Function at 0x401f49
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Receive data
Receive data on socket
Reference http user-agent string
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header

Disassembly:
push ebp
lea ebp, [esp - 0x428]
sub esp, 0x4a8
mov eax, dword [0x45c32c]
xor eax, ebp
mov dword [ebp + 0x424], eax
mov eax, dword [ebp + 0x434]
push ebx
push esi
mov esi, dword [ebp + 0x448]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x438]
push edi
mov edi, dword [ebp + 0x430]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x43c]
push edi
mov dword [ebp - 0x78], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
test ebx, ebx
jne 0x401fa2
xor eax, eax
jmp 0x40218d
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebp - 0x74], eax
je 0x401f9b
cmp byte [0x45da9c], 0
mov word [ebp - 0x6c], 2
je 0x402000
cmp dword [0x574768], 0
jne 0x402000
cmp dword [ebp + 0x444], 0
jne 0x402000
movzx eax, word [0x45da98]
push eax
call dword [sym.imp.WS2_32.dll_htons]
push dword [0x45da94]
mov word [ebp - 0x6a], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x7c], eax
push 4
lea eax, [ebp - 0x7c]
push eax
jmp 0x40201a
push dword [ebp + 0x440]
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x6a], ax
movsx eax, word [ebx + 0xa]
push eax
mov eax, dword [ebx + 0xc]
push dword [eax]
lea eax, [ebp - 0x68]
push eax
call fcn.00426fe0
add esp, 0xc
push 0x10
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x401f9b
xor ebx, ebx
cmp esi, ebx
je 0x40206b
cmp byte [esi], bl
je 0x40206b
push esi
call fcn.00426920
push eax
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__Trident_4.0__GTB7.4__InfoPath.2__SV1__.NET_CLR_3.3.69573__WOW64__en_US_
push edi
push dword [ebp - 0x70]
lea eax, [ebp - 0x5c]
push str.POST__s_HTTP_1.0_r_nHost:__s_r_nX_Requested_With:_XMLHttpRequest_r_nAccept:_application_json__text_javascript_____r_nAccept_Encoding:_gzip__deflate_r_nUser_Agent:__s_r_nContent_Type:_application_x_www_form_urlencoded__charsetUTF_8_r_nContent_Length:__d_r_nConnection:_close_r_n
push eax
call fcn.0042775f
add esp, 0x1c
jmp 0x402085
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__Trident_4.0__GTB7.4__InfoPath.2__SV1__.NET_CLR_3.3.69573__WOW64__en_US_
push edi
push dword [ebp - 0x70]
lea eax, [ebp - 0x5c]
push str.GET__s_HTTP_1.1_r_nHost:__s_r_nUser_Agent:__s_r_nAccept_Language:_cs_en_us_q0.7_en_q0.3_r_nAccept_Charset:_windows_1250_utf_8_q0.7__q0.7_r_nCache_Control:_max_age0_r_nConnection:_close_r_n
push eax
call fcn.0042775f
add esp, 0x14
cmp dword [ebp - 0x78], ebx
je 0x4020a9
push dword [ebp - 0x78]
lea eax, [ebp - 0x5c]
push str._s_r_n
push eax
call fcn.00426920
pop ecx
lea eax, [ebp + eax - 0x5c]
push eax
call fcn.0042775f
add esp, 0xc
lea eax, [ebp - 0x5c]
push 0x43ec40
push eax
call fcn.004269c0
cmp esi, ebx
pop ecx
pop ecx
je 0x4020cd
cmp byte [esi], bl
je 0x4020cd
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.004269c0
pop ecx
pop ecx
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00426920
pop ecx
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x401f9b
mov esi, 0xfa000
push esi
call fcn.00426af7
push esi
mov edi, eax
push ebx
push edi
call fcn.00426c80
add esp, 0x10
xor esi, esi
mov dword [ebp - 0x70], ebx
cmp esi, 0xf9c00
jge 0x402154
push ebx
push 0x200
lea eax, [edi + esi]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, ebx
jne 0x40212f
cmp esi, ebx
jne 0x402154
cmp eax, 0xffffffff
jne 0x40214b
inc dword [ebp - 0x70]
cmp word [ebp - 0x70], 5
jge 0x4021a5
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40210c
add esi, eax
cmp eax, ebx
mov dword [ebp - 0x70], ebx
jne 0x40210c
mov ebx, dword [ebp - 0x80]
mov dword [ebx], esi
inc esi
push esi
call fcn.00426af7
mov esi, eax
test esi, esi
pop ecx
je 0x40217b
mov eax, dword [ebx]
inc eax
push eax
push edi
push esi
call fcn.00426fe0
mov eax, dword [ebx]
add esp, 0xc
mov byte [esi + eax], 0
push edi
call fcn.004260a6
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, esi
mov ecx, dword [ebp + 0x424]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00426fc3
add ebp, 0x428
leave
ret
push dword [ebp - 0x74]
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
call fcn.004260a6
pop ecx
jmp 0x401f9b