Function at 0x4b7110
Capabilities:
Check for time delay via gettickcount
Create thread
Resolve dns

Disassembly:
sub esp, 0xf4
mov eax, dword [0x5894dc]
xor eax, esp
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0x11c]
push ebx
mov ebx, dword [esp + 0x10c]
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x120]
push edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x128]
mov edi, ecx
mov ecx, dword [esp + 0x120]
mov byte [eax], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], edx
mov byte [edx], 0
call fcn.00407610
mov ecx, dword [esp + 0x10]
mov dword [esi], 0
lea esi, [edi + 8]
push ecx
mov ecx, esi
call fcn.004091c0
push 0x510649
push str.http:__
mov ecx, esi
call fcn.004087f0
push 0x510649
push str.https:__
mov ecx, esi
call fcn.004087f0
push 0x2f
mov ecx, esi
call fcn.004074f0
push 0x3a
mov ecx, esi
call fcn.004074f0
mov ecx, esi
call fcn.00407400
mov ecx, esi
call fcn.0046fb80
test eax, eax
jne 0x4b7213
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push str.Invalid_hostname_for_resolving_hostname_to_IP_address.
mov ecx, ebx
call eax
mov eax, dword [esp + 0x10]
mov edx, dword [ebx]
mov edx, dword [edx + 0x28]
push eax
push str.hostname
mov ecx, ebx
call edx
xor al, al
mov ecx, dword [esp + 0x100]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ec47e
add esp, 0xf4
ret 0x28
mov ecx, esi
call fcn.004e81e0
test ebp, ebp
mov esi, eax
mov dword [esp + 0x10], esi
je 0x4b7231
push esi
push str.HostnameResolve
mov ecx, ebp
call fcn.0044e7a0
cmp dword [esp + 0x114], 0
je 0x4b7469
test ebp, ebp
je 0x4b7469
mov eax, dword [ebx]
mov edx, dword [eax + 0x28]
push esi
push str.dnsCacheLookup
mov ecx, ebx
call edx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.004d64d0
add esp, 8
test al, al
je 0x4b7303
mov ecx, esi
call fcn.0046fb80
test eax, eax
je 0x4b7303
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x38]
push ecx
push str._d._d._d._d
mov ecx, esi
call fcn.004e81e0
push eax
call fcn.004edb68
add esp, 0x18
cmp eax, 4
jne 0x4b7303
mov eax, dword [esp + 0x20]
movzx ecx, byte [esp + 0x30]
movzx edx, byte [esp + 0x2c]
mov byte [eax + 1], cl
movzx ecx, byte [esp + 0x18]
mov byte [eax], dl
movzx edx, byte [esp + 0x14]
mov byte [eax + 3], cl
mov ecx, esi
mov byte [eax + 2], dl
call fcn.004e81e0
push eax
push str.ResolvedToIp
mov ecx, ebp
call fcn.0044e7a0
mov edi, dword [ebx]
mov ecx, esi
add edi, 0x28
call fcn.004e81e0
mov edx, dword [edi]
push eax
push str.dnsCacheHit
mov ecx, ebx
call edx
mov al, 1
jmp 0x4b71f8
mov eax, dword [esp + 0x114]
push 0x3e9
mov ecx, edi
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], ebp
mov byte [edi + 0x60], 1
call fcn.004b75a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x34]
push ecx
push 0
push edi
push 0x4b6e30
push 0
push 0
mov dword [esp + 0x2c], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebx]
mov eax, dword [edx + 0x14]
push str.Resolving_domain_name__IPV4_
mov ecx, ebx
call eax
xor eax, eax
xor esi, esi
cmp byte [edi + 0x60], al
jne 0x4b73d4
mov esi, dword [esp + 0x1c]
lea edx, [edi + 0x38]
push edx
mov ecx, esi
call fcn.00409270
mov eax, dword [edi + 0x64]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
mov ecx, esi
call fcn.0046fb80
test eax, eax
je 0x4b7397
mov ecx, esi
call fcn.004e81e0
mov edx, dword [esp + 0x10]
push eax
push edx
call fcn.004d6560
add esp, 8
mov ecx, esi
call fcn.0046fb80
test eax, eax
je 0x4b73b6
mov ecx, esi
call fcn.004e81e0
push eax
push str.ResolvedToIp
mov ecx, ebp
call fcn.0044e7a0
mov ecx, esi
call fcn.0046fb80
test eax, eax
setne al
jmp 0x4b71f8
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, 0xc8
mov dword [esp + 0x18], eax
jle 0x4b73e6
push 0xa
jmp 0x4b73e8
push 2
call fcn.0041e160
mov eax, dword [esp + 0x118]
add esi, 1
add esp, 4
cmp esi, eax
jb 0x4b7438
push 0x74
push eax
mov ecx, ebp
xor esi, esi
call fcn.0044e7f0
mov ecx, ebp
call fcn.0044e700
test al, al
jne 0x4b7443
cmp dword [esp + 0x110], 0
je 0x4b7438
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jbe 0x4b7438
sub eax, ecx
cmp eax, dword [esp + 0x110]
ja 0x4b745d
cmp byte [edi + 0x60], 0
jne 0x4b73d0
jmp 0x4b735f
mov ecx, dword [esp + 0x24]
mov byte [ecx], 1
mov edx, dword [ebx]
mov eax, dword [edx + 0x10]
push str.DNS_lookup_aborted_by_application_callback
mov ecx, ebx
call eax
jmp 0x4b71f6
mov ecx, dword [esp + 0x28]
mov byte [ecx], 1
jmp 0x4b71f6
mov eax, dword [ebx]
mov edx, dword [eax + 0x14]
push str.Resolving_domain_name__IPV4__via_gethostbyname
mov ecx, ebx
call edx
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x4b71f6
mov ecx, dword [eax + 0xc]
cmp dword [ecx], 0
je 0x4b7498
mov ecx, dword [ecx]
mov edx, dword [ecx]
mov ecx, dword [esp + 0x20]
mov dword [ecx], edx
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 1]
push edx
movzx edx, byte [eax]
push ecx
push edx
lea eax, [esp + 0x48]
push str._d._d._d._d
push eax
call fcn.004ed7f9
mov esi, dword [esp + 0x34]
add esp, 0x18
lea ecx, [esp + 0x38]
push ecx
mov ecx, esi
call fcn.004091c0
test ebp, ebp
je 0x4b74ea
mov ecx, esi
call fcn.004e81e0
push eax
push str.ResolvedToIp
mov ecx, ebp
call fcn.0044e7a0
mov al, 1
jmp 0x4b71f8