Function at 0x10007c70
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x18]
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 8], 0xffffffff
cmp eax, esi
je 0x10007ca0
push esi
push esi
push 2
push esi
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x2000
push 8
call ebx
push eax
call fcn.10004e00
mov dword [esp + 0x24], eax
cmp eax, esi
je 0x10007e76
push ebp
push esi
push 0x1fff
push eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
test ebp, ebp
jle 0x10007e66
jmp 0x10007cf0
cmp edi, 0x100000
ja 0x10007e53
test esi, esi
jne 0x10007d10
lea edx, [edi + ebp + 1]
push edx
push esi
call ebx
push eax
call fcn.10004e00
jmp 0x10007d28
lea eax, [edi + ebp + 1]
push eax
push esi
push 0
call ebx
push eax
call fcn.1000ad70
test eax, eax
je 0x10007e57
mov ecx, dword [esp + 0x28]
push ebp
mov esi, eax
push ecx
lea edx, [esi + edi]
push edx
call sub.NTDLL.dll_RtlMoveMemory
add edi, ebp
cmp dword [esp + 0x14], 0
mov byte [esi + edi], 0
jne 0x10007dfe
push 0x1000e8f8
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x10007df8
push 0x20
push esi
mov dword [esp + 0x1c], 1
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov ebp, eax
test ebp, ebp
je 0x10007da3
push 0x20
inc ebp
push ebp
call dword [sym.imp.SHLWAPI.dll_StrChrA]
mov ebx, eax
test ebx, ebx
je 0x10007d9f
push ebp
mov byte [ebx], 0
call dword [sym.imp.SHLWAPI.dll_StrToIntA]
mov ecx, dword [esp + 0x24]
mov dword [ecx + 4], eax
mov byte [ebx], 0x20
mov ebx, dword [esp + 0x18]
mov edx, esi
sub edx, ebx
lea ebp, [edx + edi - 4]
mov byte [ebx], 0
test ebp, ebp
je 0x10007de5
mov eax, esi
sub eax, ebp
push ebp
add eax, edi
push eax
push esi
call sub.NTDLL.dll_RtlMoveMemory
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea ecx, [ebp + 1]
push ecx
push esi
push 0
call edi
push eax
call fcn.1000ad70
test eax, eax
je 0x10007e91
mov esi, eax
mov byte [eax + ebp], 0
jmp 0x10007df6
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call fcn.1000c9e0
xor esi, esi
mov edi, ebp
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x10007e2e
push 0
lea edx, [esp + 0x1c]
push edx
push edi
push esi
push eax
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
push 0
call ebx
push eax
call fcn.1000c9e0
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
push 0
push 0x1fff
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov ebp, eax
test ebp, ebp
jg 0x10007cf0
jmp 0x10007e66
test esi, esi
je 0x10007e62
push esi
push 0
call ebx
push eax
call fcn.1000c9e0
xor esi, esi
xor edi, edi
mov eax, dword [esp + 0x28]
push eax
push 0
call ebx
push eax
call fcn.1000c9e0
pop ebp
mov eax, dword [esp + 0xc]
pop ebx
cmp eax, 0xffffffff
je 0x10007ea4
push eax
call sub.NTDLL.dll_NtClose
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
push esi
push 0
call edi
push eax
call fcn.1000c9e0
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x10007e62
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
mov dword [ecx], esi
pop esi
add esp, 0xc
ret