Function at 0x403ed0
Capabilities:
Check http status code
Check if file exists
Create http request
Download and write a file
Query or enumerate registry value
Read data from internet
Receive and write data from server to client
Receive data
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x142c
call fcn.0041d4e0
mov eax, dword [0x427004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, ecx
mov dword [ebp - 0x1414], eax
lea eax, [ebp - 0x1408]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
mov dword [ebp - 0x1418], 4
mov dword [ebp - 0x1428], 0x400
mov dword [ebp - 0x140c], 0
mov dword [ebp - 0x1408], 0
mov dword [ebp - 0x1424], 4
mov dword [ebp - 0x1420], 4
mov dword [ebp - 0x1410], 0xa00
call edi
lea eax, [ebp - 0x1420]
push eax
push 0x42b248
lea eax, [ebp - 0x1424]
push eax
push 0
push str.SecureProtocols
push dword [ebp - 0x1408]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
lea eax, [ebp - 0x1410]
push eax
push 4
push 0
push str.SecureProtocols
push dword [ebp - 0x1408]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x1408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
lea eax, [ebp - 0x1428]
push 0x2000000
push eax
lea eax, [ebp - 0x404]
push eax
push 0x42b258
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
push 0
push 0x84000c00
push 0
push 0
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov ebx, eax
push 0
lea eax, [ebp - 0x1418]
mov dword [ebp - 0x1408], ebx
push eax
lea eax, [ebp - 0x142c]
push eax
push 0x20000013
push ebx
call esi
test eax, eax
je 0x4042ee
cmp dword [ebp - 0x1418], 4
jne 0x40403a
cmp dword [ebp - 0x142c], 0xc8
jne 0x4042ee
push 0
lea eax, [ebp - 0x140c]
push eax
push 0
push 0x16
push ebx
call esi
mov eax, dword [ebp - 0x140c]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push 0
mov esi, eax
lea eax, [ebp - 0x140c]
push eax
push esi
push 0x16
push ebx
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x4042ee
mov eax, dword [ebp - 0x140c]
push 0x425514
push esi
mov byte [esi + eax], 0
call fcn.0040f929
add esp, 8
test eax, eax
je 0x404122
push str.filename_
push esi
call fcn.0040f929
mov edi, eax
add esp, 8
test edi, edi
je 0x404122
add edi, 0xa
push 0x425514
push edi
call fcn.0040f929
add esp, 8
mov dword [ebp - 0x1410], eax
test eax, eax
je 0x404139
cmp eax, edi
jbe 0x404139
mov esi, edi
lea ecx, [esi + 1]
nop
mov al, byte [esi]
inc esi
test al, al
jne 0x4040d0
sub esi, ecx
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x1410]
sub eax, edi
push eax
push edi
push esi
push ebx
call fcn.0040f90c
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0x10
test eax, eax
je 0x404105
push ebx
call esi
push 0x104
push ebx
push 0x104
push 0x42c058
call fcn.00406dce
add esp, 0x10
push ebx
call esi
jmp 0x404139
push 0x4250b5
push 0x104
push 0x42c058
call fcn.00406e4e
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0xffffffffffffffff
push 0x42c058
push 0
push 0xfde9
call ebx
mov esi, eax
lea ecx, [esi + esi]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push 0x42c058
push 0
push 0xfde9
call ebx
push edi
push dword [ebp - 0x1414]
mov dword [0x42d420], edi
push str._ls_ls
push 0x104
push 0x42be40
call fcn.00401f30
add esp, 0x14
push 0x42be40
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [0x42ae38], eax
test eax, eax
jne 0x4042d8
push eax
push 0x80
push 2
push eax
push 3
push 0x40000000
push 0x42be40
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x404250
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0x141c]
push eax
push 0x1000
lea eax, [ebp - 0x1404]
push eax
push dword [ebp - 0x1408]
call ebx
test eax, eax
je 0x404249
nop dword [eax + eax]
mov esi, dword [ebp - 0x141c]
test esi, esi
je 0x40427e
push 0
lea eax, [ebp - 0x1414]
push eax
push esi
lea eax, [ebp - 0x1404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, dword [ebp - 0x1414]
jne 0x404249
lea eax, [ebp - 0x141c]
push eax
push 0x1000
lea eax, [ebp - 0x1404]
push eax
push dword [ebp - 0x1408]
call ebx
test eax, eax
jne 0x404200
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1408]
mov dword [ebp - 0x1408], 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call eax
jmp 0x404312
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1408]
mov dword [ebp - 0x1408], 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0x42b248
push 4
push 0
push str.SecureProtocols
push dword [ebp - 0x1408]
call eax
push dword [ebp - 0x1408]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404bab
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1408]
mov dword [ebp - 0x1408], 0
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocStringLen
call edi
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0x42b248
push 4
push 0
push str.SecureProtocols
push dword [ebp - 0x1408]
call eax
push dword [ebp - 0x1408]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404bab
mov esp, ebp
pop ebp
ret