Function at 0x471e71
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1cc
mov ebx, dword [ebp + 8]
or edi, 0xffffffff
test ebx, ebx
je 0x472478
cmp dword [ebx + 4], 0
je 0x472478
mov edx, dword [0x6f6734]
test edx, edx
je 0x471ea6
mov eax, dword [0x6f6738]
jmp 0x471ea9
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1ac], eax
cmp dword [ebp - 0x1ac], 0
jne 0x471ec2
mov dword [ebp - 0x1ac], 0x15
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1b0], eax
mov ecx, 4
xor eax, eax
mov edi, dword [ebp - 0x1b0]
rep stosd dword es:[edi], eax
test edx, edx
je 0x471ee3
mov dword [esp], edx
jmp 0x471ee9
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.WS2_32.dll_gethostbyname
push ecx
test eax, eax
jne 0x471efd
mov dword [esp + 8], str.gethostbyname_failed
jmp 0x471f0f
mov cx, word [eax + 0xa]
cmp cx, 4
jbe 0x471f28
mov dword [esp + 8], str.gethostbyname_address_mismatch
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
jmp 0x472475
mov word [ebx + 0x18], 2
lea edx, [ebx + 0x1c]
movsx ecx, cx
mov eax, dword [eax + 0xc]
mov esi, dword [eax]
mov edi, edx
rep movsb byte es:[edi], byte [esi]
movzx eax, word [ebp - 0x1ac]
mov dword [esp], eax
call sub.WS2_32.dll_htons
push edx
mov word [ebx + 0x1a], ax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
call sub.WS2_32.dll_socket
sub esp, 0xc
mov dword [ebx + 0x2c], eax
cmp eax, 0xffffffff
jne 0x471f82
mov dword [esp + 8], str.socket_failed
jmp 0x471f0f
mov dword [esp + 8], 0x10
mov edx, dword [ebp - 0x1b0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WS2_32.dll_connect
sub esp, 0xc
test eax, eax
jns 0x471fb0
mov dword [esp + 8], str.Failed_to_create_a_connection
jmp 0x47238d
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
jne 0x472462
cmp dword [0x6f6734], 0
je 0x472307
mov eax, dword [0x6f673c]
test eax, eax
je 0x4720f5
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.USER__s_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x1a8]
mov dword [esp], esi
call fcn.00597e90
mov byte [ebp - 0x19], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x4722b0
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
je 0x472053
cmp eax, 3
je 0x472060
dec eax
jne 0x472462
jmp 0x4720f5
cmp dword [0x6f6740], 0
je 0x4720f5
mov edx, dword [0x6f6740]
test edx, edx
lea eax, [ebp - 0x1a8]
je 0x47208e
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597e90
jmp 0x4720a6
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597e90
mov byte [ebp - 0x19], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x4722b0
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 3
jg 0x472462
mov eax, dword [0x6f6744]
test eax, eax
js 0x472462
cmp eax, 1
jle 0x472115
cmp eax, 2
jne 0x472462
jmp 0x47219b
mov eax, dword [ebx + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.SITE__s_r_n
mov dword [esp + 4], 0x190
lea esi, [ebp - 0x1a8]
mov dword [esp], esi
call fcn.00597e90
mov byte [ebp - 0x19], 0
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x4722b0
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
cmp eax, 2
jne 0x47218e
mov dword [0x6f6744], 1
jmp 0x472307
cmp dword [0x6f6744], 1
je 0x472462
mov edx, dword [ebx + 0x10]
test edx, edx
mov ecx, dword [ebx + 4]
lea eax, [ebp - 0x1a8]
jne 0x4721c9
mov dword [esp + 0xc], ecx
mov dword [esp + 8], str.USER_anonymous__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597e90
jmp 0x4721e9
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.USER__s__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], eax
call fcn.00597e90
mov byte [ebp - 0x19], 0
lea esi, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
js 0x4722b0
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
dec eax
cmp eax, 1
jbe 0x4722f6
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x47225a
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0x190
mov dword [esp], esi
call fcn.00597e90
jmp 0x472276
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0x190
mov dword [esp], esi
call fcn.00597e90
mov byte [ebp - 0x19], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
mov edi, eax
test eax, eax
jns 0x4722e4
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
mov dword [esp], 9
call fcn.00449dd2
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push eax
mov dword [ebx + 0x2c], 0xffffffff
jmp 0x472478
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
dec eax
cmp eax, 1
ja 0x472462
mov dword [0x6f6744], 2
xor edi, edi
jmp 0x472478
mov edx, dword [ebx + 0x10]
test edx, edx
lea eax, [ebp - 0x1a8]
jne 0x47232e
mov dword [esp + 8], str.USER_anonymous_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00597e90
jmp 0x47234a
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.USER__s_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], eax
call fcn.00597e90
mov byte [ebp - 0xe1], 0
lea esi, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x47239a
mov dword [esp + 8], str.send_failed
mov dword [esp + 4], 0
jmp 0x472456
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
xor edi, edi
cmp eax, 2
je 0x472478
cmp eax, 3
jne 0x472462
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x4723d7
mov dword [esp + 8], str.PASS_anonymous__r_n
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call fcn.00597e90
jmp 0x4723f3
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.PASS__s_r_n
mov dword [esp + 4], 0xc8
mov dword [esp], esi
call fcn.00597e90
mov byte [ebp - 0xe1], 0
lea edx, [ebp - 0x1a8]
xor eax, eax
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
js 0x472385
mov dword [esp], ebx
call sym.evasi0n_gui.exe_xmlNanoFTPGetResponse
xor edi, edi
cmp eax, 2
je 0x472478
cmp eax, 3
jne 0x472462
mov dword [esp + 8], str.FTP_server_asking_for_ACCNT_on_anonymous_n
mov dword [esp + 4], 0x7d2
mov dword [esp], 9
call fcn.00449dd2
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call sub.WS2_32.dll_closesocket
push esi
mov dword [ebx + 0x2c], 0xffffffff
or edi, 0xffffffff
mov eax, edi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
leave
ret