Function at 0x4022c0
Capabilities:
Encrypt data using rc4 ksa
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ea86
mov eax, dword fs:[0]
push eax
sub esp, 0x28c
mov eax, dword [0x450040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xorps xmm0, xmm0
mov dword [ebp - 0x264], 0
xor eax, eax
mov dword [ebp - 0x260], 7
movups xmmword [ebp - 0x274], xmm0
mov word [ebp - 0x274], ax
mov dword [ebp - 4], eax
movups xmmword [ebp - 0x25c], xmm0
mov dword [ebp - 0x24c], eax
movups xmmword [ebp - 0x244], xmm0
mov dword [ebp - 0x248], 7
movups xmmword [ebp - 0x228], xmm0
mov word [ebp - 0x25c], ax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], al
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], 0xf
mov byte [ebp - 0x228], al
push 0x4420e0
push 4
mov byte [ebp - 4], 1
call fcn.0041cdfe
mov esi, eax
add esp, 8
mov dword [ebp - 0x28c], esi
test esi, esi
je 0x4027ac
mov dword [esi], 0
cmp dword [esi], 0
jne 0x4023f2
push 0
push 0
push 0
push 1
push str.WinHttpSession
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
test eax, eax
je 0x4023f2
cmp dword [ebp - 0x260], 7
lea eax, [ebp - 0x274]
cmova eax, dword [ebp - 0x274]
cmp dword [edi + 0x14], 7
jbe 0x4023da
mov edi, dword [edi]
lea ecx, [ebp - 0x25c]
push ecx
push eax
push edi
mov ecx, esi
call fcn.00403a40
mov byte [ebp - 0x275], al
jmp 0x4023f9
mov byte [ebp - 0x275], 0
mov eax, dword [esi]
test eax, eax
je 0x402406
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push 4
push esi
call fcn.0041cdc8
add esp, 8
cmp byte [ebp - 0x275], 0
je 0x4027ac
cmp dword [ebp - 0x230], 0xf
lea edx, [ebp - 0x244]
lea eax, [ebp - 0x244]
cmova edx, dword [ebp - 0x244]
add edx, dword [ebp - 0x234]
cmp dword [ebp - 0x230], 0xf
cmova eax, dword [ebp - 0x244]
xor esi, esi
mov dword [ebp - 0x27c], eax
xor edi, edi
xor eax, eax
mov dword [ebp - 0x284], esi
sub edx, dword [ebp - 0x27c]
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], edi
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x280], edx
je 0x4024d2
cmp edx, 0x7fffffff
ja 0x402925
push edx
lea ecx, [ebp - 0x298]
call fcn.004039c0
mov edi, dword [ebp - 0x280]
mov esi, dword [ebp - 0x298]
push edi
push dword [ebp - 0x27c]
mov dword [ebp - 0x284], esi
push esi
call fcn.0041e1c0
mov eax, dword [ebp - 0x290]
add esp, 0xc
add edi, esi
mov dword [ebp - 0x28c], eax
mov dword [ebp - 0x294], edi
mov byte [ebp - 4], 2
mov eax, 0x4524d8
cmp dword [0x4524ec], 0xf
push 0x100
cmova eax, dword [0x4524d8]
sub edi, esi
mov dword [ebp - 0x280], eax
lea eax, [ebp - 0x210]
push 0
push eax
mov dword [ebp - 0x27c], edi
call fcn.0041e750
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.0041e750
add esp, 0x18
xor ecx, ecx
mov eax, ecx
mov esi, dword [ebp - 0x280]
xor edx, edx
mov byte [ebp + ecx - 0x110], cl
div dword [0x4524e8]
mov al, byte [edx + esi]
mov byte [ebp + ecx - 0x210], al
inc ecx
cmp ecx, 0x100
jl 0x402522
xor esi, esi
xor edi, edi
mov dl, byte [ebp + esi - 0x110]
movzx eax, byte [ebp + esi - 0x210]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x402576
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x110]
mov byte [ebp + esi - 0x110], al
inc esi
mov byte [ebp + edi - 0x110], dl
cmp esi, 0x100
jl 0x402550
mov edi, dword [ebp - 0x27c]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x288], esi
mov esi, dword [ebp - 0x284]
mov dword [ebp - 0x280], eax
test edi, edi
je 0x402652
inc eax
and eax, 0x800000ff
jns 0x4025c7
dec eax
or eax, 0xffffff00
inc eax
mov cl, byte [ebp + eax - 0x110]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x288]
movzx edx, cl
add eax, edx
and eax, 0x800000ff
jns 0x4025ed
dec eax
or eax, 0xffffff00
inc eax
mov esi, dword [ebp - 0x27c]
mov dword [ebp - 0x288], eax
mov al, byte [ebp + eax - 0x110]
mov byte [ebp + esi - 0x110], al
mov esi, dword [ebp - 0x288]
mov eax, dword [ebp - 0x27c]
mov byte [ebp + esi - 0x110], cl
movzx eax, byte [ebp + eax - 0x110]
mov ecx, dword [ebp - 0x280]
add eax, edx
mov esi, dword [ebp - 0x284]
movzx eax, al
mov al, byte [ebp + eax - 0x110]
xor byte [ecx + esi], al
inc ecx
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x280], ecx
cmp ecx, edi
jb 0x4025b8
mov ecx, dword [0x4524cc]
mov edx, dword [0x4524d4]
sub edx, ecx
mov dword [ebp - 0x27c], ecx
cmp edi, edx
jbe 0x402717
cmp edi, 0x7fffffff
ja 0x40292a
mov esi, edx
mov eax, 0x7fffffff
shr esi, 1
sub eax, esi
cmp edx, eax
jbe 0x402690
mov esi, 0x7fffffff
jmp 0x402697
add esi, edx
cmp esi, edi
cmovb esi, edi
test ecx, ecx
je 0x4026eb
cmp edx, 0x1000
jb 0x4026c3
mov eax, dword [ecx - 4]
add edx, 0x23
sub ecx, eax
mov dword [ebp - 0x280], eax
lea eax, [ecx - 4]
cmp eax, 0x1f
ja 0x40292f
mov ecx, dword [ebp - 0x280]
push edx
push ecx
call fcn.0041cdc8
add esp, 8
mov dword [0x4524cc], 0
mov dword [0x4524d0], 0
mov dword [0x4524d4], 0
push esi
mov ecx, 0x4524cc
call fcn.004039c0
mov esi, dword [0x4524cc]
push edi
push dword [ebp - 0x284]
push esi
call fcn.0041e1c0
lea eax, [esi + edi]
add esp, 0xc
mov esi, dword [ebp - 0x284]
jmp 0x40276a
mov eax, dword [0x4524d0]
sub eax, ecx
mov dword [ebp - 0x280], eax
cmp edi, eax
jbe 0x402757
push eax
push esi
push ecx
call fcn.0041e1c0
mov ecx, dword [ebp - 0x280]
sub edi, ecx
push edi
lea eax, [ecx + esi]
mov esi, dword [0x4524d0]
push eax
push esi
call fcn.0041e1c0
lea eax, [edi + esi]
add esp, 0x18
mov esi, dword [ebp - 0x284]
jmp 0x40276a
push edi
push esi
push ecx
call fcn.0041e1c0
mov eax, dword [ebp - 0x27c]
add esp, 0xc
add eax, edi
mov dword [0x4524d0], eax
mov byte [ebp - 0x275], 1
test esi, esi
je 0x4027c1
mov ecx, dword [ebp - 0x28c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x4027a0
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40292f
push ecx
push esi
call fcn.0041cdc8
add esp, 8
jmp 0x4027c1
call fcn.00402e40
push eax
call fcn.004030f0
add esp, 4
mov byte [ebp - 0x275], 0
mov ecx, dword [ebp - 0x214]
cmp ecx, 0xf
jbe 0x4027fb
mov edx, dword [ebp - 0x228]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4027f1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40292f
push ecx
push edx
call fcn.0041cdc8
add esp, 8
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0xf
mov byte [ebp - 0x228], 0
cmp ecx, 0xf
jbe 0x402850
mov edx, dword [ebp - 0x244]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402846
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40292f
push ecx
push edx
call fcn.0041cdc8
add esp, 8
mov ecx, dword [ebp - 0x248]
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0xf
mov byte [ebp - 0x244], 0
cmp ecx, 7
jbe 0x4028ab
mov edx, dword [ebp - 0x25c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4028a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40292f
push ecx
push edx
call fcn.0041cdc8
add esp, 8
mov ecx, dword [ebp - 0x260]
xor eax, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 7
mov word [ebp - 0x25c], ax
cmp ecx, 7
jbe 0x402904
mov edx, dword [ebp - 0x274]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4028fa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40292f
push ecx
push edx
call fcn.0041cdc8
add esp, 8
mov al, byte [ebp - 0x275]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cb34
mov esp, ebp
pop ebp
ret
call fcn.004039b0
call fcn.004039b0
call fcn.004217fa
int3