Function at 0x4ac0e0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call dword [sym.imp.WSOCK32.dll_inet_addr]
cmp eax, 0xffffffff
mov dword [esp + 0x2c], eax
jne 0x4ac10b
push ebx
call dword [sym.imp.WSOCK32.dll_gethostbyname]
jmp 0x4ac11a
push 2
push 4
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.WSOCK32.dll_gethostbyaddr]
mov edi, eax
test edi, edi
je 0x4ac4e6
push 6
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x20], esi
je 0x4ac4e6
push 0x5f9104
push 0x5f90fc
call dword [sym.imp.WSOCK32.dll_getservbyname]
test eax, eax
jne 0x4ac162
push 0x50
call dword [sym.imp.WSOCK32.dll_htons]
mov word [esp + 0x32], ax
jmp 0x4ac16b
mov cx, word [eax + 8]
mov word [esp + 0x32], cx
mov word [esp + 0x30], 2
mov edx, dword [edi + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
push 0x10
lea edx, [esp + 0x34]
push edx
push esi
mov dword [esp + 0x40], ecx
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
je 0x4ac1cd
mov eax, dword [ebp + 0xc]
push ebx
push eax
lea ecx, [esp + 0x48]
push str.GET__s_HTTP_1.1_r_nUser_Agent:_mIRC_r_nHost:__s_r_nCache_Control:_no_cache_r_n_r_n
push ecx
call fcn.005d9929
lea eax, [esp + 0x50]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ac1b0
push 0
sub eax, edx
push eax
lea edx, [esp + 0x48]
push edx
push esi
call dword [sym.imp.WSOCK32.dll_send]
cmp eax, 0xffffffff
jne 0x4ac1dd
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], eax
jmp 0x4ac200
mov esi, dword [ebp + 0x10]
cmp dword [esi + 0x43c], 1
jne 0x4ac4fa
mov ecx, dword [esp + 0x20]
push 0
push 0x400
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
je 0x4ac4f7
test esi, esi
je 0x4ac4ef
cmp dword [esp + 0x18], 2
jne 0x4ac256
mov edx, dword [ebp + 0x10]
mov eax, dword [edx + 0xcb0]
test eax, eax
jne 0x4ac43f
lea eax, [edi + esi + 0xa]
push eax
push ebx
call fcn.005dbd64
add esp, 8
test eax, eax
je 0x4ac4ad
add edi, eax
lea ecx, [esi + 0xa]
mov edx, ecx
shr ecx, 2
mov dword [esp + 0x28], edi
mov ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x28]
mov ecx, esi
mov eax, ecx
shr ecx, 2
lea esi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
add edi, esi
test eax, eax
mov dword [esp + 0x10], edi
jne 0x4ac321
push 0x5f4c8c
push ebx
call fcn.005da9a0
mov esi, eax
add esp, 8
test esi, esi
je 0x4ac4a0
push 4
push str.HTTP
push ebx
mov byte [esi], 0
call fcn.005f18c9
add esp, 0xc
test eax, eax
jne 0x4ac302
push 0x5f90a0
push ebx
call fcn.00422d30
add esp, 8
test eax, eax
je 0x4ac4ce
mov dword [esp + 0x18], 1
mov ecx, ebx
sub ecx, esi
lea eax, [edi + ecx - 2]
mov dword [esp + 0x10], eax
inc eax
push eax
add esi, 2
push esi
push ebx
call fcn.005daa60
mov edi, dword [esp + 0x1c]
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 1
jne 0x4ac480
push 0x5f4c8c
push ebx
call fcn.005da9a0
add esp, 8
mov esi, eax
test esi, esi
je 0x4ac4a0
mov eax, ebx
mov byte [esi], 0
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ac350
sub eax, edx
mov dword [esp + 0x28], eax
je 0x4ac3d2
cmp dword [esp + 0x1c], 0xffffffff
jne 0x4ac3a3
push 0xf
push str.Content_Length:
push ebx
call fcn.005f18c9
add esp, 0xc
test eax, eax
jne 0x4ac3a3
lea edx, [ebx + 0xf]
push edx
call fcn.005d9a55
add esp, 4
test eax, eax
mov dword [esp + 0x1c], eax
jge 0x4ac39a
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0x440], eax
mov edx, ebx
sub edx, esi
lea eax, [edi + edx - 2]
mov dword [esp + 0x10], eax
inc eax
push eax
add esi, 2
push esi
push ebx
call fcn.005daa60
push 0x5f4c8c
push ebx
call fcn.005da9a0
mov edi, dword [esp + 0x24]
add esp, 0x14
jmp 0x4ac33c
mov eax, ebx
sub eax, esi
lea eax, [edi + eax - 2]
mov dword [esp + 0x10], eax
inc eax
push eax
add esi, 2
push esi
push ebx
mov dword [esp + 0x24], 2
call fcn.005daa60
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + 0xcb0]
add esp, 0xc
test eax, eax
je 0x4ac487
mov eax, dword [esp + 0x10]
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov esi, ebx
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0
call fcn.005d9fa3
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
add esp, 4
xor ebx, ebx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xca8]
test eax, eax
je 0x4ac2a7
push 0
lea ecx, [esp + 0x18]
push ecx
push esi
lea edx, [esp + 0x4c]
push edx
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ac4f7
cmp dword [esp + 0x14], esi
je 0x4ac2a7
jmp 0x4ac4f7
cmp eax, 2
jne 0x4ac4a0
jmp 0x4ac48b
mov edi, dword [esp + 0x10]
mov eax, dword [ebp + 0x10]
mov dword [eax + 0x438], edi
mov eax, dword [esp + 0x1c]
test eax, eax
jl 0x4ac4a0
cmp edi, eax
jge 0x4ac4ef
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4ac200
test ebx, ebx
je 0x4ac4ba
push ebx
call fcn.005d9fa3
add esp, 4
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4ac4db
push ebx
call fcn.005d9fa3
add esp, 4
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esp + 0x24], 1
mov esi, dword [ebp + 0x10]
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.WSOCK32.dll_closesocket]
cmp dword [esi + 0x43c], 1
jne 0x4ac537
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4ac537
mov ecx, dword [esp + 0x18]
mov eax, 2
cmp ecx, eax
jne 0x4ac537
mov dword [esi + 0x434], ebx
xor ebx, ebx
mov dword [esi + 0x438], edi
mov dword [esi + 0x43c], eax
cmp dword [esi + 0x43c], 2
je 0x4ac549
push esi
call fcn.004ac070
add esp, 4
test ebx, ebx
je 0x4ac556
push ebx
call fcn.005d9fa3
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret