Function at 0x41a5a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xadc
mov ebx, eax
lea eax, [esp + 0x1c8]
call fcn.00429720
cmp dword [esp + 0x1c8], 1
jne 0x41aa30
mov edi, dword [0x46f108]
test edi, edi
je 0x41a870
lea eax, [esp + 0x1cc]
mov dword [esp + 0x28], eax
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
push esi
test eax, eax
je 0x41a9db
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax]
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0
mov dword [esp], 0x4686a3
call sub.msvcrt.dll_strtol
and eax, 0xffff
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
push edx
mov edi, eax
mov dword [esp], ebx
call fcn.0042ddf0
mov ecx, dword [0x46f108]
test ecx, ecx
je 0x41a840
mov word [esp + 0x38], 2
mov word [esp + 0x3a], di
mov dword [esp + 0x3c], esi
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
mov dword [ebx], eax
test eax, eax
js 0x41a8bd
mov dword [esp + 8], 0x10
lea edx, [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
test eax, eax
jne 0x41a8a0
lea eax, [ebx + 0x348]
mov dword [esp + 0x2c], eax
mov dword [esp], eax
call fcn.00431960
lea esi, [ebx + 0x410]
mov dword [esp], esi
call fcn.00432f60
lea eax, [ebx + 0x478]
mov dword [esp + 0x24], eax
mov dword [esp], eax
call fcn.004389e0
lea edi, [ebx + 0x208]
mov dword [esp], edi
call fcn.0042a870
lea ebp, [ebx + 4]
mov dword [esp], ebp
call fcn.0042af90
mov dword [esp + 0x10], 0xa
mov dword [esp + 0xc], str.ssl_client
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x42b0f0
mov dword [esp], edi
call fcn.0042aa50
mov edx, eax
test eax, eax
jne 0x41a7e0
mov dword [esp + 8], 0xc77
mov dword [esp + 4], str._____BEGIN_CERTIFICATE______r_nMIIDQTCCAimgAwIBAgIBAzANBgkqhkiG9w0BAQsFADA7MQswCQYDVQQGEwJOTDER_r_nMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN_r_nMTkwMjEwMTQ0NDAwWhcNMjkwMjEwMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G_r_nA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G_r_nCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0_ht6WMn1EpRagzSHx_r_nmdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zki5clHFzqMwUqny_r_n50BwFMtEonILwuVAT7lpg6zexKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj8n_r_nYMPGn8u67GB9taEMr5P1gmIgNb1LTV_Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL_r_nR7EUQIN9Z_SG9jGr8XmksrUuEvmEF_BibycE1ixVA0hmnM3oTDPb5Lc9un8rNsu_r_nKNFAksjoBXyOGVkCeoMbo4bF6BxyLObyavpw_LPh5aPgAIynplYb6LVAgMBAAGj_r_nUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFLRa5KWz3tJS9rnVppUP6z68x_3__r_nMB8GA1UdIwQYMBaAFLRa5KWz3tJS9rnVppUP6z68x_3_MA0GCSqGSIb3DQEBCwUA_r_nA4IBAQA4qFSCth2q22uJIdE4KGHJsJjVEfw2_xnMkTvCMfxVrvmRvqCtjE4tKDl_r_noK4MxFOek07oDZwvtAT9ijn1hHftTNS7RH9zd_fxNpfcHnMZXVC4w4DNA1fSANtW_r_n5sY1JB5Je9jScrsLSSmAjyv0Ow3Hb2Bix8wu7xNNrV5fIf7Ubmwt6SqEBxu3Kb_r_nEfObAT4huf3czznhH3C17ed6NSbXwoXfby7stWUDeRJv08RaFOykf_Aae7bY5PL_r_nyTVrkAnikMntJ9YIhNNYt3inqq11A5cN0rVTst8UKCxzQ4GpvroSwPKTFkbMw4_r_n_anT1dVxr_BtwJfiESoK3_4CeXR1_r_n_____END_CERTIFICATE______r_n_____BEGIN_CERTIFICATE______r_nMIIDQTCCAimgAwIBAgIBAzANBgkqhkiG9w0BAQUFADA7MQswCQYDVQQGEwJOTDER_r_nMA8GA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwHhcN_r_nMTEwMjEyMTQ0NDAwWhcNMjEwMjEyMTQ0NDAwWjA7MQswCQYDVQQGEwJOTDERMA8G_r_nA1UECgwIUG9sYXJTU0wxGTAXBgNVBAMMEFBvbGFyU1NMIFRlc3QgQ0EwggEiMA0G_r_nCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDA3zf8F7vglp0_ht6WMn1EpRagzSHx_r_nmdTs6st8GFgIlKXsm8WL3xoemTiZhx57wI053zhdcHgH057Zki5clHFzqMwUqny_r_n50BwFMtEonILwuVAT7lpg6zexKY8C4KQB0nFc7qKUEkHHxvYPZP9al4jwqj8n_r_nYMPGn8u67GB9taEMr5P1gmIgNb1LTV_Xjli5wwOQuvfwu7uJBVcA0Ln0kcmnL_r_nR7EUQIN9Z_SG9jGr8XmksrUuEvmEF_BibycE1ixVA0hmnM3oTDPb5Lc9un8rNsu_r_nKNFAksjoBXyOGVkCeoMbo4bF6BxyLObyavpw_LPh5aPgAIynplYb6LVAgMBAAGj_r_nUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFLRa5KWz3tJS9rnVppUP6z68x_3__r_nMB8GA1UdIwQYMBaAFLRa5KWz3tJS9rnVppUP6z68x_3_MA0GCSqGSIb3DQEBBQUA_r_nA4IBAQABE3OEPfEd_bcJW5ZdU3_VgPNS4tMzh8gnJP_V2FcvFtGylMpQq6YnEBYI_r_nyBHAL4DRvlMY5rnXGBp3ODR8MpqHC6AquRTCLzjS57iYff__4QFQqW9n92zctspv_r_nczkaPKgjqo1No3Uq0Xaz10rcxyTUPrf5wNVRZ2V0KvllvAAVSzbI4mpdUXztjhST_r_nS5A2BeWQAAOr0zq1F7TSRVJpJs7jmB2ai_igkh1IAjcuwV6VwlPsbw0gjQ0NpGM_r_niHpnlzRAi_tIbtOvMIGOBU2TIfax_5jq1agUx5aPmT5TWAiJPOOP6l5xXnDwxeYS_r_nNWqiX9GyusBZjezaCaHabjDLU0qQ_r_n_____END_CERTIFICATE______r_n_____BEGIN_CERTIFICATE______r_nMIICBDCCAYigAwIBAgIJAMFD4n5iQ8zoMAwGCCqGSM49BAMCBQAwPjELMAkGA1UE_r_nBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xhcnNzbCBUZXN0_r_nIEVDIENBMB4XDTE5MDIxMDE0NDQwMFoXDTI5MDIxMDE0NDQwMFowPjELMAkGA1UE_r_nBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRwwGgYDVQQDDBNQb2xhcnNzbCBUZXN0_r_nIEVDIENBMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEw9orNEE3WCHVv78ibopQ0tO_r_n4G7DDldTMzlY1FK0kZU5CyPfXxckYkj8GpUpziwth8KIUoCv1mqrId240xxuWLjK_r_n6LJpjvNBrSnDtF91p0dv1RkpVWmaUzsgtGYWYDMeo1AwTjAMBgNVHRMEBTADAQH__r_nMB0GA1UdDgQWBBSdbSAkSQE_K8t4tRm8fiTJ2_s2fDAfBgNVHSMEGDAWgBSdbSAk_r_nSQE_K8t4tRm8fiTJ2_s2fDAMBggqhkjOPQQDAgUAA2gAMGUCMFHKrjAPpHB0BN1a_r_nLH8TwcJ3vh0AxeKZj30mRdOKBmg_jLS3rU3g8VQBHpn8sOTTBwIxANxPO5AerimZ_r_nhCjMe0d4CTHf1gFZMF70IqEPo5VHsIp2Cqvflb0VGWFC5l9a4cQg_r_n_____END_CERTIFICATE______r_n
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00437720
test eax, eax
js 0x41a910
mov dword [esp], ebx
call fcn.0042e170
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00432f90
mov edx, eax
test eax, eax
jne 0x41a7e0
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.004319b0
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00431ba0
mov dword [esp + 8], edi
mov dword [esp + 4], 0x42ad60
mov dword [esp], esi
call fcn.004319e0
mov dword [esp + 4], 0x468da0
mov dword [esp], esi
call fcn.00431ae0
mov dword [esp + 4], 0x468d88
mov dword [esp], esi
call fcn.00431ca0
mov dword [esp + 4], esi
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004329c0
mov edx, eax
test eax, eax
je 0x41a990
lea esi, [esi]
mov dword [esp + 0x28], edx
mov dword [esp], ebx
call fcn.0042e5d0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00438a10
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00432dc0
mov dword [esp], esi
call fcn.00433030
mov dword [esp], edi
call fcn.0042a8b0
mov dword [esp], ebp
call fcn.0042b020
mov edx, dword [esp + 0x28]
test edx, edx
js 0x41a950
xor edx, edx
mov eax, edx
add esp, 0xadc
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x41a8bd
mov dword [0x46f108], 1
jmp 0x41a63b
lea eax, [esp + 0x38]
mov dword [esp + 4], eax
mov dword [esp], 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
test eax, eax
jne 0x41aa5f
mov dword [0x46f108], 1
jmp 0x41a5d4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x41a699
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_closesocket]
push eax
mov dword [esp], ebx
call fcn.0042e5d0
mov dword [esp], 2
call dword [0x4653f8]
mov dword [esp + 0xc], 0x42
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov dword [esp + 4], str.connection_to__s_failed_with_code__x_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, 0xffffffbe
mov eax, edx
add esp, 0xadc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x28], eax
mov dword [esp], ebx
call fcn.0042e5d0
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call fcn.00438a10
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00432dc0
mov dword [esp], esi
call fcn.00433030
mov dword [esp], edi
call fcn.0042a8b0
mov dword [esp], ebp
call fcn.0042b020
mov edx, dword [esp + 0x28]
mov dword [esp + 0x24], edx
mov dword [esp], 2
call dword [0x4653f8]
mov ecx, dword [esp + 0x24]
neg ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], str.init_ssl_context_failed_with_code__x_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [esp + 0x24]
jmp 0x41a82a
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00431cb0
mov edx, eax
test eax, eax
jne 0x41a7e0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x42e340
mov dword [esp + 8], 0x42e520
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.00431a20
jmp 0x41a828
mov ebx, 0x52
mov edx, 0xffffffae
mov dword [esp + 0x24], edx
mov dword [esp], 2
call dword [0x4653f8]
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x28]
mov dword [esp + 8], ecx
mov dword [esp + 4], str.resolving__s_failed_with_code__x_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [esp + 0x24]
mov eax, edx
add esp, 0xadc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 2
call dword [0x4653f8]
mov dword [esp + 8], 0x468688
mov dword [esp + 4], 0x46869f
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, 0xffffffff
jmp 0x41a82a
mov ebx, 0x42
mov edx, 0xffffffbe
lea eax, [esp + 0x1cc]
mov dword [esp + 0x28], eax
jmp 0x41a9e5