[computer]

Here's an annotated version of the code: http://pastebin.mozilla.org/2777139

It includes a hexdump of the shell code, showing it's building an HTTP request to somewhere. So it's likely identifying Tor users through non-Tor connections.