Function at 0x440ac0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x9bc
mov eax, dword [0x52bd60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x894], edx
mov eax, ecx
mov dword [ebp - 0x8b8], eax
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x870], eax
mov dword [ebp - 0x8c8], 0
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x82c], eax
mov eax, str._t_rted
mov dword [ebp - 4], 1
test eax, 0xffff0000
jne 0x440b64
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x440b74
push esi
push eax
lea ecx, [ebp - 0x82c]
call fcn.00404a70
jmp 0x440b74
push str._t_rted
lea ecx, [ebp - 0x82c]
call fcn.004044d0
push str.HttpReque_t
lea ecx, [ebp - 0x88c]
mov dword [ebp - 4], 2
call fcn.004036e0
mov byte [ebp - 4], 3
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x82c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 4
call fcn.00431c80
add esp, 4
mov edi, eax
push str.GlobalLog
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 5
call fcn.004036e0
push 0
push edi
lea eax, [ebp - 0x88c]
push eax
lea eax, [ebp - 0x878]
push eax
mov ecx, 0x530768
mov byte [ebp - 4], 6
call fcn.004018b0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x440c1f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x87c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440c42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440c5f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440c82
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x82c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440ca5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov edi, dword [ebp - 0x870]
mov ecx, edi
call fcn.0043f380
test al, al
je 0x440d5c
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x82c], eax
mov eax, str.this_module_doesnt_support_file_request
mov dword [ebp - 4], 7
test eax, 0xffff0000
jne 0x440d00
movzx esi, ax
mov ecx, esi
call fcn.00405530
test eax, eax
je 0x440d10
push esi
push eax
lea ecx, [ebp - 0x82c]
call fcn.00404a70
jmp 0x440d10
push str.this_module_doesnt_support_file_request
lea ecx, [ebp - 0x82c]
call fcn.004044d0
mov dword [ebp - 4], 8
mov esi, dword [ebp - 0x8b8]
lea edx, [ebp - 0x82c]
mov ecx, esi
call fcn.0043ec40
mov byte [ebp - 4], 0
mov edi, dword [ebp - 0x82c]
add edi, 0xfffffff0
mov dword [ebp - 0x8c8], 1
lea eax, [edi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x440d55
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, esi
jmp 0x4451fa
cmp dword [ebp - 0x894], 0
jne 0x440ec1
push str.h1nternet0pen_i__null
lea ecx, [ebp - 0x82c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], 9
call fcn.004036e0
mov byte [ebp - 4], 0xa
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x82c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], reloc.kernel32.dll_ConvertDefaultLocale
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_AssignProcessToJobObject
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_ConvertDefaultLocale
mov edx, dword [ebp - 0x870]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440e02
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440e1f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440e42
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x82c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x440e65
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push str.InternetOpen_Failed
lea ecx, [ebp - 0x884]
call fcn.00403790
mov dword [ebp - 4], reloc.kernel32.dll_CreateFileMappingW
mov esi, dword [ebp - 0x8b8]
mov edx, eax
mov ecx, esi
call fcn.0043ec40
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x884]
mov dword [ebp - 0x8c8], 1
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x440d55
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, esi
jmp 0x4451fa
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x8a0], eax
mov dword [ebp - 4], reloc.kernel32.dll_ReleaseActCtx
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x8b4], eax
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
push reloc.kernel32.dll_AllocConsole
mov ecx, edi
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x834], 0
call fcn.0044ac20
mov esi, eax
cmp byte [esi + 8], 4
je 0x440f37
push 0x2a9
push str...CrossRiderGeneralJsonjson_value.cpp
push str.type___stringValue
call fcn.004b708c
add esp, 0xc
sub esp, 0x18
mov ecx, esp
push dword [esi]
call fcn.00401250
lea ecx, [ebp - 0x834]
call fcn.004319e0
add esp, 0x18
push str.url:
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SetSystemTime
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], reloc.kernel32.dll_OpenSemaphoreW
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x834]
push ecx
mov edx, eax
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
mov edx, dword [ebp - 0x830]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441006
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_OpenSemaphoreW
mov edx, dword [ebp - 0x89c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441029
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SetSystemTime
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441046
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441069
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x86c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44108c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x8b4]
push eax
lea edx, [ebp - 0x8a0]
lea ecx, [ebp - 0x834]
call fcn.0043efe0
movzx eax, al
add esp, 8
test eax, eax
jne 0x441257
push str.CrackUrl_failed
lea ecx, [ebp - 0x82c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x82c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], reloc.kernel32.dll_IsProcessInJob
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_IsProcessInJob
mov edx, dword [ebp - 0x870]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44114f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44116c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44118f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x82c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4411b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push str.InternetCrackUrl_Failed
lea ecx, [ebp - 0x884]
call fcn.00403790
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
mov esi, dword [ebp - 0x8b8]
mov edx, eax
mov ecx, esi
call fcn.0043ec40
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x884]
add edx, 0xfffffff0
mov dword [ebp - 0x8c8], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441202
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
mov edx, dword [ebp - 0x834]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441225
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseActCtx
mov edx, dword [ebp - 0x8b4]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441248
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x8a0]
jmp 0x440e9f
push str.redirectCheck
mov ecx, edi
mov byte [ebp - 0x8bd], 0
call fcn.0044ac20
cmp eax, 0x530a10
je 0x44129c
push str.redirectCheck
mov ecx, edi
call fcn.0044ac20
cmp byte [eax + 8], 5
jne 0x44129c
push str.redirectCheck
mov ecx, edi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a5d0
mov byte [ebp - 0x8bd], al
push str.Cr_ckUrl_returned_Ho_t:
lea ecx, [ebp - 0x88c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x88c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_lstrcpynW
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x8a0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_ReadProcessMemory
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
mov edx, dword [ebp - 0x87c]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44134d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_lstrcpynW
mov edx, dword [ebp - 0x86c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441370
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44138d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4413b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4413d3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push str.Cr_ckUrl_returned_Ur1:
lea ecx, [ebp - 0x88c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x88c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x8b4]
push ecx
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
mov edx, dword [ebp - 0x87c]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441484
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
mov edx, dword [ebp - 0x86c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4414a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4414c4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4414e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44150a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push str.Cr_ckUr1_returned_Port:
lea ecx, [ebp - 0x88c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x88c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
push dword [ebp - 0x82c]
mov edx, eax
lea ecx, [ebp - 0x87c]
call fcn.00431be0
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileAttributesW
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
mov edx, dword [ebp - 0x87c]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4415ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
mov edx, dword [ebp - 0x86c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4415dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_WakeConditionVariable
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4415fa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44161d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441640
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
push ecx
mov ecx, dword [ebp - 0x834]
mov byte [ebp - 0x865], 0
lea ecx, [ecx - 0x10]
mov dword [ebp - 0x830], reloc.kernel32.dll_ReleaseSRWLockExclusive
lea edi, [ebp - 0x830]
mov esi, esp
call fcn.00404770
add eax, 0x10
mov edx, edi
lea ecx, [ebp - 0x865]
mov dword [esi], eax
call fcn.0043f140
add esp, 4
cmp byte [ebp - 0x865], 0
mov ecx, reloc.kernel32.dll_CreateWaitableTimerA
mov eax, reloc.kernel32.dll_CreateEventW
cmove eax, ecx
push eax
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.IsHTTP_:
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_LocalReAlloc
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea edi, [eax + 0x10]
mov dword [ebp - 0x87c], edi
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x88c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x8b0]
mov byte [ebp - 4], reloc.kernel32.dll_GetTimeFormatW
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x86c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetDriveTypeW
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
mov edx, dword [ebp - 0x89c]
add esp, 4
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441787
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetTimeFormatW
mov edx, dword [ebp - 0x8b0]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4417aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
mov edx, dword [ebp - 0x8ac]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4417cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4417ea
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add edi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreW
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441807
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_LocalReAlloc
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44182a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44184d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x86c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441870
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov esi, dword [ebp - 0x870]
push str.port
mov ecx, esi
call fcn.0044ac20
cmp byte [eax + 8], 1
jne 0x44189f
push str.port
mov ecx, esi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a210
mov edi, eax
jmp 0x4418ae
mov edi, dword [ebp - 0x82c]
test edi, edi
cmove edi, dword [ebp - 0x830]
push str.Port_to_use_for_the_reque_t:
lea ecx, [ebp - 0x82c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x884], esi
lea eax, [ebp - 0x82c]
push eax
lea edx, [ebp - 0x884]
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
call fcn.00431c80
add esp, 4
push edi
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
call fcn.00431be0
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_CreateActCtxW
call fcn.0040c920
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeExA
mov edx, dword [ebp - 0x87c]
add edx, 0xfffffff0
add esp, 4
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441959
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
mov edx, dword [ebp - 0x88c]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x44197c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
add esi, 0xfffffff0
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x441999
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
mov edx, dword [ebp - 0x878]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4419bc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x82c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4419dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov ecx, dword [ebp - 0x8a8]
push edi
lea edx, [ebp - 0x8a0]
mov byte [ebp - 0x88d], 0
call fcn.0043f230
mov ebx, eax
add esp, 4
mov dword [ebp - 0x88c], ebx
test ebx, ebx
jne 0x441ca0
cmp dword [0x530c5c], eax
jne 0x441a31
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x441a31
push str.InternetConnectW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x530c5c], eax
push str.CheckForAnOpenHttp_ession_returned_null__o_we_need_to_open___new_HTTP__e_sion
lea ecx, [ebp - 0x88c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x88c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_HeapSetInformation
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
mov eax, dword [0x530c5c]
test eax, eax
je 0x441be4
push 0
push 0
push 3
push 0
push 0
push edi
push dword [ebp - 0x8a0]
push dword [ebp - 0x894]
call eax
mov ebx, eax
mov dword [ebp - 0x88c], eax
test ebx, ebx
je 0x441be4
push str.Cre_ted_a_new_HTTP_se__ion:
lea ecx, [ebp - 0x82c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryW
call fcn.004036e0
mov edx, ebx
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], reloc.kernel32.dll_SetEvent
call fcn.00431d20
mov esi, eax
lea ecx, [ebp - 0x86c]
call fcn.004036a0
lea ecx, [ebp - 0x82c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileW
call fcn.00431c80
add esp, 4
push esi
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
mov byte [ebp - 0x88d], 1
jmp 0x441d82
push str.1nternetConnect_failed
lea ecx, [ebp - 0x82c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryW
call fcn.004036e0
lea ecx, [ebp - 0x87c]
call fcn.004036a0
lea ecx, [ebp - 0x82c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_VerifyVersionInfoW
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_DosDateTimeToFileTime
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
push str.InternetConnect_Failed
lea ecx, [ebp - 0x870]
call fcn.00403790
mov byte [ebp - 4], reloc.kernel32.dll_ResumeThread
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x870]
jmp 0x4451ce
push str.Found__n__lre_dy_exi_ting_HTTP_ses_ion:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_SuspendThread
call fcn.004036e0
mov edx, ebx
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
call fcn.00431d20
mov esi, eax
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFile
mov edx, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [edx + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
call fcn.00431c80
add esp, 4
push esi
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetFinalPathNameByHandleW
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFileEx
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
cmp byte [ebp - 0x8bd], 0
mov eax, 0x80400200
mov ecx, 0x80600200
cmovne eax, ecx
or eax, 0xc000
cmp byte [ebp - 0x865], 0
mov dword [ebp - 0x894], eax
je 0x441db5
or eax, 0x803080
mov dword [ebp - 0x894], eax
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x89c], eax
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
mov esi, dword [ebp - 0x870]
push str.method
mov ecx, esi
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x441f11
push str.method
mov ecx, esi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x89c]
mov byte [ebp - 4], reloc.kernel32.dll_FlushViewOfFile
call fcn.00403840
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
call fcn.00403820
push str.0pening_HTTP_request_with__method:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToFileTime
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSRWLockExclusive
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetEnvironmentStrings
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x89c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_EnumSystemLocalesA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolTimer
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
call fcn.00403820
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x830], eax
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x8b0], ebx
push str.version
mov ecx, esi
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x44205b
push str.version
mov ecx, esi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x8b0]
mov byte [ebp - 4], reloc.kernel32.dll_GetLocaleInfoA
call fcn.00403840
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.00403820
push str.Opening_HTTP_request_with__version:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_SetFileApisToOEM
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_FileTimeToSystemTime
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x8b0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_DebugBreak
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultUILanguage
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.00403820
mov ebx, dword [ebp - 0x8b0]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea edi, [eax + 0x10]
mov dword [ebp - 0x8ac], edi
push str.referer
mov ecx, esi
mov byte [ebp - 4], reloc.kernel32.dll_WriteConsoleA
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x4421a5
push str.referer
mov ecx, esi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x8ac]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryA
call fcn.00403840
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_WriteConsoleA
call fcn.00403820
push str.0pening_HTTP_reque_t_with__referer:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_InitializeCriticalSectionEx
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetPriorityClass
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetModuleFileNameA
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x8ac]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_SetHandleCount
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_DeleteFileW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_WriteConsoleA
call fcn.00403820
mov edi, dword [ebp - 0x8ac]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x8a8], esi
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
mov ecx, dword [ebp - 0x870]
push str.acceptTypes
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x4422f7
mov ecx, dword [ebp - 0x870]
push str.acceptTypes
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x8a8]
mov byte [ebp - 4], reloc.kernel32.dll_SetNamedPipeHandleState
call fcn.00403840
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
call fcn.00403820
push str.0pening_HTTP_reque_t_with___cceptType_:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_DebugActiveProcess
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileExW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x86c]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_ActivateActCtx
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x8a8]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetCommandLineA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_LocalAlloc
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
call fcn.00403820
mov esi, dword [ebp - 0x8a8]
xor eax, eax
cmp dword [esi - 0xc], eax
mov dword [ebp - 0x824], eax
cmove esi, eax
mov dword [ebp - 0x828], esi
cmp dword [edi - 0xc], eax
push 1
push dword [ebp - 0x894]
cmove edi, eax
cmp dword [ebx - 0xc], eax
cmove ebx, eax
mov eax, dword [ebp - 0x830]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
cmove eax, ecx
lea ecx, [ebp - 0x828]
push ecx
push edi
push ebx
push dword [ebp - 0x8b4]
push eax
push dword [ebp - 0x88c]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x82c], eax
test eax, eax
jne 0x442426
push str.Http0penRequest_failed
lea ecx, [ebp - 0x870]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_lstrlenW
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemDirectoryW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x870]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_HeapCreate
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
call fcn.00403820
push str.HttpOpenRequest_Failed
lea ecx, [ebp - 0x87c]
call fcn.00403790
mov byte [ebp - 4], reloc.kernel32.dll_WritePrivateProfileSectionW
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x87c]
jmp 0x4451a2
push str.HttpOpenRequest_wa__suce_sful
lea ecx, [ebp - 0x830]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateWaitableTimerA
call fcn.004036e0
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemWindowsDirectoryW
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x830]
push eax
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetTempFileNameA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_GetLongPathNameW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x86c]
call fcn.00403820
lea ecx, [ebp - 0x830]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessAffinityMask
call fcn.00403820
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea esi, [eax + 0x10]
mov dword [ebp - 0x8bc], esi
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryW
mov edi, dword [ebp - 0x870]
push str.contentType
mov ecx, edi
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x4425d6
push reloc.kernel32.dll_CreateFileMappingW
lea ecx, [ebp - 0x878]
call fcn.004036e0
lea eax, [ebp - 0x878]
push eax
push str.contentType
mov ecx, edi
mov byte [ebp - 4], reloc.kernel32.dll_FreeEnvironmentStringsA
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x830]
call fcn.004319e0
add esp, 0x18
mov esi, eax
push str.Content_Type:
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_ConnectNamedPipe
call fcn.00403790
push esi
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_AllocConsole
call fcn.00431c80
add esp, 4
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_IsBadReadPtr
call fcn.00431c80
add esp, 4
push eax
lea ecx, [ebp - 0x8bc]
mov byte [ebp - 4], reloc.kernel32.dll_GetTempFileNameW
call fcn.00403840
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x86c]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryW
call fcn.00403820
mov esi, dword [ebp - 0x8bc]
push str.additionalRequestHeaders
mov ecx, edi
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x44272e
push str.additionalRequestHeaders
mov ecx, edi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
mov byte [ebp - 4], reloc.kernel32.dll_ResetEvent
mov eax, dword [eax]
lea ecx, [ebp - 0x8bc]
push dword [eax - 0xc]
push eax
call fcn.004270f0
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryW
call fcn.00403820
lea eax, [ebp - 0x8bc]
push eax
lea ecx, [ebp - 0x86c]
mov dword [ebp - 0x86c], 0
call fcn.004036c0
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateEventW
call fcn.00445220
push str.Additional_he_der_:
lea ecx, [ebp - 0x830]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_LoadLibraryExA
call fcn.004036e0
lea ecx, [ebp - 0x894]
call fcn.004036a0
lea ecx, [ebp - 0x830]
push ecx
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForMultipleObjects
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x86c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolCleanupGroupMembers
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesA
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x894]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_SetCurrentDirectoryW
call fcn.00403820
mov esi, dword [ebp - 0x8bc]
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x894], ebx
push str.postData
mov ecx, edi
mov byte [ebp - 4], reloc.kernel32.dll_TerminateThread
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x442865
push str.postData
mov ecx, edi
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x884]
call fcn.004319e0
add esp, 0x18
push eax
lea ecx, [ebp - 0x894]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForMultipleObjectsEx
call fcn.00403840
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_TerminateThread
call fcn.00403820
push str.P0_T_dat_:
lea ecx, [ebp - 0x86c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_FreeConsole
call fcn.004036e0
lea ecx, [ebp - 0x830]
call fcn.004036a0
lea ecx, [ebp - 0x86c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateProcessW
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x894]
push ecx
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_SetWaitableTimer
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetDateFormatW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], reloc.kernel32.dll_TerminateThread
call fcn.00403820
mov ebx, dword [ebp - 0x894]
lea ecx, [ebx - 0x10]
call fcn.00404770
lea edi, [eax + 0x10]
mov dword [ebp - 0x830], edi
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
mov eax, dword [ebx - 0xc]
add eax, eax
cmp byte [ebp - 0x8bd], 0
mov dword [ebp - 0x880], eax
je 0x442c2e
push 4
lea eax, [ebp - 0x86c]
push eax
push 6
push dword [ebp - 0x82c]
mov dword [ebp - 0x86c], 0x2710
call dword [sym.imp.WININET.dll_InternetSetOptionW]
test eax, eax
je 0x4429a4
push str._et_HttpReque_t_Internet_etOption_Rec_
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_CreateSemaphoreExW
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
mov ebx, eax
lea ecx, [ebp - 0x8a4]
call fcn.004036a0
push ebx
mov edx, eax
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], reloc.kernel32.dll_EnumDateFormatsA
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x8dc]
mov byte [ebp - 4], reloc.kernel32.dll_FileTimeToLocalFileTime
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumeNameForVolumeMountPointW
push dword [ebp - 0x86c]
mov edx, eax
lea ecx, [ebp - 0x884]
call fcn.00431be0
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_SetEnvironmentVariableW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x8dc]
call fcn.00403820
lea ecx, [ebp - 0x8c4]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x87c]
jmp 0x442a8b
push str.HttpReque_t_InternetSet0ption_Rec_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetNativeSystemInfo
call fcn.004036e0
lea ecx, [ebp - 0x884]
call fcn.004036a0
mov ebx, eax
lea ecx, [ebp - 0x8dc]
call fcn.004036a0
push ebx
mov edx, eax
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSemaphore
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x8a4]
mov byte [ebp - 4], reloc.kernel32.dll_GetLongPathNameA
call fcn.00431c80
add esp, 4
mov ebx, eax
mov byte [ebp - 4], reloc.kernel32.dll_SetThreadPriority
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, ebx
lea ecx, [ebp - 0x888]
call fcn.00431be0
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_SetInformationJobObject
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x8c4]
call fcn.00403820
lea ecx, [ebp - 0x8dc]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
push 4
lea eax, [ebp - 0x86c]
push eax
push 5
push dword [ebp - 0x82c]
call dword [sym.imp.WININET.dll_InternetSetOptionW]
lea ecx, [ebp - 0x878]
test eax, eax
je 0x442b44
push str._et_HttpReque_t_1nternetSetOption__end_
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetStartupInfoA
call fcn.004036e0
lea ecx, [ebp - 0x884]
call fcn.004036a0
mov ebx, eax
lea ecx, [ebp - 0x8dc]
call fcn.004036a0
push ebx
mov edx, eax
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], reloc.kernel32.dll_OutputDebugStringA
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x8a4]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleCommandHistoryLengthW
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputCharacterA
push dword [ebp - 0x86c]
mov edx, eax
lea ecx, [ebp - 0x888]
call fcn.00431be0
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeW
push 0
jmp 0x442bcd
push str.HttpReque_t_1nternet_et0ption_Send_
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_FindResourceExA
call fcn.004036e0
lea ecx, [ebp - 0x884]
call fcn.004036a0
mov ebx, eax
lea ecx, [ebp - 0x8dc]
call fcn.004036a0
push ebx
mov edx, eax
lea ecx, [ebp - 0x8c4]
mov byte [ebp - 4], 0x9f
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x8a4]
mov byte [ebp - 4], 0xa0
call fcn.00431c80
add esp, 4
mov ebx, eax
mov byte [ebp - 4], 0xa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, ebx
lea ecx, [ebp - 0x888]
call fcn.00431be0
add esp, 4
mov byte [ebp - 4], 0xa2
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x8c4]
call fcn.00403820
lea ecx, [ebp - 0x8dc]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
xor eax, eax
cmp dword [esi - 0xc], eax
lea ebx, [esi - 0xc]
cmove esi, eax
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
or eax, ecx
jge 0x442c5b
push 0
lea ecx, [ebp - 0x830]
call fcn.0040c760
mov edi, dword [ebp - 0x830]
push dword [ebp - 0x880]
push edi
push dword [ebx]
push esi
call fcn.0040ca40
mov edi, dword [ebp - 0x82c]
mov edx, edi
mov ecx, eax
call fcn.00450570
test eax, eax
jne 0x442dc3
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], eax
call fcn.00432310
push str.Http_endReque_t_f_i1ed_with:
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xa3
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xa4
call fcn.004036e0
lea ecx, [ebp - 0x8a4]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0xa6
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x82c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xa7
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xa8
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xa3
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x88d], 0
je 0x442d66
push dword [ebp - 0x88c]
call esi
push str.HttpSendRequest_Failed_with:
lea ecx, [ebp - 0x888]
call fcn.00403790
lea ecx, [ebp - 0x82c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xa9
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xaa
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x82c]
jmp 0x445181
push str.Http_endRequest_wa__succe__ful
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xab
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xad
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xae
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
mov ebx, dword [ebp - 0x870]
mov ecx, ebx
call fcn.0043f310
test al, al
jne 0x443032
mov edx, dword [0x530408]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, reloc.kernel32.dll_GetConsoleOutputCP
idiv ecx
cmp edx, 0x10
jne 0x442ea8
push 4
call fcn.004b45a0
add esp, 4
mov esi, eax
call fcn.004b597b
push esi
mov dword [esi], eax
mov dword [0x530408], eax
call fcn.004b458c
add esp, 4
push str.No_re_ponse_i__needed__o_we_c_n_exit
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xaf
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xb1
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xb2
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x88d], 0
je 0x442f52
push dword [ebp - 0x88c]
call esi
push 0
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x83c], 0
call fcn.00449c30
mov eax, dword [ebp - 0x850]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x850], eax
mov dword [ebp - 0x84c], 0
mov byte [ebp - 0x858], 1
lea eax, [ebp - 0x858]
push eax
push ecx
push str.result
lea ecx, [ebp - 0x848]
mov byte [ebp - 4], 0xb4
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xb3
call fcn.00449f60
push str.no_response_needed
lea ecx, [ebp - 0x8d8]
call fcn.00449d10
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.content
lea ecx, [ebp - 0x848]
mov byte [ebp - 4], 0xb5
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xb3
call fcn.00449f60
mov ecx, dword [ebp - 0x8b8]
lea eax, [ebp - 0x848]
push eax
call fcn.00449de0
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x8c8], 1
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00449f60
jmp 0x445186
push 0x400
lea eax, [ebp - 0x417]
push 0
push eax
mov byte [ebp - 0x418], 0
call fcn.004b9070
add esp, 0xc
mov dword [ebp - 0x864], 0x400
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x4431b0
push str.HttpQuery1nfo_f_iled__when_querying_st_tus_code_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xb6
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xb8
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xb9
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
mov ecx, dword [0x530408]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov edi, reloc.kernel32.dll_AssignProcessToJobObject
idiv edi
cmp edx, 2
jne 0x443173
movsd xmm3, qword [0x519ff0]
movsd xmm6, qword [0x51a018]
movsd xmm5, qword [0x519fe8]
movd xmm4, ecx
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x44315d
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x443143
cmp byte [ebp - 0x88d], 0
je 0x443184
push dword [ebp - 0x88c]
call esi
push str.HttpQueryInfo_Failed
lea ecx, [ebp - 0x880]
call fcn.00403790
mov byte [ebp - 4], 0xba
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
jmp 0x445181
push str.HttpQueryInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x44329a
push str.HttpQueryInfo_failed__when_querying_statu__code_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xbb
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xbd
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xbe
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x88d], 0
je 0x44326e
push dword [ebp - 0x88c]
call esi
push str.HttpQueryInfo_Failed
lea ecx, [ebp - 0x880]
call fcn.00403790
mov byte [ebp - 4], 0xbf
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
jmp 0x445181
push 0
lea ecx, [ebp - 0x864]
push ecx
lea ecx, [ebp - 0x418]
push ecx
push reloc.kernel32.dll_OpenSemaphoreW
push edi
call eax
test eax, eax
jne 0x44338d
push str.HttpQueryInfo_f_iled__when_querying_statu__code_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xc0
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xc2
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xc3
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_VirtualFreeEx
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x88d], 0
je 0x443361
push dword [ebp - 0x88c]
call esi
push str.HttpQueryInfo_Failed
lea ecx, [ebp - 0x880]
call fcn.00403790
mov byte [ebp - 4], 0xc4
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
jmp 0x445181
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x898]
mov dword [ebp - 0x898], 0
call fcn.00436740
push str.HttpQueryInfo_returned_statu__code:
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xc5
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xc6
call fcn.004036e0
lea ecx, [ebp - 0x8a4]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0xc8
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x898]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xc9
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xca
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xc5
call fcn.00403820
push str.acceptedStatusCodes
mov ecx, ebx
call fcn.0044ac20
mov ebx, eax
mov ecx, ebx
call fcn.0044afd0
test al, al
je 0x443574
xor edi, edi
call fcn.0044a660
test eax, eax
jle 0x443702
nop
push edi
mov ecx, ebx
call fcn.0044a960
cmp byte [eax + 8], 4
push edi
mov ecx, ebx
jne 0x4434db
call fcn.0044a960
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x880]
call fcn.004319e0
add esp, 0x18
mov edx, eax
lea ecx, [ebp - 0x898]
call fcn.00426e60
lea ecx, [ebp - 0x880]
jmp 0x443547
call fcn.0044a960
cmp byte [eax + 8], 1
jne 0x44355f
lea ecx, [ebp - 0x888]
mov dword [ebp - 0x86c], 0
call fcn.004036a0
mov esi, eax
push edi
mov ecx, ebx
mov byte [ebp - 4], 0xcb
call fcn.0044a960
mov ecx, eax
call fcn.0044a210
push eax
mov edx, esi
lea ecx, [ebp - 0x86c]
call fcn.00431be0
add esp, 4
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], 0xc5
call fcn.00403820
lea edx, [ebp - 0x86c]
lea ecx, [ebp - 0x898]
call fcn.00426e60
lea ecx, [ebp - 0x86c]
mov byte [ebp - 0x865], al
call fcn.00403820
cmp byte [ebp - 0x865], 0
jne 0x4437ed
mov ecx, ebx
inc edi
call fcn.0044a660
cmp edi, eax
jl 0x443490
jmp 0x443702
call fcn.0044aff0
test al, al
je 0x4436ea
xor edi, edi
mov ecx, ebx
mov dword [ebp - 0x87c], edi
call fcn.0044a660
test eax, eax
jle 0x443702
jmp 0x4435a0
lea ecx, [ebp - 0x86c]
mov dword [ebp - 0x86c], 0
call fcn.004036a0
push edi
lea eax, [ebp - 0x86c]
push reloc.kernel32.dll_GetComputerNameExA
push eax
mov byte [ebp - 4], 0xcc
call fcn.0043b9d0
mov esi, dword [ebp - 0x86c]
add esp, 0xc
mov ecx, ebx
push esi
call fcn.0044ac20
cmp byte [eax + 8], 4
push esi
mov ecx, ebx
jne 0x44362a
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x880]
call fcn.004319e0
add esp, 0x18
mov edx, eax
lea ecx, [ebp - 0x898]
call fcn.00426e60
lea ecx, [ebp - 0x880]
mov byte [ebp - 0x865], al
call fcn.00403820
jmp 0x4436a3
call fcn.0044ac20
cmp byte [eax + 8], 1
jne 0x4436ac
lea ecx, [ebp - 0x888]
mov dword [ebp - 0x878], 0
call fcn.004036a0
mov edi, eax
push esi
mov ecx, ebx
mov byte [ebp - 4], 0xcd
call fcn.0044ac20
mov ecx, eax
call fcn.0044a210
push eax
mov edx, edi
lea ecx, [ebp - 0x878]
call fcn.00431be0
add esp, 4
lea ecx, [ebp - 0x888]
call fcn.00403820
lea edx, [ebp - 0x878]
lea ecx, [ebp - 0x898]
call fcn.00426e60
lea ecx, [ebp - 0x878]
mov byte [ebp - 0x865], al
call fcn.00403820
mov edi, dword [ebp - 0x87c]
cmp byte [ebp - 0x865], 0
jne 0x4436d3
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 0xc5
call fcn.00403820
inc edi
mov ecx, ebx
mov dword [ebp - 0x87c], edi
call fcn.0044a660
cmp edi, eax
jl 0x4435a0
jmp 0x443702
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 0xc5
call fcn.00403820
mov al, byte [ebp - 0x865]
jmp 0x4436fa
mov edx, reloc.kernel32.dll_PowerCreateRequest
lea ecx, [ebp - 0x898]
call fcn.00426eb0
test al, al
jne 0x4437ed
push str.St_tu__code_w___not_in_the_accepted__tatu__code_li_t_so_we_con_ider_this____a_6_d_re_ponse
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xce
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xd0
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd1
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xc5
call fcn.00403820
push dword [ebp - 0x82c]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x88d], 0
je 0x4437b1
push dword [ebp - 0x88c]
call esi
push dword [ebp - 0x898]
lea ecx, [ebp - 0x9c8]
call fcn.00429b40
mov byte [ebp - 4], 0xd2
push dword [eax]
call fcn.004b64f0
mov ecx, dword [ebp - 0x8b8]
add esp, 4
mov edx, eax
call fcn.0043ed90
lea ecx, [ebp - 0x9c8]
call fcn.00429b60
jmp 0x44517b
push str._tatus_code_w_s_in_the_accepted_statu__code_1ist_so_we_con_ider_this_a__a_good_re_pon_e
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd3
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xd5
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd6
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xc5
call fcn.00403820
mov ebx, dword [ebp - 0x82c]
push ecx
lea eax, [ebp - 0x874]
push eax
push ecx
mov ecx, ebx
mov dword [ebp - 0x874], 0
call fcn.00440a80
add esp, 0xc
lea ecx, [ebp - 0x86c]
mov dword [ebp - 0x86c], 0
call fcn.004036a0
mov byte [ebp - 4], 0xd7
mov eax, dword [ebp - 0x874]
test eax, eax
je 0x443b06
push eax
call fcn.004b3d60
mov esi, eax
add esp, 4
test esi, esi
je 0x443b06
push str.Wininet.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x44393b
push str.HttpQueryInfo_fai1ed_when_querying_raw_he_der_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xd8
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xda
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xdb
jmp 0x44399d
push str.HttpQueryInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4439e1
push str.HttpQuery1nfo_failed_when_querying_r_w_he_ders
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xdc
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xde
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xdf
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xd7
call fcn.00403820
jmp 0x4439f2
push 0
lea ecx, [ebp - 0x874]
push ecx
push esi
push reloc.kernel32.dll_OpenEventW
push ebx
call eax
mov edi, eax
push esi
lea ecx, [ebp - 0x880]
call fcn.00436740
push eax
lea ecx, [ebp - 0x86c]
mov byte [ebp - 4], 0xe0
call fcn.00403840
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xd7
call fcn.00403820
push esi
call fcn.004b4e1b
add esp, 4
lea ecx, [ebp - 0x878]
test edi, edi
je 0x443a7c
push str.HttpQuery1nfo_w_s__ucces_ful_when_querying_r_w_header_
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xe1
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xe3
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xe4
push 0
jmp 0x443ac6
push str.HttpQuery1nfo_f_iled_when_querying_raw_he_der_
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xe5
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xe7
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xe8
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xd7
call fcn.00403820
cmp byte [ebp - 0x8bd], 0
je 0x443e79
push 0
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x84c], 0
call fcn.00449c30
mov edx, reloc.kernel32.dll_GetProcessIoCounters
lea ecx, [ebp - 0x898]
mov byte [ebp - 4], 0xe9
call fcn.00426fb0
test al, al
je 0x443bae
mov edx, reloc.kernel32.dll_GetProcessIoCounters
lea ecx, [ebp - 0x898]
call fcn.00426fb0
test al, al
je 0x443bae
mov edx, reloc.kernel32.dll_GetProcessIoCounters
lea ecx, [ebp - 0x898]
call fcn.00426fb0
test al, al
je 0x443bae
mov edx, reloc.kernel32.dll_GetProcessIoCounters
lea ecx, [ebp - 0x898]
call fcn.00426fb0
test al, al
je 0x443bae
mov ecx, dword [ebp - 0x8b8]
lea eax, [ebp - 0x858]
push eax
call fcn.00449de0
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x8c8], 1
mov byte [ebp - 4], 0xd7
call fcn.00449f60
jmp 0x445170
lea ecx, [ebp - 0x88c]
mov dword [ebp - 0x88c], 0
call fcn.004036a0
lea eax, [ebp - 0x86c]
mov byte [ebp - 4], 0xea
push eax
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x870], 0
call fcn.004036c0
lea ecx, [ebp - 0x870]
mov byte [ebp - 4], 0xeb
call fcn.00426b50
push 0
push str.location:
lea ecx, [ebp - 0x870]
call fcn.00426b10
mov esi, eax
cmp esi, 0xffffffff
je 0x443e33
push esi
push reloc.kernel32.dll_CreateFileMappingW
lea ecx, [ebp - 0x870]
call fcn.00426b10
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x870]
call fcn.004314b0
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 0xec
call fcn.00403840
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xeb
call fcn.00403820
push 0
push str.http
lea ecx, [ebp - 0x88c]
call fcn.00426b10
mov ecx, eax
cmp ecx, 0xffffffff
je 0x443e33
mov eax, dword [ebp - 0x88c]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x88c]
call fcn.00426bb0
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], 0xed
call fcn.00403840
lea ecx, [ebp - 0x880]
call fcn.00403820
mov eax, dword [ebp - 0x840]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x83c], 0
mov byte [ebp - 0x848], 1
lea eax, [ebp - 0x848]
push eax
push ecx
push str.urlRedirected
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xee
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x848]
mov byte [ebp - 4], 0xeb
call fcn.00449f60
lea edx, [ebp - 0x834]
lea ecx, [ebp - 0x928]
call fcn.00431ab0
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xef
call fcn.00449d70
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.requestUrl
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xf0
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xef
call fcn.00449f60
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], 0xeb
call fcn.004012b0
lea edx, [ebp - 0x88c]
lea ecx, [ebp - 0x940]
call fcn.00431ab0
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xf1
call fcn.00449d70
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.redirectUrl
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xf2
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], 0xf1
call fcn.00449f60
mov byte [ebp - 4], 0xeb
lea ecx, [ebp - 0x940]
call fcn.004012b0
push 0
lea ecx, [ebp - 0x898]
call fcn.0040c7d0
push eax
call fcn.004b794b
mov ecx, dword [ebp - 0x840]
and ecx, 0xffffff01
or ecx, 1
add esp, 4
mov dword [ebp - 0x840], ecx
mov dword [ebp - 0x83c], 0
mov dword [ebp - 0x848], eax
lea eax, [ebp - 0x848]
push eax
push ecx
push str.statusCode
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xf3
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x848]
mov byte [ebp - 4], 0xeb
call fcn.00449f60
mov ecx, dword [ebp - 0x8b8]
lea eax, [ebp - 0x858]
push eax
call fcn.00449de0
lea ecx, [ebp - 0x870]
mov dword [ebp - 0x8c8], 1
call fcn.00403820
lea ecx, [ebp - 0x88c]
call fcn.00403820
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], 0xd7
call fcn.00449f60
jmp 0x445170
push str._t_rting_to_re_d_the_response
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xf4
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xf6
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xf7
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x844]
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x83c], 0
call fcn.004452a0
mov byte [ebp - 4], 0xf8
mov dword [ebp - 0x85c], 0
lea esp, [esp]
mov esi, dword [ebp - 0x840]
sub esi, dword [ebp - 0x844]
lea ecx, [ebp - 0x844]
lea eax, [esi + 0x400]
push eax
call fcn.004367a0
mov eax, dword [ebp - 0x844]
lea ecx, [ebp - 0x85c]
push ecx
add eax, esi
push ecx
push eax
mov dword [ebp - 0x85c], 0
call fcn.0040ca40
mov edx, ebx
mov ecx, eax
call fcn.004501c0
test eax, eax
je 0x44508f
mov eax, dword [ebp - 0x85c]
add eax, esi
push eax
lea ecx, [ebp - 0x844]
call fcn.004367a0
cmp dword [ebp - 0x85c], 0
jne 0x443f40
push str.Fini_hed_re_ding_the_response__1ength:
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xfe
call fcn.004036e0
lea ecx, [ebp - 0x8a4]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x888]
mov dword [ebp - 4], 0x100
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x840]
mov esi, dword [ebp - 0x844]
sub ecx, esi
mov dword [ebp - 0x8c4], ecx
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
call fcn.00431be0
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 2
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
mov dword [ebp - 4], 0xff
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], 0xf8
call fcn.00403820
push 0x400
lea eax, [ebp - 0x81f]
push 0
push eax
mov byte [ebp - 0x820], 0
call fcn.004b9070
add esp, 0xc
mov dword [ebp - 0x860], 0x400
push str.Wininet.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x444105
push str.HttpQueryInfo_fai1ed_when_querying_raw_he_der_
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov dword [ebp - 4], 0x103
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 5
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 6
jmp 0x44416c
push str.HttpQueryInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
jne 0x4441b1
push str.HttpQueryInfo_fai1ed_when_querying_raw_he_ders
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov dword [ebp - 4], 0x107
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 9
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], 0xa
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], 0xf8
call fcn.00403820
push 0
lea eax, [ebp - 0x860]
push eax
lea eax, [ebp - 0x820]
push eax
push reloc.kernel32.dll_lstrcpynW
push ebx
call edi
test eax, eax
je 0x4444c3
mov eax, dword [0x530408]
imul eax, eax
cdq
mov ecx, reloc.kernel32.dll_ConvertDefaultLocale
idiv ecx
cmp edx, 8
jne 0x444205
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x530408]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x530408], ecx
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0
call fcn.00436740
mov edx, str.gzip
lea ecx, [ebp - 0x82c]
mov dword [ebp - 4], 0x10b
call fcn.00426eb0
test al, al
je 0x4444b1
push str.gzip_decompre_sion_is_needed
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_AssignProcessToJobObject
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseActCtx
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_UnmapViewOfFile
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
call fcn.00403820
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
call fcn.004452a0
lea eax, [ebp - 0x854]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
mov edx, dword [ebp - 0x8c4]
push eax
mov ecx, esi
call fcn.0043e780
add esp, 4
lea ecx, [ebp - 0x878]
test eax, eax
jne 0x444404
push str.gzip_decompre_sion_f_i1ed
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetDiskFreeSpaceA
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_OpenSemaphoreW
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_SetConsoleCursorPosition
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
cmp byte [ebp - 0x88d], 0
je 0x4443c2
push dword [ebp - 0x88c]
call esi
push str.gzip_decompressing_error
lea ecx, [ebp - 0x880]
call fcn.00403790
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleOutputCP
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x854]
call fcn.00427000
lea ecx, [ebp - 0x82c]
jmp 0x445160
push str.gzip_decompression_w_s_comp1eted_succes_fu11y
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_OpenEventW
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_IsProcessInJob
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateDirectoryW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetUserDefaultLangID
call fcn.00403820
lea eax, [ebp - 0x854]
push eax
lea ecx, [ebp - 0x844]
call fcn.004452c0
lea ecx, [ebp - 0x854]
call fcn.00427000
mov esi, dword [ebp - 0x844]
lea ecx, [ebp - 0x82c]
mov dword [ebp - 4], 0xf8
call fcn.00403820
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call edi
cmp byte [ebp - 0x88d], 0
je 0x4444dd
push dword [ebp - 0x88c]
call edi
mov edi, dword [ebp - 0x870]
xor bl, bl
push str.responseType
mov ecx, edi
mov byte [ebp - 0x865], 0
mov dword [ebp - 0x884], ebx
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x444589
push str.responseType
mov ecx, edi
mov dword [ebp - 0x82c], 0
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x82c]
call fcn.004319e0
add esp, 0x18
mov edx, str.base64
lea ecx, [ebp - 0x82c]
call fcn.00426eb0
test al, al
je 0x44455b
mov byte [ebp - 0x865], 1
jmp 0x44457e
mov edx, str.binary
lea ecx, [ebp - 0x82c]
call fcn.00426eb0
movzx ebx, bl
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x884], ebx
lea ecx, [ebp - 0x82c]
call fcn.00403820
lea ecx, [ebp - 0x88c]
mov dword [ebp - 0x88c], 0
call fcn.004036a0
mov dword [ebp - 4], 0x11a
cmp byte [ebp - 0x865], 0
je 0x44476e
push str.Attempting_to_convert_the_re_ponse_to_b__e64
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_QueryDosDeviceW
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_lstrcpynW
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CopyFileA
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
mov eax, dword [ebp - 0x840]
sub eax, esi
push eax
mov edx, esi
lea ecx, [ebp - 0x8a4]
call fcn.0042a110
add esp, 4
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], reloc.kernel32.dll_ReadProcessMemory
call fcn.00403840
lea ecx, [ebp - 0x8a4]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
lea ecx, [ebp - 0x8c4]
call fcn.00433d50
mov edx, eax
lea ecx, [ebp - 0x88c]
call fcn.00426e60
lea ecx, [ebp - 0x8c4]
mov bl, al
call fcn.00403820
test bl, bl
je 0x4448a9
push str.F_iled_to_convert_the_respon_e_to_ba_e64
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetStringTypeA
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_WaitForSingleObjectEx
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateNamedPipeA
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
push str.Base64_encdng_error
lea ecx, [ebp - 0x8a4]
call fcn.00403790
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryA
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x88c]
jmp 0x445160
test bl, bl
je 0x44480b
push str.Re_pon_e_is_bin_ry
lea ecx, [ebp - 0x878]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetComputerNameExA
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x878]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_FormatMessageA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileA
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x878]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
jmp 0x4448af
mov eax, dword [ebp - 0x840]
mov ecx, eax
sub ecx, esi
mov dword [ebp - 0x880], ecx
cmp byte [ecx + esi - 1], 0
je 0x444847
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0x844]
call fcn.004367a0
mov eax, dword [ebp - 0x880]
mov esi, dword [ebp - 0x844]
mov byte [eax + esi], 0
mov eax, dword [ebp - 0x840]
sub eax, esi
cmp eax, 3
jbe 0x44487c
cmp byte [esi], 0xef
jne 0x44487c
cmp byte [esi + 1], 0xbb
jne 0x44487c
cmp byte [esi + 2], 0xbf
jne 0x44487c
lea eax, [esi + 3]
push eax
push esi
lea eax, [ebp - 0x880]
push eax
lea ecx, [ebp - 0x844]
call fcn.00436820
mov esi, dword [ebp - 0x844]
push esi
lea ecx, [ebp - 0x880]
call fcn.00403790
push eax
lea ecx, [ebp - 0x88c]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileAttributesW
call fcn.00403840
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
jmp 0x4448af
mov ebx, dword [ebp - 0x884]
push str.outputFile
mov ecx, edi
mov byte [ebp - 0x865], 0
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x444c69
push str.outputFile
mov ecx, edi
mov dword [ebp - 0x82c], 0
call fcn.0044ac20
mov ecx, eax
call fcn.0044a0b0
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401250
lea ecx, [ebp - 0x82c]
call fcn.004319e0
add esp, 0x18
push str.Writing_to_output_file:
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_LocalReAlloc
call fcn.004036e0
lea ecx, [ebp - 0x8a4]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x888]
mov byte [ebp - 4], reloc.kernel32.dll_GetShortPathNameA
call fcn.00431c80
add esp, 4
lea ecx, [ebp - 0x82c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileAttributesExW
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetTimeFormatW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x8a4]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_AddVectoredExceptionHandler
call fcn.00403820
mov eax, dword [ebp - 0x82c]
cmp dword [eax - 0xc], 0
je 0x444c5a
test bl, bl
je 0x444b17
push reloc.kernel32.dll_GetTempFileNameW
push eax
lea eax, [ebp - 0x870]
push eax
mov dword [ebp - 0x870], 0
call fcn.004b797d
add esp, 0xc
test eax, eax
jne 0x444ac4
cmp dword [ebp - 0x870], eax
je 0x444ac4
push str.Opened_bin_ry_stre_m
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetVolumePathNamesForVolumeNameA
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_PowerCreateRequest
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetProcessIoCounters
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
push dword [ebp - 0x870]
mov eax, dword [ebp - 0x840]
sub eax, esi
push eax
push 1
push esi
call fcn.004b7be3
push dword [ebp - 0x870]
call fcn.004b6a34
add esp, 0x14
mov byte [ebp - 0x865], 1
jmp 0x444c5a
push str.F_iled_to_open_6inary__tream
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_VerSetConditionMask
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_CreateActCtxW
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExW
jmp 0x444c1c
push ecx
lea eax, [ebp - 0x88c]
mov ecx, esp
push eax
call fcn.004036c0
lea ecx, [ebp - 0x82c]
call fcn.004350a0
add esp, 4
lea ecx, [ebp - 0x87c]
test al, al
je 0x444bd4
push str.Wrote_text_fi1e
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetConsoleScreenBufferInfo
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_CreateFileMappingA
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_SetDllDirectoryW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
mov byte [ebp - 0x865], 1
jmp 0x444c5a
push str.F_iled_to_write_text_file
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToTzSpecificLocalTime
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_DosDateTimeToFileTime
call fcn.00431c80
add esp, 4
mov byte [ebp - 4], reloc.kernel32.dll_ResumeThread
push 2
mov edx, eax
lea ecx, [ebp - 0x884]
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
call fcn.00403820
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
push str.Creating_respon_e_J_ON_and_exiting
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_RemoveDirectoryW
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_SetFileTime
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_MoveFileW
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00403820
push 0
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x84c], 0
call fcn.00449c30
mov eax, dword [ebp - 0x8d0]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x8d0], eax
mov dword [ebp - 0x8cc], 0
mov byte [ebp - 0x8d8], 1
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.result
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentDirectoryW
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.00449f60
lea edx, [ebp - 0x88c]
mov ecx, edx
call fcn.00433090
lea edx, [ebp - 0x88c]
lea ecx, [ebp - 0x940]
call fcn.00431ab0
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
call fcn.00449d70
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.content
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_SuspendThread
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
mov byte [ebp - 4], reloc.kernel32.dll_MapViewOfFile
lea ecx, [ebp - 0x8d8]
call fcn.00449f60
lea ecx, [ebp - 0x940]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.004012b0
lea edx, [ebp - 0x86c]
lea ecx, [ebp - 0x928]
call fcn.00431ab0
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
call fcn.00449d70
push ecx
push str.additionalInfo
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFile
call fcn.0044aa00
lea ecx, [ebp - 0x8d8]
push ecx
push ecx
push str.headers
mov ecx, eax
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_AcquireSRWLockShared
call fcn.00449f60
lea ecx, [ebp - 0x928]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.004012b0
lea edx, [ebp - 0x898]
lea ecx, [ebp - 0x8f8]
call fcn.00431ab0
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
call fcn.00449d70
push ecx
push str.additionalInfo
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_GetFinalPathNameByHandleW
call fcn.0044aa00
lea ecx, [ebp - 0x8d8]
push ecx
push ecx
push str.httpCode
mov ecx, eax
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_GetFileInformationByHandle
call fcn.00449f60
lea ecx, [ebp - 0x8f8]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.004012b0
push str.empty
lea ecx, [ebp - 0x910]
call fcn.00401250
push eax
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFileEx
call fcn.00449d70
lea eax, [ebp - 0x8d8]
push eax
push ecx
push str.noData
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_FindFirstFileExA
call fcn.0044aa00
mov ecx, eax
call fcn.0044a020
mov byte [ebp - 4], reloc.kernel32.dll_UnlockFileEx
lea ecx, [ebp - 0x8d8]
call fcn.00449f60
lea ecx, [ebp - 0x910]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.004012b0
push str.outputFile
mov ecx, edi
call fcn.0044ac20
cmp byte [eax + 8], 4
jne 0x444fc9
mov eax, dword [ebp - 0x8d0]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x8d0], eax
mov al, byte [ebp - 0x865]
mov dword [ebp - 0x8cc], 0
mov byte [ebp - 0x8d8], al
push str.outputFi
lea ecx, [ebp - 0x8f8]
mov byte [ebp - 4], reloc.kernel32.dll_FlushViewOfFile
call fcn.00401250
push str.leResult
mov edx, eax
lea ecx, [ebp - 0x910]
mov byte [ebp - 4], reloc.kernel32.dll_SystemTimeToFileTime
call fcn.00445400
add esp, 4
lea ecx, [ebp - 0x8d8]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x858]
mov byte [ebp - 4], reloc.kernel32.dll_ReleaseSRWLockExclusive
call fcn.0044acc0
add esp, 4
mov ecx, eax
call fcn.0044a020
lea ecx, [ebp - 0x910]
call fcn.004012b0
lea ecx, [ebp - 0x8f8]
call fcn.004012b0
lea ecx, [ebp - 0x8d8]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.00449f60
push str.Done
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpRequest
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetEnvironmentStrings
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], reloc.kernel32.dll_CloseThreadpoolTimer
call fcn.00431c80
add esp, 4
push 0
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], reloc.kernel32.dll_GetCurrentThread
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], reloc.kernel32.dll_FillConsoleOutputAttribute
call fcn.00403820
mov ecx, dword [ebp - 0x8b8]
lea eax, [ebp - 0x858]
push eax
call fcn.00449de0
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x8c8], 1
mov byte [ebp - 4], reloc.kernel32.dll_GetSystemPowerStatus
call fcn.00449f60
lea ecx, [ebp - 0x88c]
jmp 0x445160
push str.InternetReadFile_fai1ed_when_trying_to_read_the_re_ponse
lea ecx, [ebp - 0x87c]
call fcn.00403790
push str.HttpReque_t
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], 0xf9
call fcn.004036e0
lea ecx, [ebp - 0x888]
call fcn.004036a0
lea ecx, [ebp - 0x87c]
push ecx
mov edx, eax
lea ecx, [ebp - 0x880]
mov byte [ebp - 4], 0xfb
call fcn.00431c80
add esp, 4
push 2
mov edx, eax
lea ecx, [ebp - 0x884]
mov byte [ebp - 4], 0xfc
call fcn.0040c920
add esp, 4
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x888]
call fcn.00403820
lea ecx, [ebp - 0x884]
call fcn.00403820
lea ecx, [ebp - 0x87c]
mov byte [ebp - 4], 0xf8
call fcn.00403820
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebx
call esi
cmp byte [ebp - 0x88d], 0
je 0x445139
push dword [ebp - 0x88c]
call esi
push str.InternetReadFile_Failed
lea ecx, [ebp - 0x880]
call fcn.00403790
mov byte [ebp - 4], 0xfd
mov ecx, dword [ebp - 0x8b8]
mov edx, eax
call fcn.0043ec40
lea ecx, [ebp - 0x880]
call fcn.00403820
lea ecx, [ebp - 0x844]
call fcn.00427000
lea ecx, [ebp - 0x86c]
call fcn.00403820
lea ecx, [ebp - 0x898]
call fcn.00403820
lea ecx, [ebp - 0x830]
call fcn.00403820
lea ecx, [ebp - 0x894]
call fcn.00403820
lea ecx, [ebp - 0x8bc]
call fcn.00403820
lea ecx, [ebp - 0x8a8]
call fcn.00403820
lea ecx, [ebp - 0x8ac]
call fcn.00403820
lea ecx, [ebp - 0x8b0]
call fcn.00403820
lea ecx, [ebp - 0x89c]
call fcn.00403820
lea ecx, [ebp - 0x834]
call fcn.00403820
lea ecx, [ebp - 0x8b4]
call fcn.00403820
lea ecx, [ebp - 0x8a0]
call fcn.00403820
mov eax, dword [ebp - 0x8b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b4591
mov esp, ebp
pop ebp
ret