Function at 0x407c30
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Contain obfuscated stackstrings
Create tcp socket
Create udp socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419ff1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x348
mov dword [ebp - 4], 0
push edx
mov edx, 0x519237bd
mov edx, 0x44ff5652
add edx, edi
pop edx
lea eax, [ebp - 0x1a4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00407aa0
add esp, 8
movzx edx, al
test edx, edx
jne 0x407c98
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0xd]
jmp 0x40865a
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x407cc8
mov byte [ebp - 0xe], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0xe]
jmp 0x40865a
push ecx
and ecx, ecx
or ecx, eax
add ecx, esp
sbb ecx, eax
xor ecx, esp
or ecx, esi
pop ecx
push 0x10
lea eax, [ebp - 0x1a4]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.WS2_32.dll_connect]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x407d0d
mov byte [ebp - 0xf], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0xf]
jmp 0x40865a
push edi
sub edi, esp
mov edi, 0x71317c25
mov edi, 0x698d084a
pop edi
push str.H__P
lea ecx, [ebp - 0xec]
call fcn.0040ec80
mov byte [ebp - 4], 1
push eax
xor eax, esp
sbb eax, edi
mov eax, 0x1249048b
or eax, esi
nop
pop eax
push 1
lea ecx, [ebp - 0xec]
call fcn.0040fda0
mov byte [eax], 0x54
push eax
and eax, ebx
mov eax, 0x7a896b65
mov eax, 0x739a2345
pop eax
push 2
lea ecx, [ebp - 0xec]
call fcn.0040fda0
mov byte [eax], 0x54
push edx
mov edx, 0x28c775b5
mov edx, 0x225618e
sbb edx, ebp
pop edx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x42045c
call fcn.0040eb10
mov dword [ebp - 0xd4], eax
mov edx, dword [ebp - 0xd4]
mov dword [ebp - 0xf0], edx
mov byte [ebp - 4], 2
push str.Engine
lea ecx, [ebp - 0x1bc]
call fcn.0040ec80
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x50]
push ecx
lea edx, [ebp - 0x194]
push edx
mov byte [ebp - 4], 4
call fcn.004075f0
add esp, 0x20
mov dword [ebp - 0xf4], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1bc]
call fcn.0040f630
push esi
sbb esi, esp
sbb esi, edi
sub esi, esi
mov esi, 0x4fa50e5a
nop
pop esi
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xf8], esp
push 0x42045c
call fcn.0040eb10
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x130]
push ecx
call fcn.004075f0
add esp, 0x20
mov dword [ebp - 0x100], eax
mov byte [ebp - 4], 7
push ebp
add ebp, edx
add ebp, esi
sbb ebp, edi
add ebp, ebx
sub ebp, esp
sbb ebp, edx
pop ebp
push ebp
xor ebp, edi
sub ebp, edi
xor ebp, esp
mov ebp, 0x42843f91
nop
pop ebp
lea ecx, [ebp - 0x17c]
call fcn.0040ed50
mov byte [ebp - 4], 8
mov dword [ebp - 0x1c], 0
jmp 0x407e73
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
lea ecx, [ebp + 0xc]
call fcn.00417e50
cmp dword [ebp - 0x1c], eax
jae 0x407ea0
mov eax, dword [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
call fcn.0040fda0
movsx ecx, byte [eax]
add ecx, 0x11
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004160b0
jmp 0x407e6a
push str.G_T
lea ecx, [ebp - 0x164]
call fcn.0040ec80
mov byte [ebp - 4], 9
push eax
mov eax, 0x46252451
mov eax, 0x6d7c0d3b
add eax, edx
pop eax
push 1
lea ecx, [ebp - 0x164]
call fcn.0040fda0
mov byte [eax], 0x45
push ecx
mov ecx, 0x4db0097d
sub ecx, edx
add ecx, ecx
sbb ecx, ebp
nop
pop ecx
lea ecx, [ebp - 0x48]
call fcn.0040ed50
mov byte [ebp - 4], 0xa
push 0x41b3b8
push str._1.1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x104], esp
push 0x42045c
call fcn.0040eb10
mov dword [ebp - 0x108], eax
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x24c]
push eax
call fcn.004075f0
add esp, 0x20
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x58], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x58]
push edx
push 0x41b3c4
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x234]
push edx
call fcn.0040bed0
add esp, 0xc
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x60]
push ecx
lea edx, [ebp - 0x21c]
push edx
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x68]
push ecx
lea edx, [ebp - 0x204]
push edx
call fcn.0040bda0
add esp, 0xc
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x70], eax
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x70]
push ecx
lea edx, [ebp - 0x1ec]
push edx
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x78]
push ecx
lea edx, [ebp - 0x1d4]
push edx
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x80], eax
mov ecx, dword [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x48]
call fcn.0040fa90
lea ecx, [ebp - 0x1d4]
call fcn.0040f630
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1ec]
call fcn.0040f630
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x204]
call fcn.0040f630
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x21c]
call fcn.0040f630
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x234]
call fcn.0040f630
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x24c]
call fcn.0040f630
push 0x41b3c8
mov edx, dword [ebp + 8]
push edx
push str.Host:
lea eax, [ebp - 0x27c]
push eax
call fcn.0040c060
add esp, 0xc
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x88], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x88]
push edx
lea eax, [ebp - 0x264]
push eax
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0x8c], eax
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x90], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x90]
push edx
lea ecx, [ebp - 0x48]
call fcn.00410070
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x264]
call fcn.0040f630
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x27c]
call fcn.0040f630
push str.Accept:___r_n
lea ecx, [ebp - 0x48]
call fcn.004100b0
push str.Accept_Language:_en_us_r_n
lea ecx, [ebp - 0x48]
call fcn.004100b0
push str.Connection:_close_r_n
lea ecx, [ebp - 0x48]
call fcn.004100b0
push 0x41b414
lea eax, [ebp - 0x17c]
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x10c], esp
push 0x42045c
call fcn.0040eb10
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x194]
push ecx
lea edx, [ebp - 0x2dc]
push edx
call fcn.004075f0
add esp, 0x20
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x98]
push ecx
push str.User_Agent:
lea edx, [ebp - 0x2c4]
push edx
call fcn.0040c020
add esp, 0xc
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xa0]
push ecx
lea edx, [ebp - 0x2ac]
push edx
call fcn.0040be50
add esp, 0xc
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0xa8]
push ecx
lea edx, [ebp - 0x294]
push edx
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00410070
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x294]
call fcn.0040f630
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2ac]
call fcn.0040f630
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2c4]
call fcn.0040f630
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2dc]
call fcn.0040f630
push 0x41b428
lea ecx, [ebp - 0x48]
call fcn.004100b0
push 0
lea ecx, [ebp - 0x48]
call fcn.00415190
push eax
lea ecx, [ebp - 0x48]
call fcn.00413f90
push eax
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4082c5
mov byte [ebp - 0x10], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x48]
call fcn.0040f630
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x164]
call fcn.0040f630
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x17c]
call fcn.0040f630
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.0040f630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x194]
call fcn.0040f630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xec]
call fcn.0040f630
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0x10]
jmp 0x40865a
push eax
mov eax, 0x77d6525b
add eax, esi
mov eax, 0x54c556a7
pop eax
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.004079d0
add esp, 8
mov dword [ebp - 0xb4], eax
mov edx, dword [ebp - 0xb4]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x3c
call fcn.0040fa90
lea ecx, [ebp - 0x2f4]
call fcn.0040f630
push edi
mov edi, 0x7af87e2e
and edi, esi
sbb edi, esp
sub edi, ebp
nop
pop edi
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
push 0
push str._r_n_r_n
mov ecx, dword [ebp + 8]
add ecx, 0x3c
call fcn.00414960
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4083c0
push esi
or esi, esp
mov esi, 0x705868ec
mov esi, 0x35da7079
pop esi
mov byte [ebp - 0x11], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x48]
call fcn.0040f630
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x164]
call fcn.0040f630
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x17c]
call fcn.0040f630
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.0040f630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x194]
call fcn.0040f630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xec]
call fcn.0040f630
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0x11]
jmp 0x40865a
mov ecx, dword [ebp - 0x28]
add ecx, 4
push ecx
push 0
lea edx, [ebp - 0x14c]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x3c
call fcn.00418000
mov byte [ebp - 4], 0x16
mov eax, dword [0x41b6e0]
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 4
push ecx
lea edx, [ebp - 0x30c]
push edx
mov ecx, dword [ebp + 8]
add ecx, 0x3c
call fcn.00418000
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x3c
call fcn.0040fa90
lea ecx, [ebp - 0x30c]
call fcn.0040f630
push edx
mov edx, 0x77a32760
mov edx, 0x47292501
add edx, eax
pop edx
push ecx
add ecx, edi
add ecx, esp
or ecx, esp
add ecx, edi
or ecx, eax
and ecx, eax
pop ecx
push 0
push str._1.1_200
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x114], esp
push 0x42045c
call fcn.0040eb10
mov dword [ebp - 0x118], eax
lea ecx, [ebp - 0x130]
push ecx
lea edx, [ebp - 0x33c]
push edx
call fcn.004075f0
add esp, 0x20
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0xc0]
push ecx
lea edx, [ebp - 0x324]
push edx
call fcn.0040be90
add esp, 0xc
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov ecx, dword [ebp - 0xc8]
push ecx
lea ecx, [ebp - 0x14c]
call fcn.004148f0
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xffffffff
je 0x4084dd
mov dword [ebp - 0x2c], 1
jmp 0x4084e4
mov dword [ebp - 0x2c], 0
mov dl, byte [ebp - 0x2c]
mov byte [ebp - 0x12], dl
lea ecx, [ebp - 0x324]
call fcn.0040f630
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x33c]
call fcn.0040f630
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x40851a
mov ecx, 0xc8
mov edx, dword [ebp + 8]
mov word [edx + 0x38], cx
jmp 0x408534
push edi
add edi, esp
xor edi, esi
and edi, ebx
sub edi, ecx
sbb edi, ecx
sbb edi, eax
pop edi
mov eax, 0x194
mov ecx, dword [ebp + 8]
mov word [ecx + 0x38], ax
push 0
push str.Content_Length:
lea ecx, [ebp - 0x14c]
call fcn.00414960
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x4085de
push edi
mov edi, 0x37a32f76
mov edi, 0x6cc46131
add edi, edi
pop edi
mov edx, dword [ebp - 0x20]
add edx, 1
push edx
push 0x41b458
lea ecx, [ebp - 0x14c]
call fcn.00414960
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x4085de
push ebx
mov ebx, 0x7f9f27e7
mov ebx, 0x304d77c8
and ebx, esi
pop ebx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, 0x10
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x10
push ecx
lea edx, [ebp - 0x354]
push edx
lea ecx, [ebp - 0x14c]
call fcn.00418000
mov dword [ebp - 0xd0], eax
mov ecx, dword [ebp - 0xd0]
call fcn.00413f90
push eax
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x34], eax
lea ecx, [ebp - 0x354]
call fcn.0040f630
mov byte [ebp - 0x13], 1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14c]
call fcn.0040f630
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x48]
call fcn.0040f630
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x164]
call fcn.0040f630
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x17c]
call fcn.0040f630
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x130]
call fcn.0040f630
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x194]
call fcn.0040f630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xec]
call fcn.0040f630
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0040f630
mov al, byte [ebp - 0x13]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret