Function at 0x401654
Capabilities:
Contain obfuscated stackstrings
Get common file path
Read http header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x8c8
push esi
push edi
mov dword [esp + 0xac], 0x19ff0f7e
mov dword [esp + 0x64], 0x5965fe89
mov dword [esp + 0xa4], 0x49fc33d7
mov dword [esp + 0xb0], 0x6d5391af
mov dword [esp + 0x34], 0x14277bfa
mov dword [esp + 0x9c], 0x1888ae25
mov dword [esp + 8], 0x3b6613c3
mov dword [esp + 0x48], 0x32c4613b
mov dword [esp + 0x70], 0x1f07fb06
mov dword [esp + 0x90], 0x4e30f9ac
mov dword [esp + 0x14], 0x345b0ae4
mov dword [esp + 0x30], 0xbbd8d9d
mov dword [esp + 0x68], 0x185331a5
mov dword [esp + 0xa8], 0x7404874a
mov dword [esp + 0x5c], 0x6c688f9a
mov dword [esp + 0x3c], 0x33d5668f
mov dword [esp + 0x1c], 0x5e2ea379
mov dword [esp + 0xbc], 0x7a53cbbe
mov dword [esp + 0xc0], 0x69d8790d
mov dword [esp + 0xb8], 0x7f7b0e8f
mov dword [esp + 0xc8], 0x61f533e1
mov dword [esp + 0x4c], 0x2a60fb34
mov dword [esp + 0x74], 0x1948ac0c
mov dword [esp + 0x60], 0x224c3465
mov dword [esp + 0x94], 0x44ccc37
mov dword [esp + 0x28], 0x2dcec8e9
mov dword [esp + 0x2c], 0x1dc2f561
mov dword [esp + 0x10], 0xa0533fb
mov dword [esp + 0x8c], 0x157bd8cf
mov dword [esp + 0x20], 0x7983eb15
mov dword [esp + 0xc], 0x31ab748f
mov dword [esp + 0x58], 0x339cc2ec
mov dword [esp + 0x50], 0x4eb24da7
mov dword [esp + 0x40], 0x6917087e
mov dword [esp + 0x54], 0x3275fb68
mov dword [esp + 0xa0], 0xa8e049
mov dword [esp + 0x88], 0x3162bf47
mov dword [esp + 0x98], 0x28d6322
mov dword [esp + 0x84], 0x2315061f
mov dword [esp + 0xc4], 0x7c8a86af
mov dword [esp + 0x7c], 0x1dee2387
mov dword [esp + 0x24], 0x6f447d29
mov dword [esp + 0x38], 0x67743e64
mov dword [esp + 0x80], 0x61a3bbe1
mov dword [esp + 0x6c], 0xd6dcea5
mov dword [esp + 0x78], 0x3745b065
mov dword [esp + 0xb4], 0x329bbfe1
mov dword [esp + 0x44], 0xa7c6fc2
mov dword [esp + 0xcc], 0x2ec62071
mov dword [esp + 0x18], 0x39c531ab
add dword [esp + 0xac], 0x6d25bf10
mov eax, 0x66048dce
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xac], 0x5cde9b46
add dword [esp + 0xac], 0x200a0537
mov eax, 0x7c3f6850
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
mov eax, 0x56783417
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xac], 0x646246e8
mov eax, 0x4757427e
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0xb0], 0x66d7d3c0
add dword [esp + 0x64], 0x3a12a571
sub dword [esp + 0xb0], 0x5950416
mov eax, 0x7a6d8260
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x3a919eb7
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 8], 0x7b1dde25
mov eax, 0x1b58eac9
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
add dword [esp + 0xac], 0x3dd533d2
mov eax, 0x2f9f8686
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
add dword [esp + 0xb0], 0x49ec37bb
mov eax, 0x79b8d9a6
mul dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
add dword [esp + 0x14], 0x7d21b67c
sub dword [esp + 0x48], 0x387c3816
add dword [esp + 0x9c], 0x673d39c1
mov eax, 0x4552ef72
mul dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
sub dword [esp + 0x1c], 0x78346829
mov eax, 0x2e6c7a61
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
sub dword [esp + 0x14], 0x6cca362f
mov eax, 0x3aeb5cee
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
sub dword [esp + 0x70], 0x46559e24
sub dword [esp + 0x14], 0x49b64d3c
mov eax, 0x7d8050b3
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
sub dword [esp + 0x34], 0x7a0b6867
sub dword [esp + 0x70], 0x52cf4c7
mov eax, 0x6a3441b1
mul dword [esp + 8]
mov eax, dword [esp + 8]
add dword [esp + 0x34], 0x299ea8a6
mov eax, 0x2428d5ee
mul dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
mov eax, 0x3111ef33
mul dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
mov eax, 0x63756df2
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x76cd5ad0
mul dword [esp + 0xac]
mov eax, dword [esp + 0xac]
add dword [esp + 0xa4], 0x7d315a96
mov eax, 0x10456087
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
sub dword [esp + 0x14], 0x4d3d08aa
add dword [esp + 0xb8], 0x4e855df7
mov eax, 0x899969f
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
add dword [esp + 0x3c], 0x7dd5e972
sub dword [esp + 0x94], 0x11c22cb8
sub dword [esp + 8], 0x55380f62
sub dword [esp + 0x4c], 0x60ecd87a
sub dword [esp + 0x28], 0x17bfe358
add dword [esp + 0xb8], 0x46fcacae
sub dword [esp + 0xa8], 0x87d6b24
sub dword [esp + 0x30], 0x39ef069b
sub dword [esp + 0x3c], 0x697183b4
sub dword [esp + 0x14], 0x30d019d6
sub dword [esp + 0x30], 0x2351bf00
add dword [esp + 0x2c], 0x5f5b6134
sub dword [esp + 0xc0], 0x3424821a
sub dword [esp + 0x94], 0x46ecd2bd
mov eax, 0x361afd5d
mul dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
mov eax, 0x354f088
mul dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
add dword [esp + 0xac], 0x6e8e08a
mov eax, 0x2af1c223
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
sub dword [esp + 0x8c], 0x42591cf6
mov eax, 0x705a469f
mul dword [esp + 0xb8]
mov eax, dword [esp + 0xb8]
sub dword [esp + 0xb8], 0x3056987b
sub dword [esp + 0x8c], 0x4e9996c5
add dword [esp + 0xc8], 0x1fdcca07
mov eax, 0x18425df7
mul dword [esp + 0xbc]
mov eax, dword [esp + 0xbc]
mov eax, 0x53505dad
mul dword [esp + 0x74]
mov eax, dword [esp + 0x74]
mov eax, 0x35b0f2cd
mul dword [esp + 0x68]
mov eax, dword [esp + 0x68]
sub dword [esp + 0xc], 0x24caec1a
add dword [esp + 0x74], 0x41caee8f
add dword [esp + 0x70], 0x3b3648d9
mov eax, 0x6169ed0f
mul dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
sub dword [esp + 0x60], 0x641729be
add dword [esp + 0xa4], 0x6af792d5
sub dword [esp + 0x20], 0x54d1ddcc
mov eax, 0x5294ec03
mul dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
mov eax, 0x5926f5cd
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
add dword [esp + 0x98], 0x793983f3
mov eax, 0x293c81a5
mul dword [esp + 0x40]
mov eax, dword [esp + 0x40]
sub dword [esp + 0x74], 0x51b0419b
add dword [esp + 0xb8], 0x470c128d
sub dword [esp + 0xc4], 0x71b07eaf
sub dword [esp + 0xb8], 0x7fb12e76
add dword [esp + 0x60], 0x2e11f03d
mov eax, 0xad7bb5d
mul dword [esp + 0x70]
mov eax, dword [esp + 0x70]
sub dword [esp + 0x48], 0x3d0fecb6
mov eax, 0x362fc750
mul dword [esp + 0x98]
mov eax, dword [esp + 0x98]
sub dword [esp + 0xa8], 0x1f7025da
sub dword [esp + 0x58], 0x2208e05c
add dword [esp + 0xb0], 0x5dd8460
add dword [esp + 0xc0], 0x59d3c2d3
sub dword [esp + 0x98], 0x66870328
mov eax, 0x6bd7e9df
mul dword [esp + 0xa4]
mov eax, dword [esp + 0xa4]
mov eax, 0x21ad17f6
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
add dword [esp + 0xbc], 0x23971169
add dword [esp + 0xa4], 0x2aab4031
sub dword [esp + 0x94], 0x40a11ccc
add dword [esp + 0x7c], 0x1bb23de0
sub dword [esp + 0xcc], 0x362be7a9
xor esi, esi
xor edi, edi
cmp edi, 0x94d
jge 0x401cf7
push esi
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffA]
push esi
call dword [sym.imp.USER32.dll_GetSysColor]
cmp edi, 0x166fb30
jg 0x401d08
inc edi
cmp edi, 0x376c5c1
jl 0x401cd9
cmp dword [0x245925c], 0x400
jne 0x401dd2
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
push esi
lea eax, [esp + 0xd8]
push eax
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call fcn.00402184
pop ecx
push esi
push esi
call fcn.004028ba
push 0x43e78c
push str.0.txt
push esi
call fcn.004025e6
add esp, 0x14
push esi
push esi
push esi
call fcn.004029f1
fldz
push ecx
fst qword [esp + 8]
fstp qword [esp]
call fcn.00401e50
fstp st(0)
add esp, 8
fldz
fstp qword [esp]
call fcn.004027a0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004023c0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00401e70
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402670
fstp st(0)
push esi
push esi
call fcn.004021be
push esi
push esi
call fcn.00402114
add esp, 0x18
xor edi, edi
cmp edi, 0x16d22
jge 0x401def
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharWidthI]
push esi
push esi
push dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x12e8a06
jg 0x401e13
inc edi
cmp edi, 0x30375
jl 0x401dd4
mov eax, dword [0x443c64]
mov dword [0x245925c], eax
call fcn.004013b2
mov edi, 0x2ec37
cmp dword [0x245925c], 0x51f
jne 0x401e42
lea eax, [esp + 0xd0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec edi
jne 0x401e27
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10