Function at 0x411370
Capabilities:
Connect to http server
Create http request
Make an http request with a cookie
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x48bc
call fcn.0042b660
push ebx
push ebp
push esi
push edi
mov ecx, 0xc
mov esi, str.Mozilla_4.0__compatible__MSIE_9.0__Windows_NT_6.1_
lea edi, [esp + 0x5c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 6
mov esi, str.localhost.ptlogin2.qq.com
lea edi, [esp + 0x90]
xor ebp, ebp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 5
mov esi, str.ssl.ptlogin2.qq.com
lea edi, [esp + 0x48]
push ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, 5
mov esi, str.ptlogin2.qun.qq.com
lea edi, [esp + 0x38]
push ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48e8]
mov edi, dword [esp + 0x48e4]
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
mov dword [esp + 0x28], ebp
rep stosb byte es:[edi], al
lea eax, [esp + 0x6c]
mov dword [esp + 0x2c], ebp
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x3c], 0x20
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
cmp ebx, ebp
mov dword [esp + 0x10], ebx
jne 0x411422
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
push ebp
push ebp
push 3
push ebp
push ebp
lea ecx, [esp + 0xa4]
push 0x10cd
push ecx
push ebx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x14], ebp
jne 0x41145c
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
mov edx, dword [esp + 0x48d4]
mov eax, dword [esp + 0x48d0]
push edx
push 0x3fee5242
push 0xc47b99b5
push eax
lea ecx, [esp + 0x18dc]
push str._pt_get_st_clientuin_scallbackptui_getst_CBr_.16f_s
push ecx
call fcn.0042cdcc
add esp, 0x18
lea edx, [esp + 0x18cc]
push 0
push 0x80880010
push 0
push 0
push str.HTTP_1.1
push edx
push 0x50d640
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x4114d0
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
mov eax, dword [esp + 0x48d8]
lea ecx, [esp + 0x18cc]
push eax
push ecx
lea edx, [esp + 0xd4]
push str.Accept:___r_nReferer:_https:__localhost.ptlogin2.qq.com:4301_s_r_nAccept_Language:_zh_cn_r_nContent_Type:_application_x_www_form_urlencoded_r_nCookie:__s
push edx
call fcn.0042cdcc
lea edi, [esp + 0xdc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0
lea eax, [esp + 0xd4]
push ecx
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x41153c
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push ebp
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov edx, dword [esp + 0x18]
inc edx
push edx
call fcn.004a2adf
mov ebp, eax
mov eax, dword [esp + 0x1c]
mov edi, ebp
add esp, 4
lea ecx, [eax + 1]
xor eax, eax
mov edx, ecx
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push eax
push ebp
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x4115b7
push ebp
call fcn.004a2b08
add esp, 4
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov ecx, dword [esp + 0x14]
push ecx
call esi
push ebx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
mov ebx, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call ebx
mov edx, dword [esp + 0x14]
push edx
call ebx
mov eax, dword [esp + 0x10]
push eax
call ebx
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x38cc]
push str.Set_Cookie:
rep stosd dword es:[edi], eax
push ebp
call fcn.0042cce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41160a
push ebp
call fcn.004a2b08
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0x50ce98
push esi
call fcn.0042cce0
mov edi, eax
lea edx, [esp + 0x38d4]
mov ecx, edi
sub ecx, esi
add esi, 0xc
sub ecx, 0xb
push ecx
push esi
push edx
call fcn.0042de00
push str.Set_Cookie:
push edi
call fcn.0042cce0
mov esi, eax
add esp, 0x1c
test esi, esi
jne 0x41160a
push ebp
call fcn.004a2b08
mov edi, dword [esp + 0x48dc]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x38cc]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
push eax
mov ecx, ebp
push eax
push eax
and ecx, 3
lea eax, [esp + 0x6c]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x4116a6
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0
push 0
push 3
push 0
push 0
lea ecx, [esp + 0x5c]
push 0x1bb
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov ebp, eax
test ebp, ebp
jne 0x4116d9
push edi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
mov edx, dword [esp + 0x48d4]
mov eax, dword [esp + 0x48d0]
push edx
push eax
lea ecx, [esp + 0x8d4]
push str._jump_clientuin_skeyindex9pt_aid715030901daid73u1http__3A__2F__2Fqun.qq.com__2Fmember.html__23_spt_3rd_aid0ptopt1style40
push ecx
call fcn.0042cdcc
add esp, 0x10
lea edx, [esp + 0x8cc]
push 0
push 0x80880010
push 0
push 0
push str.HTTP_1.1
push edx
push 0x50d640
push ebp
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x41173d
push ebp
call ebx
push edi
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea eax, [esp + 0x38cc]
lea ecx, [esp + 0x8cc]
push eax
push ecx
lea edx, [esp + 0x10d4]
push str.Accept:___r_nReferer:_https:__ssl.ptlogin2.qq.com_s_r_nAccept_Language:_zh_cn_r_nContent_Type:_application_x_www_form_urlencoded_r_nCookie:__s
push edx
call fcn.0042cdcc
lea edi, [esp + 0x10dc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0
lea eax, [esp + 0x10d4]
push ecx
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4117a7
push esi
call ebx
push ebp
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea edx, [esp + 0x1c]
push 0
push edx
push 0
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [esp + 0x1c]
inc eax
push eax
call fcn.004a2adf
mov ecx, dword [esp + 0x20]
add esp, 4
inc ecx
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [esp + 0x14], edi
push 0
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push edi
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x411820
push edi
call fcn.004a2b08
add esp, 4
push esi
call ebx
push ebp
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea edx, [esp + 0x28]
push 0
lea eax, [esp + 0xb0]
push edx
push eax
push 5
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x411861
push edi
call fcn.004a2b08
add esp, 4
push esi
call ebx
push ebp
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea edx, [esp + 0xac]
push edx
call fcn.0042dd5e
mov edi, eax
inc edi
push edi
mov dword [esp + 0x34], edi
call fcn.004a2adf
mov edx, eax
mov ecx, edi
mov dword [esp + 0x2c], edx
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
add esp, 8
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [esp + 0x24]
lea eax, [esp + 0x30]
mov ecx, edx
push eax
push ecx
push edi
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4118df
push edi
call fcn.004a2b08
mov edx, dword [esp + 0x18]
push edx
call fcn.004a2b08
add esp, 8
push esi
call ebx
push ebp
call ebx
mov eax, dword [esp + 0x10]
push eax
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
push esi
call ebx
push ebp
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov ebp, dword [esp + 0x14]
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20cc]
push str.Set_Cookie:
push ebp
rep stosd dword es:[edi], eax
call fcn.0042cce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x411936
mov edx, dword [esp + 0x24]
push edx
call fcn.004a2b08
push ebp
call fcn.004a2b08
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0x50ce98
push esi
call fcn.0042cce0
push 0x50cef8
push esi
mov edi, eax
call fcn.0042cce0
add esp, 0x10
inc eax
cmp eax, edi
je 0x411972
mov eax, edi
lea ecx, [esp + 0x20cc]
sub eax, esi
add esi, 0xc
sub eax, 0xb
push eax
push esi
push ecx
call fcn.0042de00
add esp, 0xc
push str.Set_Cookie:
push edi
call fcn.0042cce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x411936
push ebp
call fcn.004a2b08
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x28d0]
push str._check_sig_
rep stosd dword es:[edi], eax
mov edi, dword [esp + 0x2c]
push edi
call fcn.0042cce0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4119cc
push edi
call fcn.004a2b08
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0x50d474
push esi
call fcn.0042cce0
sub eax, esi
lea edx, [esp + 0x28d4]
push eax
push esi
push edx
call fcn.0042dc60
push edi
call fcn.004a2b08
add esp, 0x18
lea eax, [esp + 0x5c]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x10], ebp
jne 0x411a1b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0
push 0
push 3
push 0
push 0
lea ecx, [esp + 0x48]
push 0x50
push ecx
push ebp
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
jne 0x411a4f
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
push 0
push 0x80284010
push 0
push 0
lea edx, [esp + 0x28dc]
push str.HTTP_1.1
push edx
push 0x50d640
push edi
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov esi, eax
test esi, esi
jne 0x411a8e
push edi
call ebx
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea eax, [esp + 0x20cc]
lea ecx, [esp + 0x28cc]
push eax
push ecx
lea edx, [esp + 0x30d4]
push str.Accept:___r_nReferer:_http:__ptlogin2.qun.qq.com_s_r_nAccept_Language:_zh_cn_r_nContent_Type:_application_x_www_form_urlencoded_r_nCookie:__s
push edx
call fcn.0042cdcc
lea edi, [esp + 0x30dc]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
push 0
dec ecx
push 0
lea eax, [esp + 0x30d4]
push ecx
push eax
push esi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x411af8
push esi
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebx
push ebp
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
lea edx, [esp + 0x20]
push 0
push edx
push 0
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [esp + 0x20]
inc eax
push eax
call fcn.004a2adf
mov ecx, dword [esp + 0x24]
add esp, 4
inc ecx
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x24]
push eax
push ebp
push 0x16
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x411b6f
push ebp
call fcn.004a2b08
add esp, 4
push esi
call ebx
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x48bc
ret 0x14
push esi
call ebx
mov eax, dword [esp + 0x14]
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x40cc]
push str.Set_Cookie:
rep stosd dword es:[edi], eax
push ebp
call fcn.0042cce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x411bbc
push ebp
call fcn.004a2b08
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48bc
ret 0x14
push 0x50ce98
push esi
call fcn.0042cce0
push 0x50cef8
push esi
mov edi, eax
call fcn.0042cce0
add esp, 0x10
inc eax
cmp eax, edi
je 0x411bf8
mov edx, edi
lea eax, [esp + 0x40cc]
sub edx, esi
add esi, 0xc
sub edx, 0xb
push edx
push esi
push eax
call fcn.0042de00
add esp, 0xc
push str.Set_Cookie:
push edi
call fcn.0042cce0
mov esi, eax
add esp, 8
test esi, esi
jne 0x411bbc
push ebp
call fcn.004a2b08
lea edi, [esp + 0x40d0]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov edx, dword [esp + 0x48dc]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x48bc
ret 0x14