Function at 0x452100
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x536336
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2198
call fcn.00501720
mov eax, dword [0x57c54c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21a4], ecx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x21a0], ecx
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov byte [ebp - 4], 1
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
cmp dword [ebp - 0x2154], 0x10
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x2158], 0
lea edx, [ecx + 1]
cmovae eax, dword [ebp - 0x2168]
mov byte [eax], 0
lea eax, [ebp - 0x2180]
cmp dword [ebp - 0x216c], 0x10
mov dword [ebp - 0x2170], 0
cmovae eax, dword [ebp - 0x2180]
mov byte [eax], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452215
sub ecx, edx
push ecx
push dword [ebp - 0x21a0]
lea ecx, [ebp - 0x2168]
call fcn.0040add0
push 0x80
lea eax, [ebp - 0x150]
push 0
push eax
call fcn.00503920
add esp, 0xc
lea eax, [ebp - 0x150]
push str.w.nanweng.cn
push 0x80
push eax
call fcn.0050c68a
add esp, 0xc
push str.w.nanweng.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x219c], eax
test eax, eax
je 0x452543
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4525d3
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x2194], xmm0
push 0x50
mov word [ebp - 0x2194], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2192], ax
mov eax, dword [ebp - 0x219c]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2190], eax
lea eax, [ebp - 0x2194]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x452536
push 4
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0xbb8
push eax
push 0x1005
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x2184]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0x219c], str._qy_sv
jle 0x452376
push 0x80
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x219c], str._qy_ov
push 0
push eax
call fcn.00503920
add esp, 0xc
lea eax, [ebp - 0xd0]
push dword [ebx + 0xc]
push str.type_d
push eax
call fcn.00452af0
add esp, 0xc
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0x2168]
push eax
call fcn.00408150
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x1c], 0x75744e58
cmovae eax, dword [ebp - 0x2168]
xorps xmm0, xmm0
push ecx
mov ecx, dword [ebp - 0x21a4]
push eax
movups xmmword [ebp - 0x4c], xmm0
mov word [ebp - 0x18], 0x4e52
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x24], 0x67697326
mov word [ebp - 0x20], 0x3d
call fcn.004526e0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2168]
call fcn.00408150
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2168]
call fcn.00408150
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x2168]
lea edx, [ebp - 0x2198]
cmovae ecx, dword [ebp - 0x2168]
call fcn.0046f530
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.00503920
mov ecx, dword [ebp - 0x2198]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452427
sub ecx, edx
lea eax, [ebp - 0x150]
push ecx
push eax
push dword [ebp - 0x219c]
lea eax, [ebp - 0x2150]
push str.POST__s_HTTP_1.1_r_nHost:__s__r_nContent_Length:__d__r_nConnection:close_r_nAccept_Language:_zh_cn_r_nCache_Conbtrol:no_cache_r_nContent_Type:application_x_www_form_urlencoded_r_n_r_n
push eax
call fcn.004366c0
lea ecx, [ebp - 0x2150]
add esp, 0x14
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452460
sub ecx, edx
lea eax, [ebp - 0x2150]
push ecx
push eax
lea ecx, [ebp - 0x2180]
call fcn.0040add0
push dword [ebp - 0x2198]
lea ecx, [ebp - 0x2180]
call fcn.00408150
push 0x55f598
lea ecx, [ebp - 0x2180]
call fcn.00408150
push dword [ebp - 0x2198]
call fcn.005010e5
mov eax, dword [ebp - 0x2198]
add esp, 4
test eax, eax
mov ecx, 0x8123
cmovne eax, ecx
mov dword [ebp - 0x2198], eax
cmp dword [ebp - 0x216c], 0x10
lea eax, [ebp - 0x2180]
push 0
push dword [ebp - 0x2170]
cmovae eax, dword [ebp - 0x2180]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x452536
cmp edi, 5
jg 0x4525a0
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.00503920
add esp, 0xc
lea eax, [ebp - 0x2150]
push 0
push 0x1000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jg 0x45255b
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x12c
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4524c1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
call esi
inc edi
cmp edi, 0xa
jg 0x4525a0
mov ecx, dword [ebp - 0x21a0]
jmp 0x4521d0
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x2150]
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
push str.HTTP_1.1
push eax
movq qword [ebp - 0x28], xmm0
call fcn.00503360
add esp, 8
test eax, eax
jne 0x4525a8
lea eax, [ebp - 0x2150]
push str.HTTP_1.0
push eax
call fcn.00503360
add esp, 8
test eax, eax
jne 0x4525a5
or esi, 0xffffffff
jmp 0x4525d5
add eax, 9
add eax, 9
push 4
push eax
lea eax, [ebp - 0x28]
push 0xc
push eax
call fcn.0050c67f
lea eax, [ebp - 0x28]
push eax
call fcn.0050da22
add esp, 0x14
cmp eax, 0xc8
je 0x4525d3
cmp eax, 0x1f4
jne 0x4525a0
xor esi, esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x216c]
cmp edx, 0x10
jb 0x452613
mov ecx, dword [ebp - 0x2180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452609
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4526a8
push edx
push ecx
call fcn.005010b4
add esp, 8
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2154]
cmp edx, 0x10
jb 0x45266b
mov ecx, dword [ebp - 0x2168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x452661
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4526ad
push edx
push ecx
call fcn.005010b4
add esp, 8
mov dword [ebp - 0x2158], 0
mov eax, esi
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00500b45
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.00508868
call fcn.00508868
int3