Function at 0x42f970
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
sub esp, 0x20
xor eax, eax
push ebx
mov dword [esp + 0x14], eax
mov ebx, ecx
mov dword [esp + 0x18], eax
push esi
mov dword [esp + 0x20], eax
lea ecx, [esp + 8]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
lea edx, [esp + 0x10]
push ecx
push edx
push eax
mov ecx, ebx
call fcn.0042fdb0
test eax, eax
je 0x42f9b7
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret 4
mov cx, word [esp + 0xc]
mov edx, dword [esp + 0x10]
push 6
push 1
push 2
mov word [esp + 0x28], 2
mov word [esp + 0x2a], cx
mov dword [esp + 0x2c], edx
call dword [sym.imp.WS2_32.dll_socket]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
lea ecx, [esp + 0x14]
push 4
push ecx
push 0x1005
push 0xffff
push eax
mov dword [ebx], eax
mov dword [esp + 0x28], 0xbb8
call esi
mov eax, dword [ebx]
lea edx, [esp + 0x14]
push 4
push edx
push 0x1006
push 0xffff
push eax
call esi
mov edx, dword [ebx]
lea ecx, [esp + 0x1c]
push 0x10
push ecx
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x42fa36
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret 4
mov eax, dword [ebx + 4]
push ebp
add eax, 7
push 0x510aa4
push eax
call fcn.004df6d0
mov ecx, dword [ebx + 4]
mov esi, eax
sub esi, ecx
mov dword [esp + 0x24], eax
sub esi, 6
push esi
call fcn.004de48f
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
dec esi
rep stosb byte es:[edi], al
mov eax, dword [ebx + 4]
push esi
add eax, 7
push eax
push ebp
call fcn.004de950
mov edi, str.GET___s_HTTP_1.1_r_nAccept:_application_vnd.ms_powerpoint__application_msword____r_nAccept_Language:_zh_cn_r_nAccept_Encoding:_deflate_r_nIf_Modified_Since:__s_r_nUser_Agent:_QvodPlayer_r_nHost:__s_r_nConnection:_Keep_Alive_r_n_r_n
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [ebx + 4]
not ecx
dec ecx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [edx + ecx + 0x104]
push edi
call fcn.004de48f
mov ecx, edi
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x54]
inc ecx
push eax
push ecx
push str.GET___s_HTTP_1.1_r_nAccept:_application_vnd.ms_powerpoint__application_msword____r_nAccept_Language:_zh_cn_r_nAccept_Encoding:_deflate_r_nIf_Modified_Since:__s_r_nUser_Agent:_QvodPlayer_r_nHost:__s_r_nConnection:_Keep_Alive_r_n_r_n
push esi
call fcn.004df42f
add esp, 0x30
mov edi, eax
test ebp, ebp
je 0x42fae9
push ebp
call fcn.004de3a6
add esp, 4
mov edx, dword [ebx]
push edi
push esi
push edx
mov ecx, ebx
call fcn.0042fb80
test eax, eax
pop ebp
je 0x42fb13
test esi, esi
je 0x42fb07
push esi
call fcn.004de3a6
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret 4
test esi, esi
je 0x42fb20
push esi
call fcn.004de3a6
add esp, 4
mov edi, 0x4000
push edi
call fcn.004de48f
mov esi, eax
add esp, 4
test esi, esi
jne 0x42fb54
mov edi, 0x2000
push edi
call fcn.004de48f
mov esi, eax
add esp, 4
test esi, esi
jne 0x42fb54
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x20
ret 4
mov eax, dword [ebx + 8]
mov ecx, dword [ebx]
push eax
push edi
push esi
push ecx
mov ecx, ebx
call fcn.0042fbd0
test esi, esi
mov edi, eax
je 0x42fb73
push esi
call fcn.004de3a6
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4