Function at 0x44bd90
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d136
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2198
call fcn.004f9530
mov eax, dword [0x57254c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21a4], ecx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x21a0], ecx
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov byte [ebp - 4], 1
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
cmp dword [ebp - 0x2154], 0x10
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x2158], 0
lea edx, [ecx + 1]
cmovae eax, dword [ebp - 0x2168]
mov byte [eax], 0
lea eax, [ebp - 0x2180]
cmp dword [ebp - 0x216c], 0x10
mov dword [ebp - 0x2170], 0
cmovae eax, dword [ebp - 0x2180]
mov byte [eax], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44bea5
sub ecx, edx
push ecx
push dword [ebp - 0x21a0]
lea ecx, [ebp - 0x2168]
call fcn.00407ce0
push 0x80
lea eax, [ebp - 0x150]
push 0
push eax
call fcn.004fb730
add esp, 0xc
lea eax, [ebp - 0x150]
push str.w.nanweng.cn
push 0x80
push eax
call fcn.00503e39
add esp, 0xc
push str.w.nanweng.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x219c], eax
test eax, eax
je 0x44c1d3
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x44c263
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x2194], xmm0
push 0x50
mov word [ebp - 0x2194], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2192], ax
mov eax, dword [ebp - 0x219c]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2190], eax
lea eax, [ebp - 0x2194]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x44c1c6
push 4
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0xbb8
push eax
push 0x1005
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x2184]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0x219c], str._qy_sv
jle 0x44c006
push 0x80
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x219c], str._qy_ov
push 0
push eax
call fcn.004fb730
add esp, 0xc
lea eax, [ebp - 0xd0]
push dword [ebx + 0xc]
push str.type_d
push eax
call fcn.0044c780
add esp, 0xc
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0x2168]
push eax
call fcn.004062d0
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x1c], 0x75744e58
cmovae eax, dword [ebp - 0x2168]
xorps xmm0, xmm0
push ecx
mov ecx, dword [ebp - 0x21a4]
push eax
movups xmmword [ebp - 0x4c], xmm0
mov word [ebp - 0x18], 0x4e52
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x24], 0x67697326
mov word [ebp - 0x20], 0x3d
call fcn.0044c370
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2168]
call fcn.004062d0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2168]
call fcn.004062d0
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x2168]
lea edx, [ebp - 0x2198]
cmovae ecx, dword [ebp - 0x2168]
call fcn.004693c0
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.004fb730
mov ecx, dword [ebp - 0x2198]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44c0b7
sub ecx, edx
lea eax, [ebp - 0x150]
push ecx
push eax
push dword [ebp - 0x219c]
lea eax, [ebp - 0x2150]
push str.POST__s_HTTP_1.1_r_nHost:__s__r_nContent_Length:__d__r_nConnection:close_r_nAccept_Language:_zh_cn_r_nCache_Conbtrol:no_cache_r_nContent_Type:application_x_www_form_urlencoded_r_n_r_n
push eax
call fcn.00431450
lea ecx, [ebp - 0x2150]
add esp, 0x14
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x44c0f0
sub ecx, edx
lea eax, [ebp - 0x2150]
push ecx
push eax
lea ecx, [ebp - 0x2180]
call fcn.00407ce0
push dword [ebp - 0x2198]
lea ecx, [ebp - 0x2180]
call fcn.004062d0
push 0x556418
lea ecx, [ebp - 0x2180]
call fcn.004062d0
push dword [ebp - 0x2198]
call fcn.004f8ef5
mov eax, dword [ebp - 0x2198]
add esp, 4
test eax, eax
mov ecx, 0x8123
cmovne eax, ecx
mov dword [ebp - 0x2198], eax
cmp dword [ebp - 0x216c], 0x10
lea eax, [ebp - 0x2180]
push 0
push dword [ebp - 0x2170]
cmovae eax, dword [ebp - 0x2180]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x44c1c6
cmp edi, 5
jg 0x44c230
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.004fb730
add esp, 0xc
lea eax, [ebp - 0x2150]
push 0
push 0x1000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jg 0x44c1eb
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x12c
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44c151
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
call esi
inc edi
cmp edi, 0xa
jg 0x44c230
mov ecx, dword [ebp - 0x21a0]
jmp 0x44be60
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x2150]
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
push str.HTTP_1.1
push eax
movq qword [ebp - 0x28], xmm0
call fcn.004fb170
add esp, 8
test eax, eax
jne 0x44c238
lea eax, [ebp - 0x2150]
push str.HTTP_1.0
push eax
call fcn.004fb170
add esp, 8
test eax, eax
jne 0x44c235
or esi, 0xffffffff
jmp 0x44c265
add eax, 9
add eax, 9
push 4
push eax
lea eax, [ebp - 0x28]
push 0xc
push eax
call fcn.00503e2e
lea eax, [ebp - 0x28]
push eax
call fcn.005051d1
add esp, 0x14
cmp eax, 0xc8
je 0x44c263
cmp eax, 0x1f4
jne 0x44c230
xor esi, esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x216c]
cmp edx, 0x10
jb 0x44c2a3
mov ecx, dword [ebp - 0x2180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44c299
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c338
push edx
push ecx
call fcn.004f8ec4
add esp, 8
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2154]
cmp edx, 0x10
jb 0x44c2fb
mov ecx, dword [ebp - 0x2168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44c2f1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x44c33d
push edx
push ecx
call fcn.004f8ec4
add esp, 8
mov dword [ebp - 0x2158], 0
mov eax, esi
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004f8955
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.00500017
call fcn.00500017
int3