Function at 0x415cd0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a01a0
mov eax, dword fs:[0]
push eax
sub esp, 0x84
push ebx
push esi
push edi
mov eax, dword [0x4b93f8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x40], 1
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], 0
mov dword [ebp - 0x64], 0
push 0x17
push 0
push str.MSXML2.XMLHTTP
lea ecx, [ebp - 0x64]
call fcn.0040fcb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.00407480
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.http:__dat.ruanmei.com_pcmaster_rmup.xml_a_d
lea eax, [ebp - 0x3c]
push eax
call fcn.0041ad10
add esp, 0xc
xor edi, edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x38], edi
push edi
push edi
push edi
push 1
push edi
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0x5c], esi
test esi, esi
je 0x415e2a
mov dword [ebp - 0x58], edi
push 4
lea eax, [ebp - 0x58]
push eax
push 2
push esi
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push edi
push 0x102
push edi
push edi
push dword [ebp - 0x3c]
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x2c], eax
test eax, eax
je 0x415e23
push 0x100000
call fcn.00448f65
mov esi, eax
mov dword [ebp - 0x60], esi
push 0x100000
push edi
push esi
call fcn.0044c180
add esp, 0x10
lea eax, [ebp - 0x38]
push eax
push 0x100000
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x415e0a
mov dword [ebp - 0x30], eax
lea esi, [eax + 1]
push esi
call fcn.00448f65
mov edi, eax
mov dword [ebp - 0x34], edi
push esi
push 0
push edi
call fcn.0044c180
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x60]
push esi
push edi
call fcn.0044bc00
add esp, 0x1c
test esi, esi
je 0x415e17
push esi
call fcn.00448f6e
add esp, 4
push dword [ebp - 0x2c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [ebp - 0x5c]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [ebp - 4], 1
jmp 0x415e46
test edi, edi
je 0x4165bd
mov ecx, ebx
call fcn.00431200
mov dword [ebx + 0x550], 1
push dword [ebp - 0x30]
push edi
lea ecx, [ebx + 0x53c]
call fcn.00424f80
push str.RmupSet
lea ecx, [ebx + 0x540]
call fcn.00409b20
lea ecx, [ebx + 0x53c]
call fcn.0042e810
push edi
call fcn.00448f6e
add esp, 4
mov dword [ebp - 0x34], 0
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebx + 0x548]
call fcn.00409ff0
mov ecx, eax
call fcn.0041e530
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e5b0
mov dword [ebp - 0x90], eax
xor esi, esi
mov dword [ebp - 0x1c], esi
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, eax
jge 0x4165b0
lea eax, [ebp - 0x44]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e5e0
mov eax, dword [eax]
test eax, eax
je 0x415f0d
mov eax, dword [eax]
jmp 0x415f0f
xor eax, eax
push eax
lea ecx, [ebp - 0x20]
call fcn.00403710
mov esi, dword [ebp - 0x44]
test esi, esi
je 0x415f65
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x415f5e
test esi, esi
je 0x415f5e
mov eax, dword [esi]
test eax, eax
je 0x415f3c
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x415f53
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x415f72
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push str.EUPP
lea ecx, [ebp - 0x20]
call fcn.0040ebb0
test eax, eax
jne 0x4161f4
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e530
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x415fbc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x2c]
call fcn.0040a030
mov ecx, eax
call fcn.0041e5b0
mov ebx, eax
xor edi, edi
mov dword [ebp - 0x78], edi
cmp edi, ebx
jge 0x4161d6
lea eax, [ebp - 0x48]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e5e0
mov eax, dword [eax]
test eax, eax
je 0x41600a
mov eax, dword [eax]
jmp 0x41600c
xor eax, eax
push eax
lea ecx, [ebp - 0x28]
call fcn.00403710
mov esi, dword [ebp - 0x48]
test esi, esi
je 0x41606a
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x416063
test esi, esi
je 0x416063
mov eax, dword [esi]
test eax, eax
je 0x416041
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416058
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x48], 0
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x416077
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x4c]
push eax
push edi
lea eax, [ebp - 0x74]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e650
mov eax, dword [eax]
test eax, eax
je 0x4160a7
mov eax, dword [eax]
jmp 0x4160a9
xor eax, eax
push eax
lea ecx, [ebp - 0x24]
call fcn.00403710
mov esi, dword [ebp - 0x4c]
test esi, esi
je 0x416107
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x416100
test esi, esi
je 0x416100
mov eax, dword [esi]
test eax, eax
je 0x4160de
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x4160f5
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x416114
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x4a60b8
lea eax, [ebp - 0x28]
push eax
call fcn.00409f10
add esp, 8
test al, al
je 0x41613f
push 0x4a4ecc
lea ecx, [ebp - 0x24]
call fcn.0040eb60
test eax, eax
setne byte [0x4c1111]
push 0x4a60c0
lea eax, [ebp - 0x28]
push eax
call fcn.00409f10
add esp, 8
test al, al
je 0x41616a
push 0x4a4ecc
lea ecx, [ebp - 0x24]
call fcn.0040eb60
test eax, eax
setne byte [0x4c1112]
push str.egmp
lea eax, [ebp - 0x28]
push eax
call fcn.00409f10
add esp, 8
test al, al
je 0x416195
push 0x4a4ecc
lea ecx, [ebp - 0x24]
call fcn.0040eb60
test eax, eax
setne byte [0x4c1113]
push str.egse
lea eax, [ebp - 0x28]
push eax
call fcn.00409f10
add esp, 8
test al, al
je 0x4161c0
push 0x4a4ecc
lea ecx, [ebp - 0x24]
call fcn.0040eb60
test eax, eax
setne byte [0x4c1114]
lea ecx, [ebp - 0x24]
call fcn.00409060
lea ecx, [ebp - 0x28]
call fcn.00409060
inc edi
jmp 0x415fcf
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4161e3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x416379
push str.downip
lea ecx, [ebp - 0x20]
call fcn.0040ebb0
test eax, eax
jne 0x4162ab
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e650
mov eax, dword [eax]
test eax, eax
je 0x41623b
mov eax, dword [eax]
jmp 0x41623d
xor eax, eax
push eax
mov ecx, 0x4c10dc
call fcn.00409b20
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x416295
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x41628e
test esi, esi
je 0x41628e
mov eax, dword [esi]
test eax, eax
je 0x41626c
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416283
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x416379
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x416379
push str.uppcmaster6
lea ecx, [ebp - 0x20]
call fcn.0040ebb0
test eax, eax
jne 0x416393
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e650
mov eax, dword [eax]
test eax, eax
je 0x4162f2
mov eax, dword [eax]
jmp 0x4162f4
xor eax, eax
push eax
lea ecx, [ebp - 0x58]
call fcn.00403710
mov esi, dword [ebp - 0x54]
test esi, esi
je 0x41634a
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x416343
test esi, esi
je 0x416343
mov eax, dword [esi]
test eax, eax
je 0x416321
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416338
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x416357
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x4a6108
lea eax, [ebp - 0x58]
push eax
call fcn.00409f10
add esp, 8
test al, al
setne byte [0x4c1110]
lea ecx, [ebp - 0x58]
call fcn.00409060
lea ecx, [ebp - 0x20]
call fcn.00409060
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x90]
jmp 0x415ed5
push 0x4a610c
lea ecx, [ebp - 0x20]
call fcn.0040ebb0
test eax, eax
jne 0x416473
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x84]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e650
mov eax, dword [eax]
test eax, eax
je 0x4163dd
mov eax, dword [eax]
jmp 0x4163df
xor eax, eax
push eax
lea ecx, [ebp - 0x38]
call fcn.00403710
mov esi, dword [ebp - 0x5c]
test esi, esi
je 0x416435
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x41642e
test esi, esi
je 0x41642e
mov eax, dword [esi]
test eax, eax
je 0x41640c
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416423
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x416445
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x4a6120
mov ecx, 0x4c1108
call fcn.00409b20
mov eax, dword [ebp - 0x38]
cmp dword [eax - 0xc], 0
je 0x41646b
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x4c1108
call fcn.00409a20
lea ecx, [ebp - 0x38]
jmp 0x416374
push str.hijactname
lea ecx, [ebp - 0x20]
call fcn.0040ebb0
test eax, eax
jne 0x416379
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x18]
call fcn.0040a030
mov ecx, eax
call fcn.0041e570
mov ecx, eax
call fcn.0040a010
mov ecx, eax
call fcn.0041e650
mov eax, dword [eax]
test eax, eax
je 0x4164bd
mov eax, dword [eax]
jmp 0x4164bf
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
call fcn.00403710
mov esi, dword [ebp - 0x60]
test esi, esi
je 0x416515
lea eax, [esi + 8]
push eax
call edi
test eax, eax
jne 0x41650e
test esi, esi
je 0x41650e
mov eax, dword [esi]
test eax, eax
je 0x4164ec
push eax
call ebx
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x416503
push eax
call fcn.00448f6e
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.00448f57
add esp, 8
mov dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x416525
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 0x7c
lea ecx, [ebp - 0x14]
call fcn.00432530
push 0x7c
lea ecx, [ebp - 0x14]
call fcn.004326c0
nop dword [eax]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x416374
push 0
push 0x4a6204
call fcn.0041a260
mov esi, eax
test esi, esi
jle 0x416598
push esi
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x14]
call fcn.00424f10
push eax
mov ecx, 0x4c10cc
call fcn.00436bf0
lea ecx, [ebp - 0x8c]
call fcn.00409060
lea eax, [esi + 1]
push eax
push 0
lea ecx, [ebp - 0x14]
call fcn.00410d10
jmp 0x416540
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x4c10cc
call fcn.00436c60
lea ecx, [ebp - 0x14]
call fcn.00402130
jmp 0x416540
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4165bd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x3c]
call fcn.00409060
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4165d9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret