Function at 0x10001140
Capabilities:
Act as tcp client
Check internet connectivity via wininet
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get socket status
Hide graphical window
Initialize winsock library
Resolve dns
Resolve function by parsing pe exports
Set socket configuration

Disassembly:
sub esp, 0x614
lea eax, [esp + 0x38]
push ebx
push ebp
push esi
push edi
push 0
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
jne 0x1000117e
mov ecx, dword [0x1000eaf4]
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x1000eaf0]
push str.OffLine_Now
push 0
push 0xc
push edx
jmp 0x10001824
lea eax, [esp + 0x494]
mov esi, 2
push eax
push esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x10001834
cmp word [esp + 0x494], si
jne 0x10001834
mov eax, dword [0x1000d47c]
mov ebx, 1
cmp eax, ebx
jne 0x100012e7
push str.221.142.244.144
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x3e8
mov dword [esp + 0x14], ebx
call dword [sym.imp.WS2_32.dll_inet_addr]
mov cx, word [0x1000d474]
mov dword [esp + 0x2c], eax
push ecx
mov word [esp + 0x2c], si
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 0
push 0
push 0
push ebx
push esi
mov word [esp + 0x42], ax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10001834
lea edx, [esp + 0x10]
push edx
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x10001834
push 0
push 0
push 8
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x38]
push 0x10
push eax
push esi
mov dword [esp + 0x7c], esi
mov dword [esp + 0x78], ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x5c]
push ecx
push 0
push edx
push 0
push ebx
call dword [sym.imp.WS2_32.dll_select]
test esi, esi
je 0x1000127f
lea eax, [esp + 0x5c]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x1000127f
xor edi, edi
jmp 0x10001281
mov edi, ebx
mov edx, dword [esp + 0x5c]
xor eax, eax
test edx, edx
jbe 0x100012c1
lea ecx, [esp + 0x60]
cmp dword [ecx], esi
je 0x1000129d
inc eax
add ecx, 4
cmp eax, edx
jb 0x1000128f
jmp 0x100012c1
lea ecx, [edx - 1]
cmp eax, ecx
jae 0x100012bc
lea ecx, [esp + eax*4 + 0x60]
mov edx, dword [ecx + 4]
inc eax
mov dword [ecx], edx
mov edx, dword [esp + 0x5c]
add ecx, 4
lea ebp, [edx - 1]
cmp eax, ebp
jb 0x100012a8
dec edx
mov dword [esp + 0x5c], edx
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test edi, edi
jne 0x1000186a
mov eax, dword [0x1000eaf4]
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.Proxy_Server_Disabled
jmp 0x10001819
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
push 0x1000e190
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
jne 0x1000130a
push 0x1000e190
call dword [sym.imp.WS2_32.dll_gethostbyname]
jmp 0x10001319
push 2
lea eax, [esp + 0x24]
push 4
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov ebp, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0x3e8
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x1000137a
xor ebx, ebx
mov edx, dword [eax]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add ebx, 4
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + ecx]
test eax, eax
jne 0x10001336
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
mov ebx, 1
lea edx, [esp + 0x5c]
push edx
call edi
push 0x50
mov dword [esp + 0x30], eax
mov word [esp + 0x2c], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 0
push 0
push 0
push ebx
push 2
mov word [esp + 0x42], ax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100013be
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x100013e1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
push 0
push 0
push 8
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x38]
push 0x10
push ecx
push esi
mov dword [esp + 0x3b0], esi
mov dword [esp + 0x3ac], ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
lea edx, [esp + 0x14]
lea eax, [esp + 0x390]
push edx
push 0
push eax
push 0
push ebx
call dword [sym.imp.WS2_32.dll_select]
test esi, esi
je 0x10001444
lea ecx, [esp + 0x390]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x10001444
xor ebp, ebp
mov edx, dword [esp + 0x390]
xor eax, eax
test edx, edx
jbe 0x10001498
lea ecx, [esp + 0x394]
cmp dword [ecx], esi
je 0x10001466
inc eax
add ecx, 4
cmp eax, edx
jb 0x10001458
jmp 0x10001498
lea ecx, [edx - 1]
cmp eax, ecx
jae 0x10001490
lea ecx, [esp + eax*4 + 0x394]
mov edx, dword [ecx + 4]
inc eax
mov dword [ecx], edx
mov edx, dword [esp + 0x390]
add ecx, 4
lea ebx, [edx - 1]
cmp eax, ebx
jb 0x10001474
mov ebx, 1
dec edx
mov dword [esp + 0x390], edx
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test ebp, ebp
jne 0x1000186a
push str.www.smartysoft.cn
call edi
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
jne 0x100014c4
push str.www.smartysoft.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
jmp 0x100014d3
push 2
lea eax, [esp + 0x20]
push 4
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov ebp, eax
test ebp, ebp
je 0x1000165a
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x10001521
xor ebx, ebx
mov edx, dword [eax]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add ebx, 4
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + ebx]
test eax, eax
jne 0x100014e8
mov edi, dword [sym.imp.WS2_32.dll_inet_addr]
lea edx, [esp + 0x5c]
push edx
call edi
push 0x50
mov dword [esp + 0x40], eax
mov word [esp + 0x3c], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 0
push 0
mov ebx, 1
push 0
push ebx
push 2
mov word [esp + 0x52], ax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001570
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x10001593
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
push 0
push 0
push 8
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x48]
push 0x10
push ecx
push esi
mov dword [esp + 0x1a8], esi
mov dword [esp + 0x1a4], ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
lea edx, [esp + 0x14]
lea eax, [esp + 0x188]
push edx
push 0
push eax
push 0
push 2
call dword [sym.imp.WS2_32.dll_select]
test esi, esi
je 0x100015f7
lea ecx, [esp + 0x188]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100015f7
xor ebp, ebp
mov edx, dword [esp + 0x188]
xor eax, eax
test edx, edx
jbe 0x1000164b
lea ecx, [esp + 0x18c]
cmp dword [ecx], esi
je 0x10001619
inc eax
add ecx, 4
cmp eax, edx
jb 0x1000160b
jmp 0x1000164b
lea ecx, [edx - 1]
cmp eax, ecx
jae 0x10001643
lea ecx, [esp + eax*4 + 0x18c]
mov edx, dword [ecx + 4]
inc eax
mov dword [ecx], edx
mov edx, dword [esp + 0x188]
add ecx, 4
lea ebx, [edx - 1]
cmp eax, ebx
jb 0x10001627
mov ebx, 1
dec edx
mov dword [esp + 0x188], edx
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test ebp, ebp
jne 0x10001848
push str.www.smartysoft.cn
call edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
jne 0x1000167b
push 0x1000e090
call dword [sym.imp.WS2_32.dll_gethostbyname]
jmp 0x1000168a
push 2
lea eax, [esp + 0x28]
push 4
push eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
mov ebp, eax
test ebp, ebp
je 0x10001806
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
test eax, eax
je 0x100016d8
xor ebx, ebx
mov edx, dword [eax]
push edx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x5c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
add ebx, 4
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + ebx]
test eax, eax
jne 0x1000169f
lea edx, [esp + 0x5c]
push edx
call dword [sym.imp.WS2_32.dll_inet_addr]
push 0x50
mov dword [esp + 0x54], eax
mov word [esp + 0x50], 2
call dword [sym.imp.WS2_32.dll_htons]
push 0
push 0
push 0
mov ebx, 1
push 0
push ebx
push 2
mov word [esp + 0x66], ax
call dword [sym.imp.WS2_32.dll_WSASocketW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10001725
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
lea eax, [esp + 0x10]
push eax
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x10001748
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
push 0
push 0
push 8
push 6
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push 0x10
push ecx
push esi
mov dword [esp + 0x2ac], esi
mov dword [esp + 0x2a8], ebx
call dword [sym.imp.WS2_32.dll_WSAConnect]
lea edx, [esp + 0x14]
lea eax, [esp + 0x28c]
push edx
push 0
push eax
push 0
push 3
call dword [sym.imp.WS2_32.dll_select]
test esi, esi
je 0x100017ac
lea ecx, [esp + 0x28c]
push ecx
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x100017ac
xor ebp, ebp
mov edx, dword [esp + 0x28c]
xor eax, eax
test edx, edx
jbe 0x100017fb
lea ecx, [esp + 0x290]
cmp dword [ecx], esi
je 0x100017ce
inc eax
add ecx, 4
cmp eax, edx
jb 0x100017c0
jmp 0x100017fb
lea ecx, [edx - 1]
cmp eax, ecx
jae 0x100017f3
lea ecx, [esp + eax*4 + 0x290]
mov edx, dword [ecx + 4]
inc eax
mov dword [ecx], edx
mov edx, dword [esp + 0x28c]
add ecx, 4
lea edi, [edx - 1]
cmp eax, edi
jb 0x100017dc
dec edx
mov dword [esp + 0x28c], edx
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
test ebp, ebp
jne 0x10001841
mov eax, dword [0x1000eaf4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push str.OffLine_Now
mov ecx, dword [0x1000eaf0]
push 0
push 0xc
push ecx
call dword [0x1000d45c]
mov dword [0x1000e6e4], 0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x614
ret
mov edi, 0x1000e090
jmp 0x1000186f
mov edi, str.www.smartysoft.cn
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x1000dc8c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
jmp 0x1000188a
mov edi, 0x1000e190
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x1000dc8c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [0x1000e6e4]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x100018ee
mov eax, dword [0x1000eaf0]
push 0x1000e3e4
push 0
push 0xc
push eax
call dword [0x1000d45c]
mov esi, dword [esp + 0x628]
push esi
call fcn.10001980
push esi
call fcn.10002390
mov eax, dword [0x1000e2a8]
add esp, 8
test eax, eax
ja 0x100018d6
mov eax, 0x3c
mov dword [0x1000e2a8], eax
pop edi
mov dword [0x1000e2ac], eax
pop esi
mov dword [0x1000e6e4], ebx
mov eax, ebx
pop ebp
pop ebx
add esp, 0x614
ret
mov ecx, dword [0x1000e2ac]
mov eax, dword [0x1000e3e0]
dec ecx
test eax, eax
mov dword [0x1000e2ac], ecx
je 0x10001944
inc ecx
lea edx, [esp + 0x160]
push ecx
push 0x1000c030
push edx
call dword [0x1000d464]
mov ecx, dword [0x1000eaf4]
add esp, 0xc
lea eax, [esp + 0x160]
push eax
push 0
push 0xc
push ecx
call dword [0x1000d45c]
mov edx, dword [0x1000eaf4]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x1000e2ac]
test eax, eax
ja 0x10001969
mov eax, dword [esp + 0x628]
push eax
call fcn.10001980
mov ecx, dword [0x1000e2a8]
add esp, 4
mov dword [0x1000e2ac], ecx
pop edi
pop esi
mov dword [0x1000e6e4], ebx
mov eax, ebx
pop ebp
pop ebx
add esp, 0x614
ret