Function at 0x4551f0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Contain obfuscated stackstrings
Create tcp socket
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537b56
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2198
call fcn.00502a70
mov eax, dword [0x57d54c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x21a4], ecx
mov ecx, dword [ebx + 8]
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0
mov dword [ebp - 0x21a0], ecx
mov dword [ebp - 0x2158], 0
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov byte [ebp - 4], 1
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
cmp dword [ebp - 0x2154], 0x10
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x2158], 0
lea edx, [ecx + 1]
cmovae eax, dword [ebp - 0x2168]
mov byte [eax], 0
lea eax, [ebp - 0x2180]
cmp dword [ebp - 0x216c], 0x10
mov dword [ebp - 0x2170], 0
cmovae eax, dword [ebp - 0x2180]
mov byte [eax], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455305
sub ecx, edx
push ecx
push dword [ebp - 0x21a0]
lea ecx, [ebp - 0x2168]
call fcn.0040ad60
push 0x80
lea eax, [ebp - 0x150]
push 0
push eax
call fcn.00504c70
add esp, 0xc
lea eax, [ebp - 0x150]
push str.w.nanweng.cn
push 0x80
push eax
call fcn.0050d9da
add esp, 0xc
push str.w.nanweng.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0x219c], eax
test eax, eax
je 0x455633
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x4556c3
xorps xmm0, xmm0
mov eax, 2
movups xmmword [ebp - 0x2194], xmm0
push 0x50
mov word [ebp - 0x2194], ax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x2192], ax
mov eax, dword [ebp - 0x219c]
push 0x10
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x2190], eax
lea eax, [ebp - 0x2194]
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x455626
push 4
lea eax, [ebp - 0x2184]
mov dword [ebp - 0x2184], 0xbb8
push eax
push 0x1005
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
push 4
lea eax, [ebp - 0x2184]
push eax
push 0x1006
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp dword [ebx + 0xc], 0
mov dword [ebp - 0x219c], str._qy_sv
jle 0x455466
push 0x80
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x219c], str._qy_ov
push 0
push eax
call fcn.00504c70
add esp, 0xc
lea eax, [ebp - 0xd0]
push dword [ebx + 0xc]
push str.type_d
push eax
call fcn.00455be0
add esp, 0xc
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0x2168]
push eax
call fcn.004080e0
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x2c], 0
lea eax, [ebp - 0x2168]
mov dword [ebp - 0x1c], 0x75744e58
cmovae eax, dword [ebp - 0x2168]
xorps xmm0, xmm0
push ecx
mov ecx, dword [ebp - 0x21a4]
push eax
movups xmmword [ebp - 0x4c], xmm0
mov word [ebp - 0x18], 0x4e52
movups xmmword [ebp - 0x3c], xmm0
mov byte [ebp - 0x16], 0
mov dword [ebp - 0x24], 0x67697326
mov word [ebp - 0x20], 0x3d
call fcn.004557d0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x2168]
call fcn.004080e0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2168]
call fcn.004080e0
cmp dword [ebp - 0x2154], 0x10
lea ecx, [ebp - 0x2168]
lea edx, [ebp - 0x2198]
cmovae ecx, dword [ebp - 0x2168]
call fcn.00472850
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.00504c70
mov ecx, dword [ebp - 0x2198]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455517
sub ecx, edx
lea eax, [ebp - 0x150]
push ecx
push eax
push dword [ebp - 0x219c]
lea eax, [ebp - 0x2150]
push str.POST__s_HTTP_1.1_r_nHost:__s__r_nContent_Length:__d__r_nConnection:close_r_nAccept_Language:_zh_cn_r_nCache_Conbtrol:no_cache_r_nContent_Type:application_x_www_form_urlencoded_r_n_r_n
push eax
call fcn.00437640
lea ecx, [ebp - 0x2150]
add esp, 0x14
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x455550
sub ecx, edx
lea eax, [ebp - 0x2150]
push ecx
push eax
lea ecx, [ebp - 0x2180]
call fcn.0040ad60
push dword [ebp - 0x2198]
lea ecx, [ebp - 0x2180]
call fcn.004080e0
push 0x560598
lea ecx, [ebp - 0x2180]
call fcn.004080e0
push dword [ebp - 0x2198]
call fcn.00502435
mov eax, dword [ebp - 0x2198]
add esp, 4
test eax, eax
mov ecx, 0x8123
cmovne eax, ecx
mov dword [ebp - 0x2198], eax
cmp dword [ebp - 0x216c], 0x10
lea eax, [ebp - 0x2180]
push 0
push dword [ebp - 0x2170]
cmovae eax, dword [ebp - 0x2180]
push eax
push esi
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x455626
cmp edi, 5
jg 0x455690
push 0x2000
lea eax, [ebp - 0x2150]
push 0
push eax
call fcn.00504c70
add esp, 0xc
lea eax, [ebp - 0x2150]
push 0
push 0x1000
push eax
push esi
call dword [sym.imp.WS2_32.dll_recv]
push esi
test eax, eax
jg 0x45564b
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x12c
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4555b1
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x12c
call esi
inc edi
cmp edi, 0xa
jg 0x455690
mov ecx, dword [ebp - 0x21a0]
jmp 0x4552c0
call dword [sym.imp.WS2_32.dll_closesocket]
lea eax, [ebp - 0x2150]
mov dword [ebp - 0x20], 0
xorps xmm0, xmm0
push str.HTTP_1.1
push eax
movq qword [ebp - 0x28], xmm0
call fcn.005046b0
add esp, 8
test eax, eax
jne 0x455698
lea eax, [ebp - 0x2150]
push str.HTTP_1.0
push eax
call fcn.005046b0
add esp, 8
test eax, eax
jne 0x455695
or esi, 0xffffffff
jmp 0x4556c5
add eax, 9
add eax, 9
push 4
push eax
lea eax, [ebp - 0x28]
push 0xc
push eax
call fcn.0050d9cf
lea eax, [ebp - 0x28]
push eax
call fcn.0050ed72
add esp, 0x14
cmp eax, 0xc8
je 0x4556c3
cmp eax, 0x1f4
jne 0x455690
xor esi, esi
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x216c]
cmp edx, 0x10
jb 0x455703
mov ecx, dword [ebp - 0x2180]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4556f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x455798
push edx
push ecx
call fcn.00502404
add esp, 8
mov dword [ebp - 0x2170], 0
mov dword [ebp - 0x216c], 0xf
mov byte [ebp - 0x2180], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x2154]
cmp edx, 0x10
jb 0x45575b
mov ecx, dword [ebp - 0x2168]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x455751
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45579d
push edx
push ecx
call fcn.00502404
add esp, 8
mov dword [ebp - 0x2158], 0
mov eax, esi
mov dword [ebp - 0x2154], 0xf
mov byte [ebp - 0x2168], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00501e95
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.00509bb8
call fcn.00509bb8
int3