Function at 0x409c00
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub esp, 0x658
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 0
push str.CS_Fingerprint_Module
mov dword [esp + 0x30], 0x1000
mov dword [esp + 0x34], 0x429234
mov dword [esp + 0x38], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
jne 0x409c4a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x658
ret
mov eax, dword [str.fp.clickspring.net]
push 0
push 0
push 3
push 0
push eax
push 0x50
push eax
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebx, eax
test ebx, ebx
mov dword [esp + 0x18], ebx
jne 0x409c80
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x658
ret
mov ecx, dword [str.http:__fp.clickspring.net_fingerprint.php]
mov edx, dword [str._dispatcher.php]
push 0
lea eax, [esp + 0x24]
push 0x84400200
push eax
push ecx
push str.HTTP_1.1
push edx
push str.POST
push ebx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov ebp, eax
test ebp, ebp
jne 0x409cca
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x658
ret
mov edi, str.Content_type:_application_x_www_form_urlencoded_n
or ecx, 0xffffffff
xor eax, eax
push 0xa0000000
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Content_type:_application_x_www_form_urlencoded_n
push ebp
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
test eax, eax
jne 0x409d0b
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call edi
push ebx
call edi
push esi
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x658
ret
push 0x1000
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
mov ecx, 0x400
xor eax, eax
mov edi, esi
rep stosd dword es:[edi], eax
mov ecx, dword [0x42b2c4]
mov edx, dword [0x4291e8]
lea eax, [esp + 0x20]
push eax
mov eax, dword [0x4291e4]
push esi
push ecx
mov ecx, dword [0x42b2c0]
push edx
push eax
push ecx
call fcn.0040a070
add esp, 0x1c
test eax, eax
jne 0x409d5b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x658
ret
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
push eax
push eax
push ebp
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x409da0
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call edi
push ebx
call edi
mov edx, dword [esp + 0x14]
push edx
call edi
push esi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x658
ret
push esi
call dword [sym.imp.MSVCRT.dll_free]
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x26d]
mov byte [esp + 0x26c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
push 0x1000
stosb byte es:[edi], al
mov dword [esp + 0x1c], 1
call dword [sym.imp.MSVCRT.dll_calloc]
add esp, 0xc
mov ebx, eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x268]
push eax
push 0x400
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x409e58
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x409e58
lea edi, [esp + 0x268]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x100
lea edi, [esp + 0x268]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0x268]
push eax
push 0x400
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x409df9
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x670]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
add esp, 4
push ebp
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
mov ebx, dword [esp + 0x66c]
push 0xa
push ebx
call dword [sym.imp.MSVCRT.dll_strchr]
mov edx, eax
add esp, 8
test edx, edx
jne 0x409ec1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x658
ret
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x69]
mov byte [esp + 0x68], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [edx + 1]
or ecx, 0xffffffff
xor eax, eax
mov byte [edx], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x68]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x68]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x67], 0xa
jne 0x409f4c
lea edi, [esp + 0x68]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x68]
mov byte [esp + ecx + 0x67], al
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x67], 0xa
je 0x409f27
push 1
push 0x400
call dword [sym.imp.MSVCRT.dll_calloc]
mov ebp, eax
or ecx, 0xffffffff
mov edi, str.AAAAB3NzaC1yc2EAAAABIwAAAIEAx21Q2C
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, ebp
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42b4c8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x42b508
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x30]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push ebp
call fcn.0040bc40
push ebp
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0x14
lea esi, [esp + 0x68]
lea eax, [esp + 0x28]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40a051
test cl, cl
je 0x40a03b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40a051
add eax, 2
add esi, 2
test cl, cl
jne 0x40a017
xor eax, eax
xor ecx, ecx
test eax, eax
pop edi
pop esi
sete cl
pop ebp
mov eax, ecx
pop ebx
add esp, 0x658
ret
sbb eax, eax
pop edi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x658
ret