Function at 0x563410
Capabilities:
Check for time delay via gettickcount
Encode data using xor
Get socket status
Receive data
Receive data on socket
Resolve function by parsing pe exports
Send data
Send data on socket
Set socket configuration

Disassembly:
test ecx, ecx
jne 0x56341a
mov eax, 5
ret
mov eax, dword [ecx]
cmp eax, 3
ja case.0x563421.0
jmp dword [eax*4 + 0x56343c]
jmp 0x563570
jmp 0x563450
jmp 0x563ab0
xor eax, eax
ret
sub esp, 0x6fc
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0x10
mov eax, dword [esi + 0x88]
lea ecx, [esp + 0xc]
push ecx
push ebx
lea edx, [esp + 0x2c]
push ebx
push edx
push 0x40
mov dword [esp + 0x3c], eax
mov dword [esp + 0x38], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x56352c
cmp eax, ebx
je 0x56352c
lea eax, [esp + 8]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esi + 0x88]
push ecx
push ebx
lea edx, [esp + 0x134]
push 0x5db
push edx
push eax
call sub.WSOCK32.dll_recvfrom
cmp eax, 0xffffffff
je 0x56346c
lea ecx, [esp + 0x128]
push str._final_
push ecx
mov byte [esp + 0x70b], bl
call fcn.00587c20
add esp, 8
test eax, eax
je 0x56346c
mov edx, dword [esp + 0x16]
push edx
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
mov ecx, esi
mov edx, dword [esp + 0x18]
push eax
call fcn.005631a0
cmp eax, 0xffffffff
jne 0x56346c
mov eax, dword [esp + 0x16]
push 5
push eax
call sub.WSOCK32.dll_ntohs
mov ecx, esi
mov edx, dword [esp + 0x1c]
push eax
call fcn.00563160
jmp 0x56346c
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esi + 0x8c]
cmp eax, 0xbb8
jbe 0x563560
mov ecx, dword [esi + 0x88]
push ecx
call sub.WSOCK32.dll_closesocket
mov edx, 3
mov ecx, esi
mov dword [esi + 0x88], 0xffffffff
call fcn.00562fe0
pop esi
xor eax, eax
pop ebx
add esp, 0x6fc
ret
sub esp, 0x10c
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0x10]
mov eax, dword [ebx + 0x88]
xor edi, edi
push ecx
push edi
lea edx, [esp + 0x20]
push edi
push edx
push 0x40
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x2c], 1
call sub.WSOCK32.dll_select
test eax, eax
jg 0x5635bc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret
mov eax, dword [0x8cfae0]
mov ecx, 0x7ff
sub ecx, eax
push edi
lea edx, [eax + 0x8cf288]
mov eax, dword [ebx + 0x88]
push ecx
push edx
push eax
call sub.WSOCK32.dll_recv
mov esi, eax
or ebp, 0xffffffff
cmp esi, ebp
je 0x56382b
cmp esi, edi
je 0x56382b
cmp dword [ebx + 0x55c], ebp
je 0x563612
mov ecx, dword [0x8cfae0]
push esi
lea edx, [ecx + 0x8cf288]
lea ecx, [ebx + 0x9c]
call fcn.00565140
mov eax, dword [0x8cfae0]
add eax, esi
mov esi, 0x8cf288
mov dword [0x8cfae0], eax
mov ecx, dword [ebx + 0x55c]
cmp ecx, ebp
jne 0x5636c6
movsx edx, byte [0x8cf288]
xor edx, 0xec
cmp eax, edx
jle 0x5636ba
mov al, byte [0x8cf288]
lea esi, [ebx + 0x2c]
xor al, 0xec
mov edi, esi
mov byte [0x8cf288], al
mov ecx, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
test edi, edi
jle 0x563678
mov cl, byte [esi + eax]
mov dl, byte [eax + 0x8cf289]
xor dl, cl
mov byte [eax + 0x8cf289], dl
inc eax
cmp eax, edi
jl 0x563662
movsx edx, byte [0x8cf288]
lea edi, [ebx + 0x9c]
mov ecx, 0x8cf289
push edi
call fcn.00565080
movsx esi, byte [0x8cf288]
mov edx, dword [0x8cfae0]
add esi, 0x8cf289
sub edx, esi
mov ecx, edi
add edx, 0x8cf288
push edx
mov edx, esi
call fcn.00565140
mov eax, dword [0x8cfae0]
cmp dword [ebx + 0x55c], ebp
je 0x563801
mov ecx, esi
lea edx, [eax - 6]
sub ecx, 0x8cf288
cmp ecx, edx
jg 0x563801
jmp 0x5636de
or ebp, 0xffffffff
push 7
push str._final_
push esi
call fcn.00588640
add esp, 0xc
test eax, eax
je 0x5637a1
mov eax, dword [ebx + 0x74]
test eax, eax
jne 0x5637a1
mov eax, dword [0x8cfae0]
cmp eax, 6
jl 0x563801
mov ecx, dword [ebx + 0x90]
cmp ecx, 6
je 0x563765
cmp ecx, 7
je 0x563765
mov edi, dword [esi]
mov eax, dword [ebx + 0x98]
mov bp, word [esi + 4]
add esi, 4
push eax
push ebp
add esi, 2
call sub.WSOCK32.dll_ntohs
and eax, 0xffff
mov edx, edi
push eax
mov ecx, ebx
call fcn.005631d0
cmp eax, 0xffffffff
jne 0x563787
mov ecx, dword [ebx + 0x90]
push ecx
push ebp
call sub.WSOCK32.dll_ntohs
mov edx, edi
mov ecx, ebx
push eax
call fcn.00563160
jmp 0x563787
sub eax, esi
mov edx, esi
add eax, 0x8cf288
mov ecx, ebx
push eax
call fcn.00563870
test eax, eax
jge 0x563783
mov dword [ebx + 0x74], 1
jmp 0x563787
je 0x5637fc
add esi, eax
mov eax, dword [0x8cfae0]
mov edx, esi
sub edx, 0x8cf288
lea ecx, [eax - 6]
cmp edx, ecx
jle 0x5636db
jmp 0x563801
mov edx, dword [ebx + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [ebx + 0x88], ebp
mov dword [0x8cfae0], 0
mov eax, dword [ebx + 0x90]
cmp eax, 6
je 0x5637e6
cmp eax, 7
je 0x5637e6
mov edx, 3
mov ecx, ebx
call fcn.00562fe0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
xor edx, edx
mov ecx, ebx
call fcn.00562fe0
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov eax, dword [0x8cfae0]
mov ecx, 0x8cf288
sub ecx, esi
add eax, ecx
push eax
push esi
push 0x8cf288
mov dword [0x8cfae0], eax
call fcn.0058b130
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
mov edx, dword [ebx + 0x88]
push edx
call sub.WSOCK32.dll_closesocket
mov dword [ebx + 0x88], ebp
mov ecx, ebx
mov dword [0x8cfae0], edi
call fcn.00563df0
mov edx, 3
mov ecx, ebx
call fcn.00562fe0
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
sub esp, 0x704
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebp, ebp
mov eax, dword [esi + 0x6c]
xor edi, edi
xor edx, edx
cmp eax, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x34], edx
jle 0x563c73
mov ecx, dword [esi + 8]
cmp dword [ecx + 4], ebp
je 0x563b02
inc edi
cmp edx, 0x40
jae 0x563b02
mov ebx, dword [ecx]
mov dword [esp + edx*4 + 0x38], ebx
mov edx, dword [esp + 0x34]
inc edx
mov dword [esp + 0x34], edx
add ecx, 0x1c
dec eax
jne 0x563ae8
cmp edi, ebp
mov dword [esp + 0x18], edi
jle 0x563c73
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push ebp
push ebp
push ecx
push 0x40
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
je 0x563c73
cmp eax, ebp
je 0x563c73
mov eax, dword [esi + 0x6c]
mov dword [esp + 0x10], ebp
cmp eax, ebp
jle 0x563c73
mov edx, dword [esi + 8]
mov ecx, dword [edx + ebp + 4]
lea eax, [edx + ebp]
test ecx, ecx
je 0x563c5c
mov edx, dword [eax]
lea ecx, [esp + 0x34]
push ecx
push edx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x563c5c
lea eax, [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esi + 8]
push ecx
mov dword [esp + 0x1c], 0x10
mov ecx, dword [eax + ebp]
push 0
lea edx, [esp + 0x144]
push 0x5db
push edx
push ecx
call sub.WSOCK32.dll_recvfrom
mov edx, dword [esi + 8]
mov edi, dword [edx + ebp + 0x10]
lea ecx, [edx + ebp]
mov edx, dword [esp + 0x28]
cmp edx, edi
jne 0x563c5c
mov dx, word [esp + 0x26]
cmp dx, word [ecx + 0xe]
jne 0x563c5c
cmp eax, 0xffffffff
je 0x563c55
mov byte [esp + eax + 0x138], 0
lea eax, [esp + 0x138]
push str._final_
push eax
call fcn.00587c20
mov ecx, dword [esi + 8]
mov edi, eax
add esp, 8
mov ebx, dword [ecx + ebp + 4]
neg edi
sbb edi, edi
neg edi
cmp word [ebx + 6], 0x270f
jne 0x563c0e
call sub.KERNEL32.dll_GetTickCount
mov edx, dword [esi + 8]
sub ax, word [edx + ebp + 8]
mov word [ebx + 6], ax
lea edx, [esp + 0x138]
mov ecx, ebx
call fcn.00564390
test edi, edi
je 0x563c5c
mov ecx, dword [esi + 4]
call fcn.00563e70
mov ecx, eax
mov eax, dword [esi + 0x70]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 2
cdq
idiv ecx
mov edx, dword [esi + 0x7c]
push eax
push ebx
push edx
push 2
push esi
call dword [esi + 0x78]
mov eax, dword [esi + 8]
add esp, 0x14
mov dword [eax + ebp + 4], 0
jmp 0x563c5c
mov dword [ecx + 4], 0
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x6c]
inc eax
add ebp, 0x1c
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x563b47
mov eax, dword [esi + 0x6c]
xor ebx, ebx
test eax, eax
jle 0x563caf
xor edi, edi
mov ecx, dword [esi + 8]
mov eax, dword [edi + ecx + 4]
test eax, eax
je 0x563ca4
mov edx, ecx
lea ebp, [edi + edx]
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp + 8]
cmp eax, 0xbb8
jbe 0x563ca4
mov dword [ebp + 4], 0
mov eax, dword [esi + 0x6c]
inc ebx
add edi, 0x1c
cmp ebx, eax
jl 0x563c7e
mov eax, dword [esi + 0x74]
test eax, eax
jne 0x563da2
mov ecx, dword [esi + 4]
call fcn.00563e70
cmp dword [esi + 0x70], eax
jl 0x563cd3
mov eax, dword [esp + 0x18]
test eax, eax
je 0x563da2
mov eax, dword [esi + 0x6c]
xor ebx, ebx
test eax, eax
jle 0x563db2
xor edi, edi
mov ecx, dword [esi + 4]
mov ebp, dword [esi + 0x70]
call fcn.00563e70
cmp ebp, eax
jge 0x563db2
mov eax, dword [esi + 8]
mov ecx, dword [edi + eax + 4]
test ecx, ecx
jne 0x563d86
mov ecx, dword [esi + 4]
mov edx, ebp
call fcn.005648b0
mov ebp, dword [eax]
mov eax, dword [esi + 0x70]
mov ecx, dword [esi + 8]
inc eax
mov dword [esi + 0x70], eax
mov dword [edi + ecx + 4], ebp
mov edx, dword [esi + 8]
mov ecx, ebp
mov word [edi + edx + 0xc], 2
call fcn.00564490
push eax
call sub.WSOCK32.dll_inet_addr
mov ecx, dword [esi + 8]
mov dword [edi + ecx + 0x10], eax
mov ecx, ebp
call fcn.005644a0
push eax
call sub.WSOCK32.dll_htons
mov edx, dword [esi + 8]
push 0x10
mov word [edi + edx + 0xe], ax
mov eax, dword [esi + 8]
mov ebp, dword [ebp + 8]
add eax, edi
shl ebp, 2
lea ecx, [eax + 0xc]
mov edx, dword [ebp + 0x5b89a0]
push ecx
mov ecx, dword [ebp + 0x5e4f38]
push 0
push edx
mov edx, dword [eax]
push ecx
push edx
call sub.WSOCK32.dll_sendto
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [esi + 8]
mov dword [edi + ecx + 8], eax
mov eax, dword [esi + 0x6c]
inc ebx
add edi, 0x1c
cmp ebx, eax
jl 0x563ce2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x704
ret
mov ecx, esi
call fcn.00563dc0
xor edx, edx
mov ecx, esi
call fcn.00562fe0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x704
ret