Function at 0x406451
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
xor esi, esi
push 0x38
lea eax, [ebp - 0x48]
push esi
push eax
mov dword [ebp - 0xc], esi
call fcn.00407159
or dword [ebp - 0x38], 0xffffffff
or dword [ebp - 0x1c], 0xffffffff
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0x4c], 0x3c
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 8]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x40654a
push esi
push esi
push esi
push esi
push str.nsis_reporter_0.1
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 8], eax
cmp eax, esi
je 0x40654a
mov eax, dword [ebp - 0x38]
push ebx
push edi
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
mov eax, dword [ebp - 0x38]
inc eax
push eax
push dword [ebp - 0x3c]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
push dword [ebp - 0x34]
push ebx
push dword [ebp - 8]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x40653c
push esi
push esi
push esi
push esi
push dword [ebp - 0x20]
push 0x40876c
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x406537
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push eax
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x406532
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call edi
push dword [ebp - 0x10]
call edi
push dword [ebp - 8]
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x406610
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42375c], 0
jne 0x40664e
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406624
mov dword [ecx*4 + 0x423758], eax
inc ecx
cmp ecx, 0x100
jl 0x40661f
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40667b
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x423758]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40665c
not eax
pop ebp
ret 0xc

Function at 0x406681
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [str.h111111]
mov dword [ebp - 8], eax
mov eax, dword [0x408904]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x4066cb
mov ecx, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub edi, esi
mov dword [ebp + 0x10], eax
mov eax, dword [ecx]
xor edx, edx
push 7
pop ebx
div ebx
mov al, byte [ebp + edx - 8]
xor al, byte [edi + esi]
mov byte [esi], al
inc esi
inc dword [ecx]
dec dword [ebp + 0x10]
jne 0x4066ae
pop edi
pop esi
pop ebx
leave
ret