Function at 0x4036c0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create raw socket
Create tcp socket
Create udp socket
Get common file path
Get socket status
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5e1ba7
push eax
mov eax, 0x4b4dc
mov dword fs:[0], esp
call fcn.00494cd0
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x51]
mov byte [esp + 0x50], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x4b4fc]
lea ecx, [esp + 0x50]
push eax
push str.http:__users.qzone.qq.com_fcg_bin_cgi_get_portrait.fcg_uins_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
xor ebp, ebp
push ebp
call fcn.00403600
add esp, 0x10
lea edx, [esp + 0x258]
push ebp
push 0x20
push edx
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x403743
push ebp
lea eax, [esp + 0x25c]
push ebp
push eax
call fcn.004033d0
add esp, 0xc
mov ecx, 0x12bff
xor eax, eax
lea edi, [esp + 0x4ed]
mov byte [esp + 0x4ec], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x65290c]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x18], ecx
push ebp
push ebp
push ebp
push ebp
push ebp
push ebp
lea ecx, [esp + 0x54]
mov dword [esp + 0x4b50c], ebp
call fcn.005d940a
push ebp
push ebp
push 1
lea edx, [esp + 0x5c]
push 1
push edx
lea ecx, [esp + 0x50]
mov byte [esp + 0x4b508], 1
call fcn.005d9505
mov ebx, eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
mov eax, dword [ebx]
call dword [eax + 0x58]
test eax, eax
je 0x403878
push 0
lea ecx, [esp + 0x1c]
call fcn.005c4f90
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4ec]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x649a14
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x4f0]
push ecx
call fcn.00494a10
add esp, 8
test eax, eax
jne 0x403825
lea edx, [esp + 0x4ec]
push 0x649a10
push edx
call fcn.00494a10
add esp, 8
test eax, eax
jne 0x403849
mov eax, dword [ebx]
lea ecx, [esp + 0x18]
push ecx
mov ecx, ebx
call dword [eax + 0x58]
test eax, eax
jne 0x4037b0
jmp 0x403878
lea edx, [esp + 0x4ec]
push str.__0_
push edx
call fcn.00494a10
mov byte [eax], 0
lea eax, [esp + 0x4f4]
push 0x649a14
push eax
jmp 0x40386b
lea ecx, [esp + 0x4ec]
push str.__0_
push ecx
call fcn.00494a10
lea edx, [esp + 0x4f4]
push 0x649a10
mov byte [eax], 0
push edx
call fcn.00494a10
mov ebp, eax
add esp, 0x10
add ebp, 3
mov eax, dword [0x65290c]
mov dword [esp + 0x10], eax
test ebp, ebp
mov byte [esp + 0x4b4f4], 2
je 0x403a55
mov dword [esp + 0x14], eax
push ebp
lea ecx, [esp + 0x18]
mov byte [esp + 0x4b4f8], 3
call fcn.005c4ce9
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x14]
mov eax, dword [eax - 8]
push eax
push 0
call fcn.005c4f90
push eax
call fcn.00403260
add esp, 8
lea ecx, [esp + 0x1c]
push 0x6499f8
call fcn.005c4bce
lea ecx, [esp + 0x35c]
mov byte [esp + 0x4b4f4], 4
push ecx
push 0x201
mov bl, 1
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40393c
push 0x40
push 0x64994c
push 0x6499d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4b4f4], 3
call fcn.005c4b60
lea ecx, [esp + 0x14]
mov byte [esp + 0x4b4f4], 2
call fcn.005c4b60
jmp 0x403a77
lea edx, [esp + 0x30]
mov dword [esp + 0x30], 1
push edx
push 0x8004667e
push esi
call dword [sym.imp.WS2_32.dll_ioctlsocket]
push 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 3
mov dword [esp + 0x3c], 0
call fcn.005c4f90
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebp, dword [esp + 0x4b500]
mov edi, eax
test edi, edi
je 0x4039f1
xor eax, eax
push ebp
mov dword [esp + 0x24], eax
mov word [esp + 0x24], 2
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x22], ax
mov ecx, dword [edi + 0xc]
push 0x10
mov edx, dword [ecx]
lea ecx, [esp + 0x24]
push ecx
push esi
mov eax, dword [edx]
mov dword [esp + 0x30], eax
call dword [sym.imp.WS2_32.dll_connect]
lea edx, [esp + 0x34]
lea eax, [esp + 0x154]
push edx
push 0
push eax
push 0
push 0
mov dword [esp + 0x16c], esi
mov dword [esp + 0x168], 1
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
jg 0x4039f3
xor bl, bl
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esp + 0x18]
push 0x6499a4
push edx
call fcn.005bd692
add esp, 0x10
test bl, bl
je 0x403a1d
push 0x649994
lea ecx, [esp + 0x20]
call fcn.005c4ce9
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
push 0x40
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4b4f4], 3
call fcn.005c4b60
lea ecx, [esp + 0x14]
mov byte [esp + 0x4b4f4], 2
call fcn.005c4b60
jmp 0x403a77
push 0x649988
lea ecx, [esp + 0x14]
call fcn.005c4ce9
mov edx, dword [esp + 0x10]
push 0x40
push 0x64997c
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x4b4f4], 1
call fcn.005c4b60
lea ecx, [esp + 0x3c]
mov byte [esp + 0x4b4f4], 0
call fcn.005d93c5
lea ecx, [esp + 0x18]
mov dword [esp + 0x4b4f4], 0xffffffff
call fcn.005c4b60
mov ecx, dword [esp + 0x4b4ec]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4b4e8
ret