Function at 0x100003fc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Delete file
Download and write a file
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1200
call fcn.10001930
or dword [ebp - 0x18], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 0x11fc]
push eax
xor edi, edi
push 0x202
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
pop eax
push dword [ebp + 0xc]
mov word [ebp - 0x28], ax
call dword [sym.imp.WS2_32.dll_htons]
push dword [ebp + 8]
mov word [ebp - 0x26], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x24], eax
cmp eax, 0xffffffff
jne 0x1000045b
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push eax
call section..text
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
push 0x10
lea eax, [ebp - 0x28]
push eax
push esi
mov dword [ebp - 8], esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x10000484
push 2
jmp 0x10000753
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 1
push eax
push esi
mov dword [ebp - 0xc], eax
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
push 4
lea eax, [ebp - 0x14]
push eax
push 0x1006
push 0xffff
push esi
mov dword [ebp - 0x14], 0x2710
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0x200
lea eax, [ebp - 0x26c]
push edi
push eax
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.HTTP_1.1_r_nAccept:___r_nAccept_Language:_zh_cn_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__r_nHost:__s_r_nConnection:_Keep_Alive_r_n_r_n
push str.GET___s
lea eax, [ebp - 0x26c]
push str._s_s
push eax
call esi
push 0x400
lea eax, [ebp - 0xe6c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
push dword [ebp + 0x18]
lea eax, [ebp - 0x26c]
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0xe6c]
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xe6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.WS2_32.dll_send]
push edi
mov ebx, eax
push ebx
lea eax, [ebp - 0xe6c]
push eax
push dword [ebp - 8]
call esi
mov dword [ebp + 0x10], eax
jmp 0x10000568
cmp eax, edi
je 0x10000751
cmp eax, 0xffffffff
je 0x10000751
mov eax, dword [ebp + 0x10]
push edi
push ebx
lea eax, [ebp + eax - 0xe6c]
push eax
push dword [ebp - 8]
call esi
add dword [ebp + 0x10], eax
sub ebx, eax
cmp ebx, edi
jg 0x10000542
mov dword [ebp + 0x10], edi
push 0x2710
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10000656
mov esi, 0x800
push esi
lea eax, [ebp - 0xa6c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
push esi
lea eax, [ebp - 0xa6c]
push eax
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_recv]
inc dword [ebp + 0x10]
mov esi, eax
cmp esi, edi
je 0x1000074d
cmp esi, 0xffffffff
je 0x1000074d
cmp dword [ebp + 0x10], 1
jne 0x100005e6
lea eax, [ebp - 0xa6c]
push str.200_OK
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x1000065d
mov ebx, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0xa6c]
push str.Content_Length:
push eax
call ebx
pop ecx
pop ecx
cmp eax, edi
je 0x10000645
add eax, 0x10
push 0x10001b20
push eax
mov dword [ebp - 0x10], eax
call ebx
push 0x40
mov ebx, eax
lea eax, [ebp - 0x6c]
push edi
push eax
call sub.MSVCRT.dll_memset
sub ebx, dword [ebp - 0x10]
add esp, 0x14
inc ebx
push ebx
push dword [ebp - 0x10]
lea eax, [ebp - 0x6c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
pop ecx
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x10000683
cmp dword [ebp + 0x10], 1
je 0x10000571
push 7
jmp 0x10000753
push 4
jmp 0x10000753
push 6
pop esi
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0xa6c]
push eax
call fcn.100003a6
cmp eax, 1
jne 0x10000754
push 0xc
jmp 0x10000753
lea eax, [ebp - 0xa6c]
push str._r_n_r_n
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
add ebx, 4
pop ecx
pop ecx
cmp ebx, 4
jne 0x100006a8
push 8
jmp 0x10000753
push edi
push 0x80
push 2
push edi
push edi
push 0xc0000000
push dword [ebp + 0x14]
sub esi, ebx
lea esi, [ebp + esi - 0xa6c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x100006d5
push 9
jmp 0x10000753
push edi
lea ecx, [ebp - 0x14]
push ecx
push esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push eax
call ebx
mov dword [ebp + 0x10], esi
cmp esi, dword [ebp - 0x10]
jne 0x10000730
xor esi, esi
inc esi
jmp 0x10000754
push edi
push 0x800
lea eax, [ebp - 0xa6c]
push eax
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, edi
je 0x10000749
cmp esi, 0xffffffff
je 0x10000749
push edi
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0xa6c]
push eax
push dword [ebp - 0x18]
call ebx
add dword [ebp + 0x10], esi
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x10]
je 0x100006ed
push 0x2710
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x100006f2
push 0xa
jmp 0x10000753
push 0xb
jmp 0x10000753
push 5
jmp 0x10000753
push 3
pop esi
cmp dword [ebp - 8], 0xffffffff
je 0x1000076e
push 2
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [ebp - 8]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc], edi
je 0x10000784
push dword [ebp - 0xc]
call ebx
cmp dword [ebp - 0x18], 0xffffffff
je 0x1000078f
push dword [ebp - 0x18]
call ebx
cmp esi, 1
je 0x100007a2
cmp dword [ebp + 0x14], edi
je 0x100007a2
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp esi, 0xc
jne 0x100007c1
push dword [ebp + 0x18]
lea eax, [ebp - 0x106c]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100003fc
mov esi, eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14