Function at 0x4a89d0
Capabilities:
Connect to http server
Create http request
Initialize winsock library
Query or enumerate registry value
Read data from internet
Receive data
Receive data on socket
Send data
Send http request
Send http request with host header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x561678
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3f0
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], esi
call fcn.004a9140
mov ecx, ebx
call fcn.004a9100
mov ecx, ebx
call fcn.004a8e80
lea eax, [ebx + 0x200]
push eax
call fcn.0042d1e0
add esp, 4
test al, al
je 0x4a8a9e
lea eax, [ebx + 0x1ce]
push eax
call fcn.0042d4c0
add esp, 4
test al, al
je 0x4a8a9e
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x26c]
mov dword [ebp - 0x28], esi
rep stosd dword es:[edi], eax
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x14], esi
cmp ecx, esi
je 0x4a8ab9
push 1
call fcn.0041f010
cmp eax, esi
jne 0x4a8ab9
cmp dword [ebx + 8], esi
jne 0x4a8a76
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.00489c10
mov ecx, dword [ebx + 4]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x20]
call fcn.00489c50
cmp eax, esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x20]
je 0x4a8ab4
call fcn.00489c40
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.00489c40
lea edx, [ebp - 0x24]
push edx
push 0xf003f
push esi
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a8bf5
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x14]
push eax
push ecx
push esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.UseHttpProxy
push edx
mov dword [ebp - 0x18], 4
call esi
test eax, eax
jne 0x4a8bf5
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4a8c00
lea eax, [ebp - 0x3fc]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, ebx
call fcn.004a9240
test eax, eax
je 0x4a8be9
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x4c]
lea edx, [ebp - 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x6c]
push edx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x24]
stosw word es:[edi], ax
lea eax, [ebp - 0x4c]
mov edi, 0x1e
push eax
push 0
push 0
push str.HttpUserName
push ecx
mov dword [ebp - 0x18], edi
call esi
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x6c]
push edx
xor edi, edi
push eax
push edi
push edi
push str.HttpPasword
push ecx
call esi
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x6c]
lea eax, [ebp - 0x4c]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.004a9510
cmp eax, edi
je 0x4a8cb8
mov edx, dword [ebp - 0x1c]
push 0xb4
push edx
mov ecx, ebx
call fcn.004a98e0
cmp eax, edi
je 0x4a8cb8
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004a99d0
cmp eax, edi
je 0x4a8cb8
mov edx, dword [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x26c]
push 0x200
push ecx
push edx
call sub.WSOCK32.dll_recv
test eax, eax
jg 0x4a8bf0
mov dword [ebp - 0x14], 0
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8ceb
push 0
push 0x5c6ff0
push 0x5c6ff0
push 1
push str.IDMan_4.1
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0
push 3
push str.azcfgped
push str.tcidm
push 0x50
push str.www.internetdownloadmanager.com
push eax
mov dword [ebx + 0x29c], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push 0
push 0x84000000
push 0
push 0x5c6ff0
push 0x5c6ff0
push str._data_395012712_register.cgi
push str.POST
push eax
mov dword [ebx + 0x2a0], eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edx, eax
mov edi, str.Host:_www.internetdownloadmanager.com_r_nAccept:___r_nContent_Type:_text_html_r_nAuthorization:_Basic_dGNpZG06YXpjZmdwZWQ
or ecx, 0xffffffff
xor eax, eax
mov dword [ebx + 0x2a4], edx
push 0xa1000000
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Host:_www.internetdownloadmanager.com_r_nAccept:___r_nContent_Type:_text_html_r_nAuthorization:_Basic_dGNpZG06YXpjZmdwZWQ
push edx
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov ecx, dword [ebx + 0x2a4]
lea eax, [ebx + 0xc]
push 0x190
push eax
push 0
push 0
push ecx
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x4a8cc0
mov esi, 4
jmp 0x4a8e15
mov dword [ebp - 0x14], edi
jmp 0x4a8bf0
mov ecx, dword [ebx + 0x2a4]
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp - 0x26c]
push 0x200
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4a8ceb
mov esi, 4
jmp 0x4a8e15
mov edi, str.58BE20ast4si5ls2D13
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x26c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.58BE20ast4si5ls2D13
push 0x200
push edx
lea ecx, [ebx + 0x298]
call fcn.004a3f00
lea esi, [ebx + 0x1ce]
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a8d47
test cl, cl
je 0x4a8d43
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a8d47
add eax, 2
add esi, 2
test cl, cl
jne 0x4a8d23
xor eax, eax
jmp 0x4a8d4c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a8d57
xor esi, esi
jmp 0x4a8e15
mov esi, str.tygh12Ggb45_t4_gr5
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a8d86
test cl, cl
je 0x4a8d82
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a8d86
add eax, 2
add esi, 2
test cl, cl
jne 0x4a8d62
xor eax, eax
jmp 0x4a8d8b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a8d96
mov esi, 1
jmp 0x4a8e15
mov esi, str.4gh_hf4dg7_6d8s
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a8dc5
test cl, cl
je 0x4a8dc1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a8dc5
add eax, 2
add esi, 2
test cl, cl
jne 0x4a8da1
xor eax, eax
jmp 0x4a8dca
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4a8dd5
mov esi, 2
jmp 0x4a8e15
mov esi, str.5tresg778Xgf8BN78_4g
lea eax, [ebp - 0x26c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a8e04
test cl, cl
je 0x4a8e00
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a8e04
add eax, 2
add esi, 2
test cl, cl
jne 0x4a8de0
xor eax, eax
jmp 0x4a8e09
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
add ecx, 3
mov esi, ecx
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x4a8e66
mov edx, dword [ebx + 0x2a4]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edx
call edi
mov eax, dword [ebx + 0x2a0]
push eax
call edi
mov ecx, dword [ebx + 0x29c]
push ecx
call edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret