, [esp + 0x18]
push eax
je 0x4164f0
mov ecx, dword [ebx]
push ecx
call fcn.0041b340
add esp, 0xc
test eax, eax
je 0x41654b
mov edx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push edx
call esi
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call edi
mov ecx, dword [ebx]
push 2
push ecx
call esi
mov edx, dword [ebx]
push edx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x41654b
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push eax
call esi
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push 2
push eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call edi
mov eax, dword [esp + 0x4e4]
mov ecx, dword [esp + 0x4e0]
push eax
push ecx
push str.SSLTray:_tcpRelay_dst__s:_d_failed_02.
jmp 0x416c6d
mov esi, dword [esp + 0x4e0]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416557
sub eax, edx
lea ecx, [esp + 0x14]
mov edi, eax
push ecx
push edi
call fcn.0041bb20
mov al, byte [esp + 0x1b]
add esp, 8
test al, al
lea edx, [esp + 0x14]
push 4
push edx
je 0x41663e
mov eax, dword [ebx]
push eax
call fcn.0041b340
add esp, 0xc
test eax, eax
jne 0x416ba3
mov edx, dword [ebx]
push edi
push esi
push edx
call fcn.0041b340
add esp, 0xc
test eax, eax
jne 0x4163c2
mov ecx, dword [esp + 0x4e4]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.0041bb20
mov al, byte [esp + 0x1b]
add esp, 8
test al, al
lea edx, [esp + 0x14]
push 4
push edx
je 0x41670f
mov eax, dword [ebx]
push eax
call fcn.0041b340
add esp, 0xc
test eax, eax
jne 0x416ba3
mov ecx, 3
mov edi, str.F_DATA
lea esi, [esp + 0x90]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x416767
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x14]
push eax
add ecx, 3
push ecx
call fcn.0041bb20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push 4
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.0041b4c0
add esp, 0x14
test eax, eax
jne 0x416823
push 3
push 0x47b258
jmp 0x4167b6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x416692
mov edx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push edx
call edi
mov eax, dword [ebp + 4]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call ebx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push 2
push edx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call ebx
mov edx, dword [esp + 0x4e4]
push edx
push esi
push str.SSLTray:_tcpRelay_dst__s:_d_failed_03.
jmp 0x4169ce
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edi
push esi
push edx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x4165ab
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push eax
call edi
mov ecx, dword [ebp + 4]
mov ebx, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call ebx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push 2
push eax
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call ebx
mov eax, dword [esp + 0x4e4]
push eax
push esi
lea ecx, [esp + 0xe0]
push str.SSLTray:_tcpRelay_dst__s:_d_failed_04.
push ecx
call fcn.0044dd9b
lea edx, [esp + 0xe8]
push edx
call fcn.00402ab0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push ecx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x4165e6
mov edx, dword [ebp + 4]
mov ebx, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push edx
call ebx
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push 2
push edx
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call edi
mov edx, dword [esp + 0x4e4]
push edx
push esi
push str.SSLTray:_tcpRelay_dst__s:_d_failed_05.
jmp 0x4169ce
mov ecx, 3
mov edi, str.O_DATA
lea esi, [esp + 0x90]
xor edx, edx
repe cmpsw word [esi], word es:[edi]
jne 0x41685c
mov ecx, dword [esp + 0x60]
lea eax, [esp + 0x14]
push eax
add ecx, 3
push ecx
call fcn.0041bb20
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
push 4
lea edx, [esp + 0x20]
push edx
push ecx
call fcn.0041b4c0
add esp, 0x14
test eax, eax
jne 0x416823
push 3
push 0x47ea28
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x416802
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push ecx
call esi
mov edx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 2
push ecx
call esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov ecx, dword [esp + 0x60]
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [eax + 4]
lea edx, [esp + 0x24]
push edx
push ecx
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x4169f6
mov edx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push edx
call esi
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call edi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push 2
push edx
call esi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.0041bb20
mov al, byte [esp + 0x1b]
add esp, 8
test al, al
lea ecx, [esp + 0x14]
push 4
push ecx
je 0x4168c1
mov edx, dword [ebx]
push edx
call fcn.0041b340
add esp, 0xc
test eax, eax
je 0x416920
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push eax
call esi
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [ebx]
push 2
push edx
call esi
mov eax, dword [ebx]
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x41696e
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push ecx
call esi
mov edx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 2
push ecx
call esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call edi
mov ecx, dword [esp + 0x4e4]
mov edx, dword [esp + 0x4e0]
push ecx
push edx
push str.SSLTray:_tcpRelay_dst__s:_d_failed_06.
jmp 0x4169ce
mov edx, dword [esp + 0x60]
mov ecx, dword [ebx]
push edx
lea eax, [esp + 0x24]
push eax
push ecx
call fcn.0041b340
add esp, 0xc
test eax, eax
je 0x4169f6
mov edx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push edx
call esi
mov eax, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push eax
call edi
mov ecx, dword [ebx]
push 2
push ecx
call esi
mov edx, dword [ebx]
push edx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov eax, dword [esp + 0x60]
mov edx, dword [ebp + 8]
push eax
mov eax, dword [edx + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
call fcn.0041b4c0
add esp, 0xc
test eax, eax
je 0x4169f6
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push ecx
call esi
mov edx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 2
push ecx
call esi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push eax
call edi
mov ecx, dword [esp + 0x4e4]
mov edx, dword [esp + 0x4e0]
push ecx
push edx
push str.SSLTray:_tcpRelay_dst__s:_d_failed_07.
lea eax, [esp + 0xe4]
push eax
call fcn.0044dd9b
lea ecx, [esp + 0xe8]
push ecx
call fcn.00402ab0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov ecx, 3
mov edi, 0x47b258
lea esi, [esp + 0x90]
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x416a77
push str.ftp_command
call fcn.00402a90
mov esi, dword [esp + 0x64]
inc esi
push esi
call fcn.0044dffd
mov byte [eax + esi - 1], 0
lea ecx, [esi - 1]
mov edx, ecx
shr ecx, 2
mov edi, eax
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x88]
push ecx
push eax
mov dword [ebp], 0
mov byte [ebp + 0x10], 0
mov edx, dword [0x49f060]
push 0x4ac7c8
push edx
push 0x4d3ed0
push ebp
call fcn.00405200
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
mov ecx, 3
mov edi, str.ORACLE
lea esi, [esp + 0x90]
xor eax, eax
repe cmpsw word [esi], word es:[edi]
jne 0x416ae9
push str.oracle_command
call fcn.00402a90
mov esi, dword [esp + 0x64]
inc esi
push esi
call fcn.0044dffd
mov byte [eax + esi - 1], 0
lea ecx, [esi - 1]
mov edx, ecx
shr ecx, 2
mov edi, eax
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x88]
mov edx, dword [esp + 0x68]
push ecx
push edx
push eax
push ebp
mov dword [ebp], 0
call fcn.0040ca90
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
push str.comes_tcp_data_relay
call fcn.00402a90
mov al, byte [esp + 0x17]
add esp, 4
test al, al
je 0x416bf3
cmp dword [esp + 0x4e4], 0x15
jne 0x416b6e
push str.Internet_tcp_is_ftp.
call fcn.00402a90
mov esi, dword [esp + 0x64]
inc esi
push esi
call fcn.0044dffd
lea ecx, [esi - 1]
mov edx, ecx
mov byte [eax + esi - 1], 0
shr ecx, 2
mov edi, eax
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
push 0
push eax
push 0x4ac7c8
mov ecx, edx
push 0x438
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4d3ed0
push ebp
mov dword [ebp], 0
mov byte [ebp + 0x10], 1
call fcn.00405200
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
push str.comes_tcp_data_relay_internet
call fcn.00402a90
add esp, 4
lea eax, [esp + 0x1c]
push eax
push 0
push ebp
push 0x416190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x416bd4
push str.comes_tcp_data_relay_internet_thread_null
call fcn.00402a90
add esp, 4
mov ecx, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
push 2
push ecx
call esi
mov edx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push edx
call edi
mov eax, dword [ebx]
push 2
push eax
call esi
mov ecx, dword [ebx]
push ecx
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
add ebp, 4
push ebp
call fcn.00416020
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
push str.comes_tcp_data_relay_VPN
call fcn.00402a90
add esp, 4
lea edx, [esp + 0x1c]
push edx
push 0
push ebp
push 0x415e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
jne 0x416c95
push str.comes_tcp_data_relay_vpn_thread_null
call fcn.00402a90
mov eax, dword [ebp + 4]
mov esi, dword [sym.imp.WS2_32.dll_shutdown]
add esp, 4
push 2
push eax
call esi
mov ecx, dword [ebp + 4]
mov edi, dword [sym.imp.WS2_32.dll_closesocket]
push ecx
call edi
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
push 2
push eax
call esi
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
push edx
call edi
mov eax, dword [esp + 0x4e4]
mov ecx, dword [esp + 0x4e0]
push eax
push ecx
push str.SSLTray:_tcpRelay_dst__s:_d_failed_08.
lea edx, [esp + 0xe4]
push edx
call fcn.0044dd9b
lea eax, [esp + 0xe8]
push eax
call fcn.00402ab0
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret
cmp dword [esp + 0x18], 1
jne 0x416cab
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp + 4]
push edx
call fcn.00415b90
jmp 0x416cb8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp + 4]
push ecx
call fcn.00415930
add esp, 8
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
test eax, eax
je 0x416ce7
push eax
call fcn.00440500
mov eax, dword [ebp + 8]
push eax
call fcn.0044dee5
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c8
ret