Function at 0x42b6e0
Capabilities:
Check for time delay via queryperformancecounter
Connect socket
Get socket status
Initialize winsock library
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4cb58b
mov eax, dword fs:[0]
push eax
sub esp, 0x830
mov eax, dword [0x510a50]
xor eax, esp
mov dword [esp + 0x828], eax
push ebx
push esi
push edi
mov eax, dword [0x510a50]
xor eax, esp
push eax
lea eax, [esp + 0x840]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x1c]
xor esi, esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], ebx
cmp eax, esi
je 0x42c156
cmp ecx, esi
je 0x42c156
mov eax, dword [ebp + 8]
lea ecx, [esp + 0x44]
push ecx
mov word [ebx + 0x28], di
mov dword [ebx + 0x24], eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceFrequency]
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x2a4]
push ecx
push 0x202
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, esi
je 0x42b797
mov byte [ebx], 0x65
jmp 0x42c159
push esi
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x10], esi
cmp esi, 0xffffffff
jne 0x42b7bb
mov byte [ebx], 0x66
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x42c159
mov edx, 2
push edi
mov word [esp + 0x88], dx
call dword [sym.imp.WS2_32.dll_htons]
lea ecx, [esp + 0x4c]
push ecx
mov word [esp + 0x8a], ax
mov eax, dword [ebp + 8]
push 0x8004667e
push esi
mov dword [esp + 0x94], eax
mov dword [esp + 0x58], 1
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x42b814
push esi
mov byte [ebx], 0x67
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x42c159
mov edi, dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
xor eax, eax
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
call edi
push 0x10
lea eax, [esp + 0x88]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, dword [ebp + 0x14]
lea edx, [esp + 0x58]
push edx
push 0
lea eax, [esp + 0x1a4]
push eax
push 0
push 0
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x70], 0
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1b0], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x42b88f
push esi
mov byte [ebx], 6
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x42c159
lea ecx, [esp + 0x2c]
push ecx
call edi
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
sub esi, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
sbb edi, dword [esp + 0x28]
push 0
push 0xf4240
push edx
push eax
call fcn.0048b6a0
push edx
push eax
push edi
push esi
call fcn.0048b6a0
xor edi, edi
push edi
push 0x3e8
push edx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], edx
call fcn.0048b6a0
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [ebx + 0xc], ecx
cmp dword [ebp + 0x14], edx
jb 0x42c140
mov esi, dword [esp + 0x10]
sub dword [ebp + 0x14], edx
lea ecx, [esp + 0x54]
push ecx
push 0x8004667e
push esi
mov dword [esp + 0x60], edi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x42b7ff
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], edi
mov byte [esp + 0x68], 0
push 4
push str.GET
lea ecx, [esp + 0x70]
mov dword [esp + 0x850], edi
call fcn.00404e60
mov edx, dword [esp + 0x1c]
mov eax, edx
lea esi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b950
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x70]
call fcn.004047e0
push 0x18
push str._HTTP_1.1_r_nAccept:___r_n
lea ecx, [esp + 0x70]
call fcn.004047e0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x42bafa
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42b985
sub eax, edx
push eax
push esi
lea ecx, [esp + 0x70]
call fcn.004047e0
mov ecx, dword [esp + 0x7c]
mov esi, dword [esp + 0x68]
mov eax, esi
cmp ecx, 0x10
jae 0x42b9ac
lea eax, [esp + 0x68]
mov edx, dword [esp + 0x78]
cmp byte [eax + edx - 2], 0xd
jne 0x42b9c9
mov eax, esi
cmp ecx, 0x10
jae 0x42b9c2
lea eax, [esp + 0x68]
cmp byte [eax + edx - 1], 0xa
je 0x42b9d9
push 2
push 0x4f6544
lea ecx, [esp + 0x70]
call fcn.004047e0
push 0xc
push str._nUser_Agent:
lea edx, [esp + 0x70]
push edx
xor eax, eax
call fcn.004127d0
cmp eax, 0xffffffff
jne 0x42ba2d
push 0
lea eax, [esp + 0x6c]
push eax
mov edx, str._nUSER_AGENT:
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42ba2d
push 0
lea ecx, [esp + 0x6c]
push ecx
mov edx, 0x4f6568
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42ba2d
push 0x4e
push str.User_Agent:_Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.1__Gecko_Firefox_r_n
lea ecx, [esp + 0x70]
call fcn.004047e0
push 6
push str._nHost:
lea edx, [esp + 0x70]
push edx
xor eax, eax
call fcn.004127d0
cmp eax, 0xffffffff
jne 0x42ba9f
push 0
lea eax, [esp + 0x6c]
push eax
mov edx, 0x4f65d0
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42ba9f
push 0
lea ecx, [esp + 0x6c]
push ecx
mov edx, str._nHOST:
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42ba9f
push 6
push str.Host:
lea ecx, [esp + 0x70]
call fcn.004047e0
mov edx, dword [esp + 0x18]
push edx
lea ecx, [esp + 0x6c]
call fcn.00404650
push 2
push 0x4f6544
lea ecx, [esp + 0x70]
call fcn.004047e0
push 0x11
push str._nAccept_Encoding:
lea eax, [esp + 0x70]
push eax
xor eax, eax
call fcn.004127d0
cmp eax, 0xffffffff
jne 0x42bb64
push 0
lea ecx, [esp + 0x6c]
push ecx
mov edx, str._naccept_encoding:
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42bb64
push 0
lea edx, [esp + 0x6c]
push edx
mov edx, str._nACCEPT_ENCODING:
call fcn.004120d0
cmp eax, 0xffffffff
jne 0x42bb64
cmp dword [ebp + 0x18], 0
je 0x42bb64
push 0x20
push str.Accept_Encoding:_gzip__deflate_r_n
jmp 0x42bb5b
cmp dword [ebp + 0x18], 0
je 0x42bb10
push 0x20
push str.Accept_Encoding:_gzip__deflate_r_n
lea ecx, [esp + 0x70]
call fcn.004047e0
push 0x4e
push str.User_Agent:_Mozilla_4.0__compatible__MSIE_7.0__Windows_NT_5.1__Gecko_Firefox_r_n
lea ecx, [esp + 0x70]
call fcn.004047e0
push 6
push str.Host:
lea ecx, [esp + 0x70]
call fcn.004047e0
mov edx, dword [esp + 0x18]
mov eax, edx
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42bb40
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x70]
call fcn.004047e0
push 2
push 0x4f6544
lea ecx, [esp + 0x70]
call fcn.004047e0
push 0x15
push str.Connection:_close_r_n_r_n
lea ecx, [esp + 0x70]
call fcn.004047e0
mov edi, dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
lea eax, [esp + 0x24]
xor esi, esi
push eax
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
call edi
cmp dword [esp + 0x7c], 0x10
mov eax, dword [esp + 0x68]
jae 0x42bb9a
lea eax, [esp + 0x68]
mov ecx, dword [esp + 0x78]
push esi
mov esi, dword [esp + 0x14]
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x42bbcf
push esi
mov byte [ebx], 2
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [esp + 0x68]
call fcn.00404a40
jmp 0x42c159
lea esi, [esp + 0x24]
call fcn.00445730
mov ecx, eax
mov eax, 0x431bde83
mul ecx
shr edx, 0x12
mov dword [ebx + 0x10], ecx
cmp dword [ebp + 0x14], edx
jb 0x42c121
mov esi, dword [ebp + 0x14]
xor eax, eax
sub esi, edx
mov edx, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x24]
push eax
mov dword [ebp + 0x14], esi
mov dword [esp + 0x9c], edx
mov dword [esp + 0x98], 1
call edi
lea ecx, [esp + 0x60]
push ecx
push 0
push 0
lea edx, [esp + 0xa0]
push edx
push 0
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], 0
call dword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
jne 0x42bc7a
mov eax, dword [esp + 0x10]
push eax
mov byte [ebx], 8
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [esp + 0x7c], 0x10
jb 0x42c159
mov ecx, dword [esp + 0x68]
push ecx
call fcn.00460bb0
add esp, 4
jmp 0x42c159
lea edx, [esp + 0x2c]
push edx
call edi
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
sub esi, dword [esp + 0x24]
mov edi, dword [esp + 0x30]
sbb edi, dword [esp + 0x28]
push 0
push 0xf4240
push eax
push ecx
call fcn.0048b6a0
push edx
push eax
push edi
push esi
call fcn.0048b6a0
push 0
push 0x3e8
push edx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], edx
call fcn.0048b6a0
mov ecx, eax
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov dword [ebx + 0x14], ecx
cmp dword [ebp + 0x14], edx
jb 0x42bc49
sub dword [ebp + 0x14], edx
mov esi, dword [esp + 0x10]
push 4
lea edx, [esp + 0x54]
push edx
push 0x1006
push 0xffff
push esi
mov dword [esp + 0x64], 0xbb8
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x42bd37
push esi
mov byte [ebx], 0x67
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [esp + 0x7c], 0x10
jb 0x42c159
mov eax, dword [esp + 0x68]
push eax
call fcn.00460bb0
add esp, 4
jmp 0x42c159
lea ecx, [esp + 0x24]
xor edi, edi
push ecx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
push 0x400
lea edx, [esp + 0x438]
push edi
push edx
call fcn.00488a00
add esp, 0xc
push 0x2800
call fcn.00460bbb
add esp, 4
push 0x2800
push edi
push eax
mov dword [esp + 0x20], eax
call fcn.00488a00
add esp, 0xc
push edi
push 0x400
lea eax, [esp + 0x43c]
push eax
mov ecx, esi
push ecx
mov dword [esp + 0x2c], 0x2800
call dword [sym.imp.WS2_32.dll_recv]
mov dword [esp + 0x18], eax
cmp eax, edi
je 0x42bf4c
lea ecx, [ecx]
mov esi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x42bf16
lea ebx, [edi + eax]
mov dword [esp + 0x44], ebx
cmp ebx, dword [esp + 0x1c]
jbe 0x42be58
push edi
call fcn.00460bbb
add esp, 4
push edi
mov ebx, eax
push 0
push ebx
call fcn.00488a00
add esp, 0xc
push edi
push esi
push ebx
call fcn.00488b10
add esp, 0xc
push esi
call fcn.00460bb0
mov eax, dword [esp + 0x20]
add eax, 0x2800
add esp, 4
push eax
mov dword [esp + 0x20], eax
call fcn.00460bbb
mov esi, eax
mov eax, dword [esp + 0x20]
add esp, 4
push eax
push 0
push esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x28], eax
call fcn.00488a00
add esp, 0xc
push edi
push ebx
push esi
call fcn.00488b10
add esp, 0xc
push ebx
call fcn.00460bb0
mov edx, dword [esp + 0x1c]
add esp, 4
push edx
lea eax, [esp + 0x438]
push eax
add esi, edi
push esi
call fcn.00488b10
mov edi, dword [esp + 0x50]
jmp 0x42be6b
push eax
lea ecx, [esp + 0x438]
push ecx
add esi, edi
push esi
call fcn.00488b10
mov edi, ebx
add esp, 0xc
push 0x400
lea edx, [esp + 0x438]
push 0
push edx
call fcn.00488a00
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.DLL_QueryPerformanceCounter]
mov ecx, dword [esp + 0x38]
mov esi, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
sub esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x30]
sbb ebx, dword [esp + 0x28]
push 0
push 0xf4240
push ecx
push edx
call fcn.0048b6a0
push edx
push eax
push ebx
push esi
call fcn.0048b6a0
mov esi, dword [ebp + 0x14]
push 0
imul esi, esi, 0x3e8
push 0x3e8
push edx
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], edx
call fcn.0048b6a0
xor ecx, ecx
cmp edx, ecx
jg 0x42bf45
jl 0x42beea
cmp eax, esi
jae 0x42bf45
mov ecx, dword [esp + 0x10]
push 0
push 0x400
lea eax, [esp + 0x43c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_recv]
mov ebx, dword [esp + 0x20]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x42bdb0
jmp 0x42bf4c
test edi, edi
jne 0x42bf4c
mov edx, dword [esp + 0x10]
push edx
mov byte [ebx], 3
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push esi
call fcn.00460bb0
add esp, 4
lea ecx, [esp + 0x68]
call fcn.00404a40
jmp 0x42c159
mov ebx, dword [esp + 0x20]
mov byte [ebx], 9
lea esi, [esp + 0x24]
call fcn.00445730
push 0
push 0x3e8
push edx
push eax
call fcn.0048b6a0
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x14]
push str._r_n_r_n
push eax
mov dword [ebx + 0x1c], edi
call fcn.00486cd0
add esp, 8
mov dword [esp + 0x20], eax
test eax, eax
jne 0x42bf9e
mov ecx, dword [esp + 0x10]
push ecx
mov byte [ebx], 9
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [esp + 0x14]
push edx
jmp 0x42bf2f
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
sub eax, esi
add eax, 5
push eax
mov dword [ebx + 0x3c], eax
call fcn.00460bbb
mov ecx, dword [ebx + 0x3c]
add esp, 4
push ecx
push 0
push eax
mov dword [ebx + 0x40], eax
call fcn.00488a00
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x40]
add esp, 0xc
dec edx
push edx
push esi
push eax
call fcn.00488b10
mov eax, dword [ebx + 0x40]
add esp, 0xc
push str._r_nContent_Type:
push eax
call fcn.00486cd0
mov esi, eax
add esp, 8
test esi, esi
je 0x42c042
lea ecx, [esi + 2]
push 0x4f6544
push ecx
call fcn.00486cd0
mov edx, 0xfff1
sub edx, esi
add eax, edx
mov word [ebx + 0x34], ax
movzx eax, ax
push eax
call fcn.00460bbb
movzx ecx, word [ebx + 0x34]
add esp, 0xc
push ecx
push 0
push eax
mov dword [ebx + 0x38], eax
call fcn.00488a00
movzx edx, word [ebx + 0x34]
mov eax, dword [ebx + 0x38]
add esp, 0xc
dec edx
push edx
add esi, 0x10
push esi
push eax
call fcn.00488b10
add esp, 0xc
mov eax, dword [ebx + 0x40]
mov dx, word [eax + 9]
lea ecx, [ebx + 0x44]
mov word [ecx], dx
mov al, byte [eax + 0xb]
push ecx
mov byte [ecx + 2], al
call fcn.00485fcb
add esp, 4
mov word [ebx + 0x2a], ax
mov eax, dword [ebx + 0x40]
push str.Content_Encoding:_gzip
push eax
call fcn.00486cd0
add esp, 8
test eax, eax
jne 0x42c095
mov eax, dword [ebx + 0x40]
push str.content_encoding:_gzip
push eax
call fcn.00486cd0
add esp, 8
test eax, eax
jne 0x42c095
sub edi, dword [ebx + 0x3c]
inc edi
mov dword [ebx + 0x20], edi
jmp 0x42c0f6
push 0x400000
mov dword [esp + 0x1c], 0x400000
call fcn.00460bbb
add esp, 4
push 0x400000
mov esi, eax
push 0
push esi
call fcn.00488a00
sub edi, dword [ebx + 0x3c]
mov edx, dword [esp + 0x2c]
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
push esi
inc edi
add edx, 4
push edi
push edx
call fcn.0042aa90
add esp, 0x10
cmp eax, 0xffffffff
je 0x42c0e5
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x20], eax
jmp 0x42c0ed
cmp byte [ebx], 0
jne 0x42c0ed
mov byte [ebx], 5
push esi
call fcn.00460bb0
add esp, 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov edx, dword [esp + 0x14]
push edx
call fcn.00460bb0
add esp, 4
lea ecx, [esp + 0x68]
call fcn.00404a40
xor eax, eax
jmp 0x42c15c
mov edx, dword [esp + 0x10]
push edx
mov byte [ebx], 7
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
lea ecx, [esp + 0x68]
call fcn.00404a40
jmp 0x42c159
mov eax, dword [esp + 0x10]
push eax
mov byte [ebx], 6
call dword [sym.imp.WS2_32.dll_closesocket]
call dword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x42c159
mov byte [ebx], 0x64
or eax, 0xffffffff
mov ecx, dword [esp + 0x840]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x828]
xor ecx, esp
call fcn.004840ae
mov esp, ebp
pop ebp
ret