Function at 0x10071b60
Capabilities:
Check for time delay via gettickcount
Contain obfuscated stackstrings
Resolve dns

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101847c2
mov eax, dword fs:[0]
push eax
sub esp, 0x900
mov eax, dword [0x101cd7b4]
xor eax, esp
mov dword [esp + 0x8f8], eax
push ebx
push esi
push edi
mov eax, dword [0x101cd7b4]
xor eax, esp
push eax
lea eax, [esp + 0x910]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov eax, ecx
xor ebx, ebx
cmp dword [eax + 4], ebx
mov dword [esp + 0x18], eax
mov byte [eax + 0x10], bl
je 0x1007222a
mov al, 0x6d
push 0xff
mov byte [esp + 0x7fa], al
mov byte [esp + 0x803], al
mov cl, 0x68
lea eax, [esp + 0x809]
push ebx
push eax
mov byte [esp + 0x800], 0x71
mov byte [esp + 0x801], cl
mov byte [esp + 0x803], 0x46
mov byte [esp + 0x804], 0x59
mov byte [esp + 0x805], 0x55
mov byte [esp + 0x806], 0x34
mov byte [esp + 0x807], 0x35
mov byte [esp + 0x808], 0x56
mov byte [esp + 0x809], 0x42
mov byte [esp + 0x80a], 0x53
mov byte [esp + 0x80c], 0x70
mov byte [esp + 0x80d], cl
mov byte [esp + 0x80e], 0x45
mov byte [esp + 0x80f], 0x32
mov byte [esp + 0x810], bl
call fcn.101596b0
add esp, 0xc
cmp byte [0x101cf1f4], bl
mov dword [esp + 0x1c], 0x100
je 0x10071c8c
cmp byte [0x101cf1f5], bl
jne 0x10071c8c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x101cf1f8]
cmp eax, ecx
jbe 0x10071c8c
sub eax, ecx
cmp eax, dword [0x101cce28]
jb 0x10071c8c
mov byte [0x101cf1f4], bl
mov dword [esp + 0x440], 0xf
mov dword [esp + 0x43c], ebx
mov byte [esp + 0x42c], bl
mov edi, dword [sym.imp.WS2_32.dll_gethostbyname]
lea ecx, [esi + 0x43b]
push ecx
mov dword [esp + 0x91c], ebx
call edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2afc
jne 0x10071ce0
mov byte [0x101cf1f4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101cf1f8], eax
jmp 0x10071cef
cmp dword [0x101cf1f8], ebx
je 0x10071cef
mov byte [0x101cf1f5], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x10071cfb
xor eax, eax
jmp 0x10071d02
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.100087e0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x434]
mov byte [esp + 0x924], 1
call fcn.10005470
cmp dword [esp + 0x38], 0x10
jb 0x10071d3c
mov edx, dword [esp + 0x24]
push edx
call fcn.10159534
add esp, 4
mov dword [esp + 0x408], 0xf
mov dword [esp + 0x404], ebx
mov byte [esp + 0x3f4], bl
lea eax, [esi + 0x53d]
push eax
mov byte [esp + 0x91c], 2
call edi
mov dword [esp + 0x14], eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2afc
jne 0x10071d8b
mov byte [0x101cf1f4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101cf1f8], eax
jmp 0x10071d9a
cmp dword [0x101cf1f8], ebx
je 0x10071d9a
mov byte [0x101cf1f5], 1
mov eax, dword [esp + 0x14]
cmp eax, ebx
jne 0x10071da6
xor eax, eax
jmp 0x10071dad
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.100087e0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x3fc]
mov byte [esp + 0x924], 3
call fcn.10005470
cmp dword [esp + 0x38], 0x10
jb 0x10071de7
mov ecx, dword [esp + 0x24]
push ecx
call fcn.10159534
add esp, 4
mov dword [esp + 0x424], 0xf
mov dword [esp + 0x420], ebx
mov byte [esp + 0x410], bl
lea edx, [esi + 0x63f]
push edx
mov byte [esp + 0x91c], 4
call edi
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2afc
jne 0x10071e34
mov byte [0x101cf1f4], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x101cf1f8], eax
jmp 0x10071e43
cmp dword [0x101cf1f8], ebx
je 0x10071e43
mov byte [0x101cf1f5], 1
cmp edi, ebx
jne 0x10071e4b
xor eax, eax
jmp 0x10071e52
mov eax, dword [edi + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push eax
lea edx, [esp + 0x24]
push edx
call fcn.100087e0
add esp, 8
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x418]
mov byte [esp + 0x924], 5
call fcn.10005470
cmp dword [esp + 0x38], 0x10
mov byte [esp + 0x918], 4
jb 0x10071e94
mov eax, dword [esp + 0x24]
push eax
call fcn.10159534
add esp, 4
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 4]
mov edi, dword [ebp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x58]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x808]
push ecx
push 0x10
lea ecx, [esp + 0x800]
push ecx
push edi
push eax
call edx
test eax, eax
jne 0x100721ab
push 0x3af
lea eax, [esp + 0x448]
push ebx
push eax
call fcn.101596b0
mov eax, dword [esp + 0x438]
mov dword [esp + 0x451], edi
mov edi, 0x10
add esp, 0xc
cmp dword [esp + 0x440], edi
mov byte [esp + 0x444], 2
mov byte [esp + 0x661], bl
jae 0x10071f0e
lea eax, [esp + 0x42c]
mov ecx, dword [esp + 0x43c]
push ecx
push 0x80
push eax
lea edx, [esp + 0x461]
push edx
call fcn.100e9203
mov eax, dword [esi + 0x22a]
add esp, 0x10
cmp dword [esp + 0x408], edi
mov dword [esp + 0x449], eax
mov eax, dword [esp + 0x3f4]
jae 0x10071f50
lea eax, [esp + 0x3f4]
mov ecx, dword [esp + 0x404]
push ecx
push 0x80
push eax
lea edx, [esp + 0x4e3]
push edx
call fcn.100e9203
movzx eax, word [esi + 0x234]
add esp, 0x10
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov edi, dword [sym.imp.WS2_32.dll_htons]
add ax, 0xa
push eax
call edi
movzx ecx, word [esi + 0x63d]
push ecx
mov word [esp + 0x451], ax
call edi
movzx edx, word [esi + 0x53b]
push edx
mov word [esp + 0x55b], ax
call edi
cmp byte [esi + 0xb67], 4
mov word [esp + 0x4d5], ax
sete al
add al, 0xc
cmp dword [esp + 0x424], 0x10
mov byte [esp + 0x662], al
mov eax, dword [esp + 0x410]
jae 0x10071fe0
lea eax, [esp + 0x410]
mov ecx, dword [esp + 0x420]
push ecx
push 0x80
push eax
lea edx, [esp + 0x77d]
push edx
call fcn.100e9203
movzx eax, word [esi + 0x73f]
add esp, 0x10
push eax
call edi
mov ecx, dword [esp + 0x7f4]
mov esi, dword [esp + 0x1c]
cmp esi, 0x80
mov edx, dword [esp + 0x7f8]
mov word [esp + 0x7f1], ax
mov eax, dword [esp + 0x7fc]
mov dword [esp + 0x559], ecx
mov ecx, dword [esp + 0x800]
mov edi, 0x10
mov dword [esp + 0x561], eax
mov byte [esp + 0x770], bl
mov dword [esp + 0x55d], edx
mov dword [esp + 0x565], ecx
mov dword [esp + 0x5d9], edi
mov eax, esi
jb 0x1007206e
mov eax, 0x80
push eax
lea edx, [esp + 0x808]
push edx
lea eax, [esp + 0x5e5]
push eax
call fcn.1015a240
mov eax, dword [esp + 0x24]
mov dword [esp + 0x778], eax
mov eax, dword [eax + 0x14]
add esp, 0xc
cmp eax, ebx
mov dword [esp + 0x65d], esi
je 0x1007214f
mov dword [esp + 0x3c], ebx
mov ecx, 0xeb
lea esi, [esp + 0x444]
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x3c]
push ecx
mov ecx, eax
movsb byte es:[edi], byte [esi]
call fcn.100718b0
mov esi, 0x10
cmp dword [esp + 0x424], esi
jb 0x100720e7
mov edx, dword [esp + 0x410]
push edx
call fcn.10159534
add esp, 4
cmp dword [esp + 0x408], esi
mov edi, 0xf
mov dword [esp + 0x424], edi
mov dword [esp + 0x420], ebx
mov byte [esp + 0x410], bl
jb 0x1007211a
mov eax, dword [esp + 0x3f4]
push eax
call fcn.10159534
add esp, 4
cmp dword [esp + 0x440], esi
mov dword [esp + 0x408], edi
mov dword [esp + 0x404], ebx
mov byte [esp + 0x3f4], bl
jb 0x10072148
mov ecx, dword [esp + 0x42c]
push ecx
call fcn.10159534
add esp, 4
xor eax, eax
jmp 0x1007222f
cmp dword [esp + 0x424], edi
jb 0x10072168
mov edx, dword [esp + 0x410]
push edx
call fcn.10159534
add esp, 4
cmp dword [esp + 0x408], edi
mov esi, 0xf
mov dword [esp + 0x424], esi
mov dword [esp + 0x420], ebx
mov byte [esp + 0x410], bl
jb 0x1007219b
mov eax, dword [esp + 0x3f4]
push eax
call fcn.10159534
add esp, 4
cmp dword [esp + 0x440], edi
mov dword [esp + 0x408], esi
jmp 0x1007220a
mov esi, 0x10
cmp dword [esp + 0x424], esi
jb 0x100721c9
mov edx, dword [esp + 0x410]
push edx
call fcn.10159534
add esp, 4
cmp dword [esp + 0x408], esi
mov edi, 0xf
mov dword [esp + 0x424], edi
mov dword [esp + 0x420], ebx
mov byte [esp + 0x410], bl
jb 0x100721fc
mov eax, dword [esp + 0x3f4]
push eax
call fcn.10159534
add esp, 4
cmp dword [esp + 0x440], esi
mov dword [esp + 0x408], edi
mov byte [esp + 0x3f4], bl
mov dword [esp + 0x404], ebx
jb 0x1007222a
mov ecx, dword [esp + 0x42c]
push ecx
call fcn.10159534
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x910]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x8f8]
xor ecx, esp
call fcn.10159cce
mov esp, ebp
pop ebp
ret 8