Function at 0x426cf0
Capabilities:
Connect socket
Initialize winsock library
Receive data
Receive data on socket
Resolve dns

Disassembly:
sub esp, 0xcdc
mov eax, dword [0x48b270]
xor eax, esp
mov dword [esp + 0xcd8], eax
push ebx
push ebp
push edi
mov edi, ecx
mov dword [esp + 0x2c], edi
mov edx, dword [esp + 0xcfc]
mov eax, dword [esp + 0xcec]
mov ebp, dword [esp + 0xcf0]
mov ebx, dword [esp + 0xcf4]
mov ecx, dword [esp + 0xcf8]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push ecx
push 0x400
mov dword [esp + 0x20], edx
lea edx, [esp + 0x8ec]
push edx
push pe_nt_image_headers32
lea ecx, [esp + 0x7f4]
push ecx
push 0x14
lea edx, [esp + 0x1e8]
push edx
push eax
mov ecx, edi
call fcn.00426b90
mov ecx, str.HTTP
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426d95
test dl, dl
je 0x426d91
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426d95
add eax, 2
add ecx, 2
test dl, dl
jne 0x426d75
xor eax, eax
jmp 0x426d9a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x426da8
mov eax, 1
jmp 0x42717c
lea eax, [esp + 0x40]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x426d9e
push esi
push eax
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
mov dword [esp + 0x20], esi
cmp esi, 0xffffffff
je 0x426e1c
mov edx, dword [esp + 0x18]
mov ecx, 2
push edx
mov word [esp + 0x38], cx
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x36], ax
lea eax, [esp + 0x7e8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x426e06
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [esp + 0x38], eax
push 0x10
lea eax, [esp + 0x38]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x426e26
mov eax, 1
jmp 0x42717b
cmp byte [esp + 0x8e8], 0
jne 0x426e48
push 0x400
push 0x46f790
lea ecx, [esp + 0x8f0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
test ebx, ebx
jne 0x426e60
push str.GET
push 0x400
lea edx, [esp + 0x1f0]
push edx
jmp 0x426e72
push 0x473a90
push 0x400
lea eax, [esp + 0x1f0]
push eax
call fcn.00453ad5
add esp, 0xc
lea ecx, [esp + 0x8e8]
push ecx
lea edx, [esp + 0x1ec]
push 0x400
push edx
call fcn.00455a5b
push str._HTTP_1.1_r_n
lea eax, [esp + 0x1f8]
push 0x400
push eax
call fcn.00455a5b
push str.Accept:_application_x_ms_application__image_gif__image_x_xbitmap__image_jpeg__image_pjpeg__application_xamlxml__application_x_ms_xbap__application_vnd.ms_excel__application_msword__application_vnd.ms_powerpoint____r_n
lea ecx, [esp + 0x204]
push 0x400
push ecx
call fcn.00455a5b
push str.Accept_Language:_zh_CN_r_n
lea edx, [esp + 0x210]
push 0x400
push edx
call fcn.00455a5b
push str.Accept_Encoding:_gzip__deflate_r_n
lea eax, [esp + 0x21c]
push 0x400
push eax
call fcn.00455a5b
push str.User_Agent:_Mozilla_4.0_r_n
lea ecx, [esp + 0x228]
push 0x400
push ecx
call fcn.00455a5b
mov eax, dword [esp + 0x5c]
add esp, 0x48
test eax, eax
je 0x426f43
push eax
lea edx, [esp + 0x5ec]
push str.Content_Length:__ld_r_n
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x5f4]
push eax
lea ecx, [esp + 0x1f8]
push 0x400
push ecx
call fcn.00455a5b
add esp, 0x18
push str.Host:
lea edx, [esp + 0x1ec]
push 0x400
push edx
call fcn.00455a5b
lea eax, [esp + 0x7f4]
push eax
lea ecx, [esp + 0x1f8]
push 0x400
push ecx
call fcn.00455a5b
push 0x46f1f0
lea edx, [esp + 0x204]
push 0x400
push edx
call fcn.00455a5b
add esp, 0x24
test ebp, ebp
je 0x426fa9
cmp byte [ebp], 0
je 0x426fa9
lea eax, [esp + 0x1e8]
push ebp
push eax
call fcn.00426cb0
add esp, 8
push str.Connection:close_r_n
lea ecx, [esp + 0x1ec]
push 0x400
push ecx
call fcn.00455a5b
push 0x46f1f0
lea edx, [esp + 0x1f8]
push 0x400
push edx
call fcn.00455a5b
add esp, 0x18
test ebx, ebx
je 0x426ffb
mov eax, dword [esp + 0x14]
test eax, eax
je 0x426ffb
mov byte [ebx + eax], 0
lea eax, [esp + 0x1e8]
push ebx
push eax
call fcn.00426cb0
add esp, 8
lea ecx, [esp + 0x1e8]
push ecx
push esi
mov ecx, edi
call fcn.00426b60
lea eax, [esp + 0x1e8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x427015
sub eax, edx
lea edx, [eax*4]
push edx
call fcn.0045306c
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
lea ecx, [esp + 0x1ec]
add esp, 4
lea edi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x427040
sub ecx, edi
lea edx, [esp + 0x1e8]
add ecx, ecx
push edx
add ecx, ecx
push ecx
push eax
call fcn.00453ad5
mov ebx, 0xa
push ebx
call fcn.0045306c
mov edi, eax
add esp, 0x10
xor eax, eax
mov ebp, edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
jmp 0x427084
mov esi, dword [esp + 0x20]
push 0
push 1
lea edx, [esp + 0x5f0]
push edx
push esi
call dword [sym.imp.WS2_32.dll_recv]
mov ecx, 1
test eax, eax
jge 0x4270a4
mov dword [esp + 0x14], ecx
mov al, byte [esp + 0x5e8]
cmp al, 0xa
je 0x4270b9
cmp al, 0xd
je 0x4270cc
add dword [esp + 0x18], ecx
jmp 0x4270cc
cmp dword [esp + 0x18], 0
jne 0x4270c4
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], 0
mov esi, ebp
sub esi, edi
mov byte [esp + 0x10], al
cmp esi, ebx
jb 0x4270e9
add ebx, ebx
push ebx
push edi
call fcn.0045541e
mov edi, eax
add esp, 8
lea ebp, [esi + edi]
mov al, byte [esp + 0x10]
mov byte [ebp], al
inc ebp
cmp dword [esp + 0x14], 0
je 0x427080
mov ebx, dword [esp + 0x1c]
mov dword [ebx + 4], edi
push 0xa
mov byte [ebp], 0
mov dword [esp + 0x30], 0xa
call fcn.0045306c
add esp, 4
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea ecx, [ecx]
mov esi, dword [esp + 0x20]
push 0
push 0x1ff
lea ecx, [esp + 0x5f0]
push ecx
push esi
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x42715f
mov ecx, dword [esp + 0x30]
push eax
lea edx, [esp + 0x5ec]
mov byte [esp + eax + 0x5ec], 0
push edx
lea eax, [esp + 0x2c]
push eax
call fcn.00426b00
jmp 0x427120
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov byte [eax], 0
sub eax, ecx
push esi
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
pop esi
mov ecx, dword [esp + 0xce4]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004517f0
add esp, 0xcdc
ret 0x14