Function at 0x101aea4
Capabilities:
Query remote server for available data
Read data from internet
Receive data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0104b870
mov eax, dword [0x1079e94]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
mov edi, dword [ebp + 0xc]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], esi
mov dword [ebp - 0x1018], ebx
mov dword [ebp - 0x1010], ebx
mov dword [ebp - 0x1014], ebx
push ebx
jne 0x101af59
push ebx
push ebx
lea eax, [ebp - 0x1018]
push eax
xor eax, eax
cmp dword [0x107b254], ebx
push ebx
setne al
lea eax, [eax + eax + 2]
or eax, 1
push eax
push 5
push edi
call dword [sym.imp.CRYPTNET.dll_CryptRetrieveObjectByUrlW]
test eax, eax
jne 0x101af2b
call fcn.0106d6ff
push eax
push eax
push 0x14d0140
push edi
mov dword [ebp - 0x1008], eax
call fcn.01053590
jmp 0x101b0bd
push ebx
push ebx
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push ebx
push dword [ebp - 0x1018]
call fcn.0103e078
cmp eax, ebx
mov dword [ebp - 0x1008], eax
je 0x101b0aa
push eax
push 0x1580140
jmp 0x101b0b8
lea eax, [ebp - 0x100c]
push eax
push esi
mov dword [ebp - 0x100c], ebx
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x101af81
call fcn.0106d6ff
push eax
push 0x1640140
call fcn.01053610
lea eax, [ebp - 0x101c]
push eax
mov edi, 0x1000
push edi
lea eax, [ebp - 0x1004]
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
mov dword [ebp - 0x100c], ebx
jmp 0x101aff4
cmp dword [ebp - 0x101c], ebx
je 0x101b010
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x101c]
lea eax, [ebp - 0x1004]
push eax
call fcn.0101ae43
cmp eax, ebx
mov dword [ebp - 0x1008], eax
jne 0x101b0b2
mov eax, dword [ebp - 0x101c]
add dword [ebp - 0x100c], eax
lea eax, [ebp - 0x101c]
push eax
push edi
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1020]
call esi
test eax, eax
jne 0x101afa4
call fcn.0106d6ff
push eax
mov dword [ebp - 0x1008], eax
push 0x16f0140
jmp 0x101b0b8
push dword [ebp - 0x100c]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x1010], eax
jne 0x101b03a
mov eax, 0x8007000e
push eax
mov dword [ebp - 0x1008], eax
push 0x17f0140
jmp 0x101b0b8
mov ecx, dword [ebp - 0x100c]
add ecx, eax
mov eax, dword [ebp - 0x1014]
mov dword [ebp - 0x1008], ecx
jmp 0x101b072
mov ecx, dword [eax + 4]
sub dword [ebp - 0x1008], ecx
mov edi, dword [ebp - 0x1008]
mov edx, ecx
shr ecx, 2
lea esi, [eax + 8]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [eax]
cmp eax, ebx
jne 0x101b050
push 0xffffffffffffffff
push dword [ebp - 0x100c]
push dword [ebp - 0x1010]
call fcn.0102aa93
cmp eax, ebx
je 0x101b0aa
push eax
push 0x18e0140
call fcn.01053610
push dword [ebp - 0x100c]
push dword [ebp - 0x1010]
push ebx
call fcn.01052b92
mov dword [ebp - 0x1008], ebx
jmp 0x101b0bd
push eax
push 0x1760140
call fcn.01053610
cmp dword [ebp - 0x1018], ebx
je 0x101b0d3
push 2
push dword [ebp - 0x1018]
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
cmp dword [ebp - 0x1014], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x101b0f6
mov eax, dword [ebp - 0x1014]
mov edi, dword [eax]
push eax
mov dword [ebp - 0x1014], edi
call esi
cmp edi, ebx
jne 0x101b0e1
cmp dword [ebp - 0x1010], ebx
je 0x101b106
push dword [ebp - 0x1010]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1008]
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 8