Function at 0x41bfe0
Capabilities:
Create thread
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c62ee
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x51eee0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [0x520340]
imul eax, eax
cdq
mov ecx, 0x18
idiv ecx
mov edi, dword [ebp + 8]
cmp edx, 2
jne 0x41c03c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
lea ecx, [ebp - 0x84]
call fcn.00442860
mov dword [ebp - 4], 0
push str.success
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00442820
push 0x4d968c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 2
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 1
call fcn.00442a70
push str.type
mov ecx, edi
call fcn.00442de0
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004435b0
lea eax, [ebp - 0x5c]
push eax
call fcn.0044ee90
add esp, 0x1c
push str.callbackId
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.00443e00
test al, al
jne 0x41c558
mov eax, dword [ebp - 0x5c]
mov ecx, str.sync
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c0f6
test dx, dx
je 0x41c0f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c0f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c0d0
xor eax, eax
jmp 0x41c0fb
sbb eax, eax
or eax, 1
test eax, eax
setne al
test al, al
je 0x41c1be
push str.webRequest_callbackId_not_exist
lea ecx, [ebp - 0x54]
call fcn.00401ff0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 4
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41c172
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 3
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41c195
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c1b5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
jmp 0x41c79f
push 0x4d97f4
mov ecx, edi
call fcn.00442de0
sub esp, 0x18
mov ecx, eax
push esp
call fcn.004435b0
lea eax, [ebp - 0x60]
push eax
call fcn.0044ee90
add esp, 0x1c
push str.isResponse
mov ecx, edi
mov byte [ebp - 4], 0xd
call fcn.00443e00
test al, al
je 0x41c443
push str.isResponse
mov ecx, edi
call fcn.00442de0
mov ecx, eax
call fcn.00443370
test al, al
je 0x41c443
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0xe
call fcn.00435e40
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 0xf
call fcn.00433650
mov ecx, dword [eax]
xor eax, eax
add esp, 4
test ecx, ecx
setne al
test eax, eax
jne 0x41c266
push 0x80004005
call fcn.00404480
mov eax, dword [ebp - 0x58]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c296
test dx, dx
je 0x41c292
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c296
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c270
xor eax, eax
jmp 0x41c29b
sbb eax, eax
or eax, 1
mov edx, dword [ebp - 0x50]
test eax, eax
sete bl
add edx, 0xfffffff0
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41c2bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x41c3a1
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x50]
push str.webRequest_HttpRequest_
push eax
call fcn.0040b800
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x10
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x11
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x12
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x11
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41c339
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xf
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c359
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c379
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c399
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x60]
jmp 0x41c6e2
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x13
call fcn.00442780
push str.content
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x14
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x13
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41c3fa
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c41a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c52f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41c52f
call fcn.00417bf0
test al, al
jne 0x41c490
mov esi, dword [0x520340]
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x141]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a5340
add esp, 4
push eax
call fcn.004a7190
add esp, 4
lea eax, [ebp - 0x60]
push eax
call fcn.00438fa0
add esp, 4
test al, al
jne 0x41c52c
push str.webRequest_HttpWithNoResponseRequest_error
lea ecx, [ebp - 0x50]
call fcn.00401ff0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x15
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x16
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0x17
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x16
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41c50e
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0xd
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jmp 0x41c38f
or edi, 0xffffffff
mov edx, dword [ebp - 0x60]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c704
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41c704
push 0x10
call fcn.004a5bed
mov esi, eax
add esp, 4
mov dword [ebp - 0x50], esi
mov byte [ebp - 4], 7
test esi, esi
je 0x41c57a
push 0
mov ecx, esi
call fcn.00442860
jmp 0x41c57c
xor esi, esi
push edi
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00442b10
lea eax, [ebp - 0x54]
push eax
push 0
push esi
push 0x40c3f0
push 0
push 0
mov dword [ebp - 0x54], 0
call fcn.004a7e9c
add esp, 0x18
test eax, eax
jne 0x41c6fa
test esi, esi
je 0x41c5c3
mov ecx, esi
call fcn.00442a70
push esi
call fcn.004a5bbe
add esp, 4
call fcn.004a76e6
push dword [eax]
lea eax, [ebp - 0x58]
push eax
call fcn.0043e100
add esp, 8
push eax
lea eax, [ebp - 0x50]
push str.webRequest_beginthreadex_
push eax
mov byte [ebp - 4], 8
call fcn.0040b800
add esp, 0xc
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 4], 0xa
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41c60f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [0x520340]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 8
jne 0x41c686
mov eax, 0x4ec4ec4f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x68
mov eax, esi
sub eax, ecx
xor ebx, ebx
cmp eax, 0x1d
je 0x41c680
lea ecx, [ecx]
mov eax, esi
or eax, 0xffffff36
add esi, eax
mov eax, esi
imul eax, esi
inc ebx
cmp ebx, eax
jg 0x41c680
mov eax, 0x4ec4ec4f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x68
mov eax, esi
sub eax, ecx
cmp eax, 0x1d
jne 0x41c650
mov dword [0x520340], ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.0044ef60
add esp, 8
push eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xb
call fcn.00442780
push 0x4d968c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xc
call fcn.00442d00
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.00442b10
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xb
call fcn.00442a70
cmp dword [ebp - 0x18], 0x10
jb 0x41c6df
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jmp 0x41c18b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or edi, 0xffffffff
mov edx, dword [ebp - 0x5c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c798
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41c798
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x4c]
call fcn.004449b0
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov byte [ebp - 4], 0x1c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0x1d
call fcn.00417bc0
test al, al
jne 0x41c830
mov esi, dword [0x520340]
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
xor ebx, ebx
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, esi
sub eax, ecx
cmp eax, 0xeb
je 0x41c82a
mov eax, esi
or eax, 0xffffff55
add esi, eax
mov eax, esi
imul eax, esi
inc ebx
cmp ebx, eax
jg 0x41c82a
mov eax, 0x2aaaaaab
imul esi
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
shl ecx, 3
mov eax, esi
sub eax, ecx
cmp eax, 0xeb
jne 0x41c7f5
mov dword [0x520340], ebx
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x4c]
call fcn.004478c0
mov edx, eax
cmp dword [edx + 0x14], 0x10
mov byte [ebp - 4], 0x1e
jb 0x41c851
mov edx, dword [edx]
sub esp, 0x18
mov esi, esp
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], 0
mov byte [esi], 0
cmp byte [edx], 0
jne 0x41c870
xor ecx, ecx
jmp 0x41c87e
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x41c875
sub ecx, ebx
push ecx
push edx
mov ecx, esi
call fcn.00401460
lea eax, [ebp - 0x54]
push eax
call fcn.0044ee90
add esp, 0x1c
push eax
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1f
call fcn.00402af0
mov edx, dword [ebp - 0x54]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x1e
lea eax, [edx + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41c8c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x18], 0x10
mov byte [ebp - 4], 0x1d
jb 0x41c8d5
push dword [ebp - 0x2c]
call fcn.004a5bbe
add esp, 4
mov ebx, dword [ebp - 0x74]
mov esi, dword [ebp - 0x50]
mov eax, 8
mov word [ebx], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x41c8f6
call fcn.0040c2e0
add esi, 0xfffffff0
mov dword [ebx + 8], eax
mov byte [ebp - 4], 0x1c
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x41c914
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0x10
mov byte [ebp - 4], 0
mov dword [ebp - 0x4c], 0x4d9684
jb 0x41c930
push dword [ebp - 0x48]
call fcn.004a5bbe
add esp, 4
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
call fcn.00444ab0
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], 0xffffffff
call fcn.00442a70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004a63c4
mov esp, ebp
pop ebp
ret