Function at 0x430e48
Capabilities:
Check for software breakpoints
Check http status code
Delete file
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Resolve dns
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46aca3
mov eax, dword fs:[0]
push eax
mov eax, 0x39a8
call fcn.004405e0
mov eax, dword [0x48a024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x392c], edx
mov dword [ebp - 0x3904], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x39b4]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x3930], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3910], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3918], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3950], eax
lea eax, [ebp - 0x38f8]
push eax
push str.PerformRemoteHttpOp
mov dword [ebp - 0x38f8], 0x4b1
call fcn.0041bb53
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x38f4]
mov eax, dword [0x48bd08]
mov ebx, edx
push 9
pop ecx
mov dword [ebp - 0x3934], eax
xor eax, eax
push 0x80
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x391c], edx
push eax
mov dword [ebp - 0x3924], ebx
mov dword [ebp - 0x3920], edx
mov dword [ebp - 0x38fc], edx
mov dword [ebp - 0x390c], edx
mov dword [ebp - 0x3940], 4
mov dword [ebp - 0x393c], edx
call fcn.00441660
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x3914], cl
call fcn.004068d0
push eax
lea ecx, [ebp - 0x3928]
call fcn.00405f99
mov byte [ebp - 4], 2
call fcn.004068d0
push eax
lea ecx, [ebp - 0x3908]
call fcn.00405f99
mov byte [ebp - 4], 4
xor eax, eax
push 6
pop ecx
lea edi, [ebp - 0x39a8]
mov dword [ebp - 0x3990], 0x3c
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x394c]
mov dword [ebp - 0x3988], 0x20
stosd dword es:[edi], eax
xor edx, edx
mov ecx, 0x400
mov dword [ebp - 0x3900], edx
mov dword [ebp - 0x3984], edx
mov dword [ebp - 0x3970], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x398c], eax
mov edi, 0x800
lea eax, [ebp - 0x10d0]
mov dword [ebp - 0x397c], edi
mov dword [ebp - 0x3980], eax
xor eax, eax
mov word [ebp - 0x3978], ax
lea eax, [ebp - 0x18d0]
mov dword [ebp - 0x3974], eax
lea eax, [ebp - 0x38d0]
mov dword [ebp - 0x3960], edi
mov edi, dword [ebp - 0x3904]
mov dword [ebp - 0x396c], eax
lea eax, [ebp - 0x30d0]
mov dword [ebp - 0x3964], eax
lea eax, [ebp - 0x20d0]
mov dword [ebp - 0x3968], ecx
mov dword [ebp - 0x395c], eax
mov dword [ebp - 0x3958], ecx
cmp edi, 5
je 0x431023
cmp edi, 6
jne 0x431067
mov eax, dword [ebp - 0x3930]
test eax, eax
je 0x431067
cmp word [eax], dx
je 0x431067
cmp dword [ebp - 0x3918], edx
je 0x431042
cmp dword [ebp - 0x3910], edx
je 0x431067
mov eax, dword [0x48bd14]
test esi, esi
cmove esi, eax
mov dword [ebp - 0x3954], esi
cmp esi, 4
jne 0x431116
cmp byte [0x48bd18], dl
jne 0x431140
mov dword [ebp - 0x38f8], 0x57
cmp dword [ebp - 0x3948], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x431088
push dword [ebp - 0x3948]
call esi
cmp dword [ebp - 0x3944], 0
je 0x431099
push dword [ebp - 0x3944]
call esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
je 0x4310a6
push ebx
call esi
mov eax, dword [ebp - 0x3920]
test eax, eax
je 0x4310b3
push eax
call esi
mov eax, dword [ebp - 0x391c]
test eax, eax
je 0x4310c0
push eax
call esi
mov esi, dword [ebp - 0x38f8]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3908]
lea ecx, [ecx - 0x10]
call fcn.00406985
xor eax, eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x3928]
add ecx, 0xfffffff0
call fcn.00406985
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39b4]
call fcn.0041bbc1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043fc0b
leave
ret
cmp esi, 5
jg 0x431067
cmp esi, 3
jne 0x431140
cmp eax, esi
je 0x431140
call fcn.00431b8c
test eax, eax
je 0x431140
mov dword [ebp - 0x38f8], 0x32
jmp 0x431071
push dword [ebp - 0x3930]
push str.PerformRemoteHttpOp:_Url:__s
call fcn.0041b909
mov eax, dword [ebp - 0x3910]
xor edx, edx
pop ecx
pop ecx
test eax, eax
je 0x431175
cmp dword [ebp - 0x3918], edx
jne 0x431175
mov dword [ebp - 0x3900], eax
cmp word [eax], dx
je 0x431067
cmp dword [0x48bc70], 0
jle 0x43118d
mov dword [ebp - 0x38f8], 0x2e3
jmp 0x431071
xor ecx, ecx
inc ecx
cmp esi, 4
je 0x4311e4
cmp esi, 3
je 0x4311bb
push edx
xor eax, eax
cmp esi, ecx
push edx
push edx
setne al
push eax
push dword [0x48bca8]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
mov dword [ebp - 0x391c], esi
jmp 0x43122c
lea eax, [ebp - 0x10d0]
cmp edi, 5
jne 0x4311dc
push dword [0x48bd2c]
push 0x800
push eax
call fcn.0045478b
add esp, 0xc
jmp 0x43120b
push dword [0x48bd30]
jmp 0x4311cc
movzx eax, word [0x48bd20]
push eax
push dword [0x48bd1c]
lea eax, [ebp - 0x10d0]
push str._s:_hu
push 0x800
push eax
call fcn.0040817c
add esp, 0x14
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x10d0]
push eax
push 3
push dword [0x48bca8]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
mov dword [ebp - 0x391c], eax
test esi, esi
je 0x431071
cmp dword [0x48bc70], 0
jg 0x43117e
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x3934]
push 4
push eax
push 3
push esi
call edi
test eax, eax
je 0x431071
push 4
lea eax, [ebp - 0x3934]
push eax
push 7
push esi
call edi
test eax, eax
je 0x431071
push 4
lea eax, [ebp - 0x3934]
push eax
push 6
push esi
call edi
test eax, eax
je 0x431071
push 4
lea eax, [ebp - 0x3934]
push eax
push 5
push esi
call edi
test eax, eax
je 0x431071
mov eax, dword [ebp - 0x3900]
test eax, eax
je 0x4312d5
lea ecx, [ebp - 0x38f4]
push ecx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x4312cf
push 9
pop ecx
lea edi, [ebp - 0x38f4]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp - 0x3900]
cmp dword [ebp - 0x392c], 1
jne 0x431352
test eax, eax
je 0x431352
cmp dword [ebp - 0x38d4], 0
je 0x431310
push dword [ebp - 0x38d4]
lea eax, [ebp - 0x90]
push str.Range:_bytes_u__n
push 0x40
push eax
call fcn.0040817c
add esp, 0x10
mov byte [ebp - 0x3914], 1
jmp 0x431352
mov ebx, dword [ebp - 0x3900]
push 9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x431346
cmp eax, 0x20
je 0x431336
cmp eax, 5
jne 0x431346
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x431319
mov ebx, dword [ebp - 0x3924]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x3990]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x3930]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x43137c
mov dword [ebp - 0x38f8], 0xb
jmp 0x431071
cmp byte [0x48bd0c], 0
je 0x4314f7
mov esi, dword [sym.imp.DNSAPI.dll_DnsQuery_W]
lea eax, [ebp - 0x38fc]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebp - 0x3980]
call esi
test eax, eax
jne 0x431071
mov eax, dword [ebp - 0x38fc]
test eax, eax
je 0x431071
xor ecx, ecx
inc ecx
cmp word [eax + 8], cx
je 0x4313cf
mov eax, dword [eax]
test eax, eax
jne 0x4313be
jmp 0x431071
mov eax, dword [eax + 0x18]
push ecx
push dword [ebp - 0x38fc]
mov dword [ebp - 0x3924], eax
call dword [sym.imp.DNSAPI.dll_DnsFree]
mov eax, dword [ebp - 0x3924]
xor ecx, ecx
mov dword [ebp - 0x38fc], ecx
cmp al, 0x7f
je 0x431427
cmp al, 0xa9
jne 0x431400
cmp ah, 0xfe
jmp 0x431421
cmp al, 0xa
je 0x431427
cmp al, 0xac
jne 0x431416
mov al, ah
sub al, 0x10
cmp al, 0xf
ja 0x4314f7
jmp 0x431427
cmp al, 0xc0
jne 0x4314f7
cmp ah, 0xa8
jne 0x4314f7
push ecx
lea eax, [ebp - 0x38fc]
push eax
push ecx
xor eax, eax
push 0x48
inc eax
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
test eax, eax
jne 0x4314f7
mov esi, dword [ebp - 0x38fc]
test esi, esi
je 0x4314f7
inc eax
cmp word [esi + 8], ax
je 0x431467
mov esi, dword [esi]
test esi, esi
jne 0x431456
jmp 0x4314f7
mov ecx, str.Host:
call fcn.004082a0
push eax
push str.Host:
lea ecx, [ebp - 0x3908]
call fcn.00408222
lea ecx, [ebp - 0x10d0]
call fcn.004082a0
push eax
lea eax, [ebp - 0x10d0]
push eax
lea ecx, [ebp - 0x3908]
call fcn.00409578
mov ecx, 0x47edb0
call fcn.004082a0
push eax
push 0x47edb0
lea ecx, [ebp - 0x3908]
call fcn.00409578
mov esi, dword [esi + 0x18]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x38fc]
call dword [sym.imp.DNSAPI.dll_DnsFree]
xor ecx, ecx
push esi
mov dword [ebp - 0x38fc], ecx
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x47edb8
lea eax, [ebp - 0x10d0]
push 0x800
push eax
call fcn.0040817c
add esp, 0x10
mov esi, dword [ebp - 0x3950]
test esi, esi
je 0x431515
mov ecx, esi
call fcn.004082a0
push eax
push esi
lea ecx, [ebp - 0x3908]
call fcn.00409578
mov ecx, dword [ebp - 0x3984]
xor edx, edx
inc edx
lea eax, [ecx - 1]
cmp eax, edx
ja 0x431544
cmp word [ebp - 0x3978], 0
jne 0x431544
cmp ecx, edx
jne 0x431538
push 0x50
pop eax
jmp 0x43153d
mov eax, 0x1bb
mov word [ebp - 0x3978], ax
xor eax, eax
push eax
push dword [ebp - 0x3978]
lea eax, [ebp - 0x10d0]
push eax
push dword [ebp - 0x391c]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp - 0x3920], eax
test eax, eax
je 0x431071
lea ecx, [ebp - 0x30d0]
call fcn.004082a0
push eax
lea eax, [ebp - 0x30d0]
push eax
lea ecx, [ebp - 0x3928]
call fcn.00408222
lea ecx, [ebp - 0x20d0]
call fcn.004082a0
push eax
lea eax, [ebp - 0x20d0]
push eax
lea ecx, [ebp - 0x3928]
call fcn.00409578
cmp dword [ebp - 0x3984], 2
mov ecx, 0x800100
mov eax, 0x100
cmove eax, ecx
mov dword [ebp - 0x3938], eax
call fcn.004068d0
push eax
lea ecx, [ebp - 0x3904]
call fcn.00405f99
mov byte [ebp - 4], 6
cmp dword [ebp - 0x392c], 0
jne 0x4315e9
mov esi, str.POST
jmp 0x4315fc
cmp dword [ebp - 0x3910], 0
mov esi, 0x47edcc
jne 0x4315fc
mov esi, str.HEAD
mov ecx, esi
call fcn.004082a0
push eax
push esi
lea ecx, [ebp - 0x3904]
call fcn.00408222
push dword [ebp - 0x3938]
mov esi, dword [ebp - 0x3904]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x3928]
push esi
push dword [ebp - 0x3920]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
mov dword [ebp - 0x3924], ebx
test ebx, ebx
jne 0x431651
mov byte [ebp - 4], 4
lea ecx, [esi - 0x10]
call fcn.00406985
jmp 0x431071
cmp dword [ebp - 0x3954], 5
jne 0x4316ab
xor eax, eax
mov dword [ebp - 0x39a4], 3
inc eax
mov dword [ebp - 0x39a8], eax
mov dword [ebp - 0x3994], eax
lea eax, [ebp - 0x394c]
push eax
lea eax, [ebp - 0x39a8]
push eax
push dword [ebp - 0x3930]
push dword [ebp - 0x391c]
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x4316ab
push 0xc
lea eax, [ebp - 0x394c]
push eax
push 0x26
push ebx
call edi
test eax, eax
jne 0x4316ab
jmp 0x431640
cmp word [ebp - 0x18d0], 0
je 0x4316db
xor ecx, ecx
lea eax, [ebp - 0x38d0]
push ecx
push eax
lea eax, [ebp - 0x18d0]
push eax
xor eax, eax
inc eax
push eax
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x4316db
jmp 0x431640
cmp byte [0x48bd22], 0
je 0x431722
mov eax, dword [0x48bd24]
push dword [eax - 0xc]
push eax
push 0x1002
push dword [ebp - 0x3920]
call edi
test eax, eax
jne 0x431703
jmp 0x431640
mov eax, dword [0x48bd28]
push dword [eax - 0xc]
push eax
push 0x1003
push dword [ebp - 0x3920]
call edi
test eax, eax
jne 0x431722
jmp 0x431640
cmp dword [ebp - 0x3984], 2
jne 0x43174c
push 4
lea eax, [ebp - 0x3938]
mov dword [ebp - 0x3938], 0x3000
push eax
push 0x1f
push ebx
call edi
test eax, eax
jne 0x43174c
jmp 0x431640
mov eax, dword [ebp - 0x3908]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [eax - 0xc], 0
je 0x431772
push 0x10000000
push 0xffffffffffffffff
push eax
push ebx
call edi
test eax, eax
jne 0x431772
jmp 0x431640
cmp dword [ebp - 0x392c], 0
jne 0x4317a7
mov edi, dword [ebp - 0x3918]
test edi, edi
je 0x431789
mov eax, dword [edi]
jmp 0x43178f
mov eax, dword [ebp - 0x38d4]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x4317e8
jmp 0x431640
cmp byte [ebp - 0x3914], 0
je 0x4317ca
push 0x10000000
push 0xffffffffffffffff
lea eax, [ebp - 0x90]
push eax
push ebx
call edi
test eax, eax
jne 0x4317ca
jmp 0x431640
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x4317e2
jmp 0x431640
mov edi, dword [ebp - 0x3918]
cmp dword [0x48bc70], 0
jle 0x431800
mov dword [ebp - 0x38f8], 0x2e3
jmp 0x431640
cmp dword [ebp - 0x392c], 0
jne 0x4318cc
mov eax, dword [ebp - 0x3910]
test eax, eax
je 0x431838
push dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov edx, eax
mov ecx, ebx
push edi
call fcn.0041a841
mov dword [ebp - 0x38f8], eax
pop ecx
pop ecx
test eax, eax
je 0x431838
jmp 0x431640
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x43184b
jmp 0x431640
lea eax, [ebp - 0x393c]
push eax
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x390c]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x431878
jmp 0x431640
mov eax, dword [ebp - 0x390c]
cmp eax, 0xc8
je 0x4318a2
cmp eax, 0xc9
je 0x4318a2
cmp eax, 0xcc
je 0x4318bf
mov dword [ebp - 0x38f8], 9
jmp 0x431640
cmp eax, 0xcc
je 0x4318bf
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, ebx
call fcn.0041aa38
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x38f8], eax
jmp 0x431640
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x4318df
jmp 0x431640
lea eax, [ebp - 0x393c]
push eax
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x390c]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x43190c
jmp 0x431640
cmp dword [ebp - 0x390c], 0xce
je 0x431984
cmp dword [ebp - 0x390c], 0xc8
je 0x431929
jmp 0x431640
cmp byte [ebp - 0x3914], 0
je 0x431984
xor eax, eax
mov byte [ebp - 0x3914], al
cmp dword [ebp - 0x3900], eax
je 0x431984
mov esi, dword [ebp - 0x3900]
push 9
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x431978
cmp eax, 0x20
je 0x431968
cmp eax, 5
jne 0x431978
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x43194b
mov esi, dword [ebp - 0x3904]
mov ebx, dword [ebp - 0x3924]
mov eax, dword [ebp - 0x3910]
test eax, eax
je 0x4318bf
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edx, eax
mov ecx, ebx
push dword [ebp - 0x3914]
push dword [ebp - 0x3918]
call fcn.0041aa38
add esp, 0xc
mov dword [ebp - 0x38f8], eax
test eax, eax
je 0x4318bf
jmp 0x431640