Function at 0x470c11
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1cc
mov ebx, dword [ebp + 8]
or edi, 0xffffffff
test ebx, ebx
je 0x471218
cmp dword [ebx + 4], 0
je 0x471218
mov edx, dword [0x6d9704]
test edx, edx
je 0x470c46
mov eax, dword [0x6d9708]
jmp 0x470c49
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jne 0x470c62
mov dword [ebp - 0x1ac], 0x15
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1b0], eax
mov ecx, 4
xor eax, eax
mov edi, dword [ebp - 0x1b0]
rep stosd dword es:[edi], eax
test edx, edx
je 0x470c83
mov dword [esp], edx
jmp 0x470c89
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.WS2_32.dll_gethostbyname
push ecx
test eax, eax
jne 0x470c9d
mov dword [esp + 8], str.gethostbyname_failed
jmp 0x470caf
mov cx, word [eax + 0xa]
cmp cx, 4
jbe 0x470cc8
mov dword [esp + 8], str.gethostbyname_address_mismatch
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00448b72
jmp 0x471215
mov word [ebx + 0x18], 2
lea edx, [ebx + 0x1c]
movsx ecx, cx
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
mov edi, edx
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebp - 0x1ac]
mov dword [esp], eax
call sub.WS2_32.dll_htons
push edx
mov word [ebx + 0x1a], ax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov dword [ebx + 0x2c], eax
cmp eax, 0xffffffff
jne 0x470d22
mov dword [esp + 8], str.socket_failed
jmp 0x470caf
mov dword [esp + 8], 0x10
mov edx, dword [ebp - 0x1b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
test eax, eax
jns 0x470d50
mov dword [esp + 8], str.Failed_to_create_a_connection
jmp 0x47112d
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
jne 0x471202
cmp dword [0x6d9704], 0
je 0x4710a7
mov eax, dword [0x6d970c]
test eax, eax
je 0x470e95
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.USER__s_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x1a8]
mov dword [esp], esi
call fcn.00597a20
mov byte [ebp - 0x19], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x471050
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
je 0x470df3
cmp eax, 3
je 0x470e00
dec eax
jne 0x471202
jmp 0x470e95
cmp dword [0x6d9710], 0
je 0x470e95
mov edx, dword [0x6d9710]
test edx, edx
lea eax, [ebp - 0x1a8]
je 0x470e2e
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597a20
jmp 0x470e46
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597a20
mov byte [ebp - 0x19], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x471050
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 3
jg 0x471202
mov eax, dword [0x6d9714]
test eax, eax
js 0x471202
cmp eax, 1
jle 0x470eb5
cmp eax, 2
jne 0x471202
jmp 0x470f3b
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.SITE__s_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x1a8]
mov dword [esp], esi
call fcn.00597a20
mov byte [ebp - 0x19], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x471050
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
jne 0x470f2e
mov dword [0x6d9714], 1
jmp 0x4710a7
cmp dword [0x6d9714], 1
je 0x471202
mov edx, dword [ebx + 0x10]
test edx, edx
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x1a8]
jne 0x470f69
mov dword [esp + 0xc], ecx
mov dword [esp + 8], str.USER_anonymous__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597a20
jmp 0x470f89
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.USER__s__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597a20
mov byte [ebp - 0x19], 0
lea esi, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x471050
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
dec eax
cmp eax, 1
jbe 0x471096
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x470ffa
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0x190
mov dword [esp], esi
call fcn.00597a20
jmp 0x471016
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], esi
call fcn.00597a20
mov byte [ebp - 0x19], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
jns 0x471084
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00448b72
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x471218
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
dec eax
cmp eax, 1
ja 0x471202
mov dword [0x6d9714], 2
xor edi, edi
jmp 0x471218
mov edx, dword [ebx + 0x10]
test edx, edx
lea eax, [ebp - 0x1a8]
jne 0x4710ce
mov dword [esp + 8], str.USER_anonymous_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00597a20
jmp 0x4710ea
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.USER__s_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00597a20
mov byte [ebp - 0xe1], 0
lea esi, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x47113a
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
jmp 0x4711f6
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
xor edi, edi
cmp eax, 2
je 0x471218
cmp eax, 3
jne 0x471202
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x471177
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call fcn.00597a20
jmp 0x471193
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call fcn.00597a20
mov byte [ebp - 0xe1], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
js 0x471125
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
xor edi, edi
cmp eax, 2
je 0x471218
cmp eax, 3
jne 0x471202
mov dword [esp + 8], str.FTP_server_asking_for_ACCNT_on_anonymous_n
mov dword [esp + 4], 0x7d2
mov dword [esp], 9
call fcn.00448b72
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push esi
mov dword [ebx + 0x2c], 0xffffffff
or edi, 0xffffffff
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret