Function at 0x1000aa36
Capabilities:
Create udp socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x704
push ebx
push esi
push edi
push 0x11
push 2
xor ebx, ebx
push 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x40], 1
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esp + 0x18], eax
cmp eax, ebx
jge 0x1000aa6e
xor eax, eax
jmp 0x1000adcf
push 0x80
lea eax, [esp + 0x5c]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
push 2
pop eax
mov word [esp + 0x58], ax
lea eax, [esp + 0xd8]
push eax
push ebx
push str.223.255.255.255
mov dword [esp + 0x68], ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetBestRoute]
test eax, eax
jne 0x1000ab64
push 0x1c
mov dword [esp + 0x18], ebx
call fcn.10011198
pop ecx
mov edi, eax
push ebx
lea eax, [esp + 0x18]
push eax
push edi
mov dword [esp + 0x1c], edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpAddrTable]
cmp eax, 0x7a
jne 0x1000aaf0
xor eax, eax
lea esi, [esp + 0x10]
call fcn.100111ae
push dword [esp + 0x14]
call fcn.10011198
mov edi, eax
pop ecx
mov dword [esp + 0x10], edi
cmp edi, ebx
je 0x1000ab64
push ebx
lea eax, [esp + 0x18]
push eax
push edi
call dword [sym.imp.IPHLPAPI.DLL_GetIpAddrTable]
mov eax, dword [edi]
xor esi, esi
cmp eax, ebx
jle 0x1000ab59
lea ecx, [edi + 8]
mov edx, dword [ecx]
cmp edx, dword [esp + 0xe8]
je 0x1000ab21
inc esi
add ecx, 0x18
cmp esi, eax
jl 0x1000ab0c
jmp 0x1000ab59
push 4
lea eax, [esp + 0x20]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_memset]
imul esi, esi, 0x18
add esp, 0xc
lea esi, [esi + edi + 4]
mov eax, dword [esi]
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 9
push ebx
push dword [esp + 0x28]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [esi]
mov dword [esp + 0x5c], eax
xor eax, eax
lea esi, [esp + 0x10]
call fcn.100111ae
push 4
lea eax, [esp + 0x38]
push eax
push 4
push 0xffff
push dword [esp + 0x28]
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
js 0x1000aa67
push 0x10
lea eax, [esp + 0x5c]
push eax
push dword [esp + 0x20]
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x1000aba8
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x1000aa67
mov dword [esp + 0x30], ebx
cmp dword [str.urn:schemas_upnp_org:device:InternetGatewayDevice:1], ebx
je 0x1000adb7
mov dword [esp + 0x14], str.urn:schemas_upnp_org:device:InternetGatewayDevice:1
cmp dword [esp + 0x30], ebx
jne 0x1000ac67
mov eax, dword [esp + 0x14]
push 2
push dword [eax]
mov esi, str.239.255.255.250
push esi
push str.M_SEARCH__HTTP_1.1_r_nHOST:__s:1900_r_nST:__s_r_nMAN:__ssdp:discover__r_nMX:__u_r_n_r_n
lea eax, [esp + 0x120]
push 0x600
push eax
call fcn.100112cf
push 0x20
mov edi, eax
lea eax, [esp + 0x54]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0x24
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
push str.1900
push esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 2
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x1000adb7
mov esi, dword [esp + 0x28]
jmp 0x1000ac51
push dword [esi + 0x10]
lea eax, [esp + 0x114]
push dword [esi + 0x18]
push ebx
push edi
push eax
push dword [esp + 0x2c]
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, dword [esi + 0x1c]
mov edi, eax
cmp esi, ebx
jne 0x1000ac32
push dword [esp + 0x28]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
cmp edi, ebx
jl 0x1000adb7
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x110]
push 0x600
push eax
mov eax, 0x7d0
call fcn.1000be4b
pop ecx
pop ecx
mov dword [esp + 0x30], eax
cmp eax, ebx
jl 0x1000adb7
jne 0x1000aca1
cmp dword [esp + 0x24], ebx
jne 0x1000adb7
jmp 0x1000ada2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], ebx
push eax
lea ebx, [esp + 0x124]
call fcn.1000b213
add esp, 0x14
cmp dword [esp + 0x10], 0
je 0x1000ada0
cmp dword [esp + 0x1c], 0
je 0x1000ada0
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
test esi, esi
je 0x1000ad42
mov edi, dword [sym.imp.msvcrt.dll_memcmp]
push ebx
push dword [esp + 0x20]
push dword [esi + 4]
call edi
add esp, 0xc
test eax, eax
jne 0x1000ad38
mov eax, dword [esi + 4]
cmp byte [ebx + eax], 0
jne 0x1000ad38
push dword [esp + 0x20]
push dword [esp + 0x14]
push dword [esi + 8]
call edi
add esp, 0xc
test eax, eax
jne 0x1000ad38
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x20]
cmp byte [ecx + eax], 0
je 0x1000ad3e
mov esi, dword [esi]
test esi, esi
jne 0x1000acf7
test esi, esi
jne 0x1000ada0
mov eax, dword [esp + 0x20]
lea eax, [eax + ebx + 0x14]
push eax
call fcn.10011198
mov esi, eax
pop ecx
test esi, esi
je 0x1000adb5
mov eax, dword [esp + 0x24]
push ebx
push dword [esp + 0x20]
mov dword [esi], eax
lea eax, [esi + 0x10]
lea edi, [esi + ebx + 0x11]
push eax
mov dword [esi + 4], eax
mov dword [esi + 8], edi
call dword [sym.imp.msvcrt.dll_memcpy]
push dword [esp + 0x2c]
mov byte [esi + ebx + 0x10], 0
push dword [esp + 0x20]
push edi
call dword [sym.imp.msvcrt.dll_memcpy]
mov eax, dword [esp + 0x38]
add eax, esi
add esp, 0x18
mov byte [eax + ebx + 0x11], 0
and dword [esi + 0xc], 0
mov dword [esp + 0x24], esi
xor ebx, ebx
add dword [esp + 0x14], 4
mov eax, dword [esp + 0x14]
cmp dword [eax], ebx
jne 0x1000abc0
jmp 0x1000adb7
xor ebx, ebx
push dword [esp + 0x18]
call dword [sym.imp.WS2_32.dll_closesocket]
mov ecx, dword [esp + 0x24]
mov eax, ecx
jmp 0x1000adcb
mov ecx, dword [ecx]
cmp ecx, ebx
jne 0x1000adc9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret