Function at 0x1000f9b0
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 8], 0xffffffff
cmp eax, esi
je 0x1000f9e0
push esi
push esi
push 2
push esi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x2000
push 8
call ebx
push eax
call fcn.10016d00
mov dword [esp + 0x24], eax
cmp eax, esi
je 0x1000fbb6
push ebp
push esi
push 0x1fff
push eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
test ebp, ebp
jle 0x1000fba6
jmp 0x1000fa30
cmp edi, 0x100000
ja 0x1000fb93
test esi, esi
jne 0x1000fa50
lea edx, [edi + ebp + 1]
push edx
push esi
call ebx
push eax
call fcn.10016d00
jmp 0x1000fa68
lea eax, [edi + ebp + 1]
push eax
push esi
push 0
call ebx
push eax
call fcn.10012e90
test eax, eax
je 0x1000fb97
mov ecx, dword [esp + 0x28]
push ebp
mov esi, eax
push ecx
lea edx, [esi + edi]
push edx
call sub.NTDLL.dll_RtlMoveMemory
add edi, ebp
cmp dword [esp + 0x14], 0
mov byte [esi + edi], 0
jne 0x1000fb3e
push 0x10019988
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x1000fb38
push 0x20
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov ebp, eax
test ebp, ebp
je 0x1000fae3
push 0x20
inc ebp
push ebp
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov ebx, eax
test ebx, ebx
je 0x1000fadf
push ebp
mov byte [ebx], 0
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, dword [esp + 0x24]
mov dword [ecx + 4], eax
mov byte [ebx], 0x20
mov ebx, dword [esp + 0x18]
mov edx, esi
sub edx, ebx
lea ebp, [edx + edi - 4]
mov byte [ebx], 0
test ebp, ebp
je 0x1000fb25
mov eax, esi
sub eax, ebp
push ebp
add eax, edi
push eax
push esi
call sub.NTDLL.dll_RtlMoveMemory
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [ebp + 1]
push ecx
push esi
push 0
call edi
push eax
call fcn.10012e90
test eax, eax
je 0x1000fbd1
mov esi, eax
mov byte [eax + ebp], 0
jmp 0x1000fb36
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.10015150
xor esi, esi
mov edi, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x1000fb6e
push 0
lea edx, [esp + 0x1c]
push edx
push edi
push esi
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
call ebx
push eax
call fcn.10015150
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
push 0
push 0x1fff
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
test ebp, ebp
jg 0x1000fa30
jmp 0x1000fba6
test esi, esi
je 0x1000fba2
push esi
push 0
call ebx
push eax
call fcn.10015150
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x28]
push eax
push 0
call ebx
push eax
call fcn.10015150
pop ebp
mov eax, dword [esp + 0xc]
pop ebx
cmp eax, 0xffffffff
je 0x1000fbe4
push eax
call sub.NTDLL.dll_NtClose
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
push 0
call edi
push eax
call fcn.10015150
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x1000fba2
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
add esp, 0xc
ret