Function at 0x100035d0
Capabilities:
Prepare http request
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10147bb6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x120c
call fcn.10140530
mov eax, dword [0x10189710]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x1180], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1170], edi
mov dword [ebp - 0x117c], ecx
mov dword [ebp - 0x1198], edx
mov dword [ebp - 0x11a4], eax
mov byte [ebp - 0x1175], al
mov dword [ebp - 0x1188], eax
mov dword [ebp - 0x1194], eax
cmp byte [0x101c2e90], al
jne 0x10003656
mov ecx, 0x101c2e90
call fcn.1005b250
xor eax, eax
mov word [ebp - 0x11dc], ax
push eax
mov eax, 0x10153fb4
lea esi, [ebp - 0x11e0]
mov dword [ebp - 0x11c8], 7
mov dword [ebp - 0x11cc], 0
call fcn.10009fd0
xor esi, esi
push 0xffffffffffffffff
mov byte [ebp - 4], 1
push esi
lea ecx, [edi + 0x230]
lea eax, [ebp - 0x11e0]
mov dword [edi + 0x22c], esi
call fcn.10009c90
mov byte [ebp - 4], 0
cmp dword [ebp - 0x11c8], 8
mov dword [edi + 0x228], esi
jb 0x100036c6
mov ecx, dword [ebp - 0x11dc]
push ecx
call fcn.10128f9e
add esp, 4
mov eax, dword [ebp + 0x10]
xor esi, esi
push 0x200
lea ecx, [edi + 0x20]
xor edx, edx
push esi
push ecx
mov dword [ebp - 0x11c8], 7
mov dword [ebp - 0x11cc], esi
mov word [ebp - 0x11dc], dx
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], 0xfffffffe
mov dword [edi + 0x14], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], esi
call fcn.1012e060
add esp, 0xc
push 0x3c
lea edx, [ebp - 0x121c]
push esi
mov dword [edi + 0x220], esi
mov dword [edi + 0x224], esi
mov dword [edi + 4], esi
push edx
mov dword [edi + 8], esi
mov dword [edi + 0x458], esi
mov byte [edi + 0x24c], 0
call fcn.1012e060
lea eax, [ebp - 0xb54]
mov dword [ebp - 0x120c], eax
or eax, 0xffffffff
add esp, 0xc
lea esi, [edi + 0x480]
push str.WinHttpCrackURL__SendRequest_
mov edx, esi
mov dword [ebp - 0x121c], 0x3c
mov dword [ebp - 0x1208], 0x100
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x1214], eax
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003797
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
cmp dword [0x101a8974], 0
je 0x100037c6
mov ecx, dword [ebp - 0x1198]
push ecx
push str._PROC___s__
push 0
call fcn.1006ed90
add esp, 0xc
push ebx
push 0x101542cc
push 0
call fcn.1006ed90
add esp, 0xc
lea edx, [ebp - 0x121c]
push edx
push 0
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x100045d9
cmp dword [0x101a8974], 0
je 0x10003809
movzx eax, word [ebp - 0x1204]
push eax
lea ecx, [ebp - 0xb54]
push ecx
push 0x101542d0
mov edx, esi
call fcn.100027f0
add esp, 0xc
jmp 0x10003820
movzx edx, word [ebp - 0x1204]
push edx
push str.WinHttpConnect_to_Port:_u
mov edx, esi
call fcn.100027f0
add esp, 8
cmp dword [0x101a8978], 0
je 0x10003839
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, dword [ebp - 0x1204]
mov edx, dword [edi + 0x464]
push 0
push eax
lea ecx, [ebp - 0xb54]
push ecx
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0x468], eax
test eax, eax
je 0x100045d9
xor ebx, ebx
cmp dword [ebp - 0x1210], 2
mov edx, esi
setne bl
dec ebx
and ebx, 0x800000
jne 0x10003882
push str.WinHttpOpenRequest__HTTP_
jmp 0x10003887
push str.WinHttpOpenRequest__HTTPS_
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x100038a8
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, dword [ebp - 0x1180]
test eax, eax
je 0x100038fe
cmp byte [eax], 0
je 0x100038fe
push str.WinHttpOpenRequest__POST_
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x100038df
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, dword [ebp - 0x11f0]
mov ecx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push eax
push str.POST
push ecx
jmp 0x10003992
cmp dword [ebp + 0x20], 0
mov edx, esi
jne 0x10003948
push str.WinHttpOpenRequest__GET_
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000392c
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov edx, dword [ebp - 0x11f0]
mov eax, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push edx
push 0x10154414
push eax
jmp 0x10003992
push str.WinHttpOpenRequest__GET___Only_Response_Header_
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000396e
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [ebp - 0x11f0]
mov edx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push ecx
push 0x10154414
mov dword [edi + 0x458], 1
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x46c], eax
test eax, eax
je 0x100045d9
push 0x10154480
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x100039ce
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
push esi
lea eax, [edi + 0x350]
push 0x10153fb0
push eax
call fcn.1006ed90
mov ecx, dword [edi + 0x46c]
add esp, 0xc
push 0
push 0x7f4000
push 0x10005340
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
test eax, eax
jne 0x100045d9
push 0x103
push eax
lea edx, [ebp - 0x123]
push edx
mov byte [ebp - 0x124], al
call fcn.1012e060
add esp, 0xc
push 0x103
lea eax, [ebp - 0x22b]
push 0
push eax
mov byte [ebp - 0x22c], 0
call fcn.1012e060
add esp, 0xc
push str.Reading_ProxyUserName_and_ProxyPassword_from_HKLMSoftwareMicroWorld...
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003a64
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov ebx, 0x104
push str.ProxyUserName
lea eax, [ebp - 0x1190]
lea edi, [ebp - 0x124]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.WS2_32.dll_bind
mov dword [ebp - 0x1190], ebx
call fcn.10059d80
push str.ProxyPassword
lea eax, [ebp - 0x1190]
lea edi, [ebp - 0x22c]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.WS2_32.dll_bind
mov dword [ebp - 0x1190], ebx
call fcn.10059d80
cmp byte [ebp - 0x124], 0
je 0x10003bfe
cmp byte [ebp - 0x22c], 0
je 0x10003bfe
xor eax, eax
lea ebx, [ebp - 0x1174]
lea edi, [ebp - 0x124]
mov dword [ebp - 0x1174], eax
mov dword [ebp - 0x1184], eax
call fcn.10073b70
test eax, eax
je 0x10003bd6
lea ebx, [ebp - 0x1184]
lea edi, [ebp - 0x22c]
call fcn.10073b70
test eax, eax
je 0x10003bd6
push str.WinHttpSetCredentials_2_
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003b37
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
cmp dword [0x101c2f94], 0
jne 0x10003b69
call fcn.100831a0
mov edi, dword [ebp - 0x1174]
test eax, eax
je 0x10003b5d
push edi
push str._Proxy_authentication_set_2_:__s:_n
call fcn.1012854e
add esp, 8
mov dword [0x101c2f94], 1
jmp 0x10003b6f
mov edi, dword [ebp - 0x1174]
cmp dword [0x101a8978], 0
je 0x10003b88
push edi
push str._Proxy_authentication_set_2_:__S:
push 0
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [ebp - 0x1184]
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x46c]
push 0
push ecx
push edi
push 1
push 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x10003bdc
test edi, edi
je 0x10003bba
push edi
call fcn.10128243
add esp, 4
mov eax, dword [ebp - 0x1184]
test eax, eax
je 0x100045d3
push eax
call fcn.10128243
add esp, 4
jmp 0x100045d3
mov edi, dword [ebp - 0x1174]
test edi, edi
je 0x10003be9
push edi
call fcn.10128243
add esp, 4
mov eax, dword [ebp - 0x1184]
test eax, eax
je 0x10003c26
push eax
call fcn.10128243
add esp, 4
jmp 0x10003c26
push str.NO_proxy_username_pwd_defined
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003c26
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov ecx, str.Connection:_Close
lea edx, [ebp - 0x116c]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10003c31
mov edi, dword [ebp - 0x1170]
mov edx, dword [edi + 0x46c]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
lea ecx, [ebp - 0x116c]
push ecx
push edx
call ebx
mov eax, dword [ebp - 0x11a4]
test eax, eax
je 0x10003c85
cmp word [eax], ax
je 0x10003c85
push 0x20000000
push 0xffffffffffffffff
push eax
mov eax, dword [edi + 0x46c]
push eax
call ebx
mov esi, dword [ebp + 0x1c]
cmp esi, 2
jne 0x10003cc8
mov ecx, str.X_Nimbus_APIKey:_2162EB2F_62A6_4141_A24E_AB1B5C7C3EAF
lea edx, [ebp - 0xd5c]
jmp 0x10003ca0
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10003ca0
mov edx, dword [edi + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea ecx, [ebp - 0xd5c]
push ecx
push edx
call ebx
cmp esi, 1
jne 0x10003e2d
push 0x103
lea eax, [ebp - 0x543]
push 0
push eax
mov byte [ebp - 0x544], 0
call fcn.1012e060
add esp, 0xc
mov ecx, str.X_Nimbus_UUID:
lea edx, [ebp - 0x74c]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10003d00
lea eax, [ebp - 0x74c]
cmp word [eax], 0
je 0x10003d22
add eax, 2
jmp 0x10003d17
xor ecx, ecx
mov word [eax], cx
mov edx, 0x101c2e90
lea esp, [esp]
mov cl, byte [edx]
test cl, cl
je 0x10003d43
movzx cx, cl
mov word [eax], cx
add eax, 2
inc edx
jmp 0x10003d30
xor edx, edx
push 0x20000000
mov word [eax], dx
push 0xffffffffffffffff
lea eax, [ebp - 0x74c]
mov ecx, edi
mov edx, dword [ecx + 0x46c]
push eax
push edx
call ebx
push str.NCId
lea eax, [ebp - 0x11a8]
lea edi, [ebp - 0x544]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.WS2_32.dll_bind
mov dword [ebp - 0x11a8], 0x104
call fcn.10059d80
mov ecx, str.X_Nimbus_ClientID:
lea edx, [ebp - 0x74c]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10003d96
cmp byte [ebp - 0x544], al
jne 0x10003ddc
lea edi, [ebp - 0x74c]
add edi, 0xfffffffe
jmp 0x10003dc0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10003dc0
mov ecx, 0x12
mov esi, str.45403B8E_207A_45CF_AF7F_1050D4AAE746
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x10003e10
lea ecx, [ebp - 0x74c]
cmp word [ecx], 0
je 0x10003ded
add ecx, 2
jmp 0x10003de2
xor eax, eax
mov word [ecx], ax
lea edx, [ebp - 0x544]
mov al, byte [edx]
test al, al
je 0x10003e0b
movzx ax, al
mov word [ecx], ax
add ecx, 2
inc edx
jmp 0x10003df8
xor edx, edx
mov word [ecx], dx
mov ecx, dword [ebp - 0x1170]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea eax, [ebp - 0x74c]
push eax
push edx
call ebx
mov eax, 0x1bb
cmp word [ebp - 0x1204], ax
jne 0x10003fef
test byte [0x101cd9d8], 1
mov dword [ebp - 0x119c], 0
jne 0x10003e63
or dword [0x101cd9d8], 1
call fcn.1006bad0
mov dword [0x101cd9d4], eax
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x46c]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea ecx, [ebp - 0x119c]
push ecx
push 0x1f
push eax
mov dword [ebp - 0x119c], 0x3300
call edi
test eax, eax
jne 0x10003eb7
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, dword [ebp - 0x1170]
push eax
add esi, 0x480
push str.WINHTTP_OPTION_SECURITY_FLAGS_Set_Error__LastErr:_d_
mov edx, esi
call fcn.100027f0
add esp, 8
jmp 0x10003ed8
mov esi, dword [ebp - 0x1170]
add esi, 0x480
push str.WINHTTP_OPTION_SECURITY_FLAGS_Successfully_Set
mov edx, esi
call fcn.100027f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003ef1
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
cmp dword [0x101cd9d4], 0
jne 0x10003f61
mov eax, dword [ebp - 0x1198]
test eax, eax
je 0x10003f61
cmp byte [eax], 0
je 0x10003f61
push 0
push str.abusedb
push eax
call fcn.10063340
add esp, 0xc
cmp eax, 0xffffffff
je 0x10003f61
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x464]
push 4
lea ecx, [ebp - 0x11a0]
push ecx
push 0x54
push eax
mov dword [ebp - 0x11a0], 0x20
call edi
test eax, eax
jne 0x10003f5a
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Set_Error__LastErr:_d_
mov edx, esi
call fcn.100027f0
add esp, 8
jmp 0x10003fac
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Successfully_Set__WINHTTP_FLAG_SECURE_PROTOCOL_SSL3_
jmp 0x10003fa2
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x464]
push 4
lea ecx, [ebp - 0x118c]
push ecx
push 0x54
push eax
mov dword [ebp - 0x118c], 0xa80
call edi
test eax, eax
jne 0x10003f9d
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Set_Error__LastErr:_d_
mov edx, esi
call fcn.100027f0
add esp, 8
jmp 0x10003fac
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Successfully_Set__TLS1__TLS1_1__TLS1_2_
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x10003fc5
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [ebp - 0x1170]
mov edx, dword [ecx + 0x46c]
push 0
push 0
push 0x2f
push edx
call edi
test eax, eax
jne 0x10003fe0
call ebx
push 0x10154aac
mov edx, esi
call fcn.100027f0
add esp, 4
mov ebx, dword [ebp - 0x1180]
test ebx, ebx
je 0x10004520
cmp byte [ebx], 0
je 0x10004520
mov eax, str.ThisIsDataStream_
mov ecx, ebx
call fcn.1005a140
test eax, eax
je 0x100042f1
push 0x103
lea eax, [ebp - 0x43b]
push 0
push eax
mov byte [ebp - 0x43c], 0
call fcn.1012e060
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x333]
push 0
push ecx
mov byte [ebp - 0x334], 0
call fcn.1012e060
mov edi, dword [ebp - 0x1170]
lea esi, [edi + 0x480]
add esp, 0xc
push 0x10154ae4
mov edx, esi
mov dword [ebp - 0x1174], esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000408e
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov edx, dword [edi + 0x46c]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_multipart_form_data__boundary____________ThIs_Is_tHe_bouNdaRY__
push edx
call esi
test eax, eax
je 0x1000462f
push 0xa0000000
push 0xffffffffffffffff
mov eax, edi
mov ecx, dword [eax + 0x46c]
push str.User_Agent:_VirusTotal_Uploader_2.0
push ecx
call esi
test eax, eax
je 0x1000462f
push 0xa0000000
push 0xffffffffffffffff
mov edx, edi
mov eax, dword [edx + 0x46c]
push str.Cache_Control:_no_cache
push eax
call esi
test eax, eax
je 0x1000462f
mov esi, dword [ebp - 0x1174]
push str.IsFilePresent__
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000411d
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
push 1
push 0
xor edx, edx
mov ecx, ebx
call fcn.10060eb0
add esp, 8
test eax, eax
jne 0x100042e2
mov eax, dword [ebp - 0x117c]
test eax, eax
je 0x10004154
cmp byte [eax], 0
je 0x10004154
push eax
lea ecx, [ebp - 0x43c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x10004165
lea edx, [ebp - 0x43c]
push edx
mov ecx, ebx
call fcn.100620f0
add esp, 4
push str.ReadFromFile__
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000418d
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
push ebx
xor ecx, ecx
lea edx, [ebp - 0x1188]
call fcn.1007a110
mov edi, eax
add esp, 4
mov dword [ebp - 0x1180], edi
test edi, edi
jbe 0x100045d3
cmp dword [ebp - 0x1188], 0
je 0x100045d3
cmp dword [ebp + 0x18], 0
je 0x100041cc
mov eax, dword [ebp - 0x1170]
call fcn.10006300
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x334]
push str.______________ThIs_Is_tHe_bouNdaRY___r_nContent_Disposition:_form_data_name_archivo__filename__s__r_nContent_Type:_application_x_msdownload_r_n_r_n
push ecx
call fcn.10127dc0
add esp, 0xc
lea edx, [ebp - 0x334]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea edi, [esi + edi + 0x2a]
mov dword [ebp - 0x118c], edi
inc edi
push edi
call fcn.101264a0
mov ecx, dword [ebp - 0x1170]
add esp, 4
mov dword [ecx + 0x884], eax
test eax, eax
je 0x100045cd
push edi
push 0
push eax
call fcn.1012e060
mov ebx, dword [ebp - 0x1170]
mov eax, dword [ebx + 0x884]
add esp, 0xc
push esi
lea edx, [ebp - 0x334]
push edx
push eax
call fcn.10130710
mov ecx, dword [ebp - 0x1180]
mov edx, dword [ebp - 0x1188]
mov eax, dword [ebx + 0x884]
add esp, 0xc
push ecx
push edx
add eax, esi
push eax
call fcn.10130710
mov edi, dword [ebx + 0x884]
add edi, esi
add edi, dword [ebp - 0x1180]
mov ecx, 0xa
mov esi, str._r_n______________ThIs_Is_tHe_bouNdaRY_____r_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x1174]
add esp, 0xc
push str.WinHttpSendRequest_POST_
mov edx, esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x100042b0
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov eax, dword [ebp - 0x118c]
mov ecx, dword [ebx + 0x884]
mov edx, dword [ebx + 0x46c]
push ebx
push eax
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x100045cd
mov eax, esi
mov ecx, ebx
jmp 0x100045b1
mov dword [ebp - 0x1194], 1
jmp 0x100045d9
mov esi, dword [ebp - 0x1170]
add esi, 0x480
push str.WinHttpAddRequestHeadersData
mov edx, esi
mov dword [ebp - 0x1174], esi
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000432b
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov edi, dword [ebp - 0x117c]
mov eax, str.analyticdata:
mov ecx, edi
call fcn.1005a140
test eax, eax
je 0x100043e9
mov eax, str.fname
mov ecx, edi
call fcn.1005a140
test eax, eax
je 0x100043e9
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept:__
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x100045cd
mov ecx, dword [ebp - 0x1170]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept_Encoding:_gzip_deflate
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x100045cd
cmp dword [ebp + 0x1c], 2
push 0x20000000
push 0xffffffffffffffff
jne 0x100043c8
mov eax, dword [ebp - 0x1170]
mov ecx, dword [eax + 0x46c]
push str.Content_Type:_application_json
push ecx
jmp 0x10004425
mov edx, dword [ebp - 0x1170]
mov eax, dword [edx + 0x46c]
push str.Content_Type:_application_octet_stream
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x10004433
jmp 0x100045d3
mov eax, str.fname
mov ecx, edi
call fcn.1005a140
test eax, eax
jne 0x1000440c
push 0x1014d5e3
push str.fname
push edi
call fcn.10064100
add esp, 0xc
mov ecx, dword [ebp - 0x1170]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_text_plain
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x100045cd
add ebx, 0x11
push ebx
call fcn.10128238
mov esi, eax
add esp, 4
test esi, esi
jbe 0x100045cd
test edi, edi
je 0x100045cd
cmp dword [ebp + 0x18], 0
je 0x10004462
mov eax, dword [ebp - 0x1170]
call fcn.10006300
lea edi, [esi + 1]
push edi
call fcn.101264a0
mov ecx, dword [ebp - 0x1170]
add esp, 4
mov dword [ecx + 0x884], eax
test eax, eax
je 0x100045cd
push edi
push 0
push eax
call fcn.1012e060
mov edx, dword [ebp - 0x117c]
mov edi, dword [ebp - 0x1170]
mov eax, dword [edi + 0x884]
add esp, 0xc
push esi
push edx
push eax
call fcn.10130710
mov ebx, dword [ebp - 0x1174]
add esp, 0xc
push str.WinHttpSendRequest_POSTDATA_
mov edx, ebx
call fcn.100027f0
add esp, 4
cmp dword [0x101a8978], 0
je 0x100044d9
push ebx
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov ecx, dword [edi + 0x884]
mov edx, dword [edi + 0x46c]
push edi
push esi
push esi
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x100045cd
mov eax, ebx
push eax
mov ecx, edi
add ecx, 0x350
push 0x10153fb0
push ecx
call fcn.1006ed90
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x100045c6
cmp dword [ebp + 0x20], 0
mov edi, dword [ebp - 0x1170]
jne 0x10004546
lea esi, [edi + 0x480]
push str.WinHttpSendRequest_GET_
mov edx, esi
mov dword [ebp - 0x1174], esi
call fcn.100027f0
jmp 0x10004562
lea edx, [edi + 0x480]
push str.WinHttpSendRequest_HEAD_
mov dword [ebp - 0x1174], edx
call fcn.100027f0
mov esi, dword [ebp - 0x1174]
add esp, 4
cmp dword [0x101a8978], 0
je 0x1000457e
push esi
push 0x10153fb0
push 0
call fcn.1006ed90
add esp, 0xc
mov edx, dword [edi + 0x46c]
push edi
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x100045cd
push 0x101a8988
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x1174]
mov ecx, dword [ebp - 0x1170]
push eax
add ecx, 0x350
push 0x10153fb0
push ecx
call fcn.1006ed90
add esp, 0xc
mov byte [ebp - 0x1175], 1
mov esi, dword [ebp - 0x1174]
mov edi, dword [ebp - 0x1170]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x117c], eax
mov eax, dword [ebp - 0x1188]
test eax, eax
je 0x100045f8
push eax
call fcn.10128243
add esp, 4
cmp byte [ebp - 0x1175], 0
jne 0x100046fc
mov ecx, dword [ebp - 0x117c]
lea ebx, [ebp - 0xf64]
call fcn.10002bf0
xor ebx, ebx
cmp dword [ebp - 0x1194], ebx
jne 0x10004637
lea edx, [ebp - 0xf64]
push edx
push esi
push str._s_failed___s
jmp 0x10004644
mov esi, dword [ebp - 0x1174]
jmp 0x100045d9
mov eax, dword [ebp - 0x117c]
push eax
push esi
push str._s_failed__File_Absent___u_
lea edx, [ebp - 0x954]
call fcn.100027f0
add esp, 0xc
xor ecx, ecx
lea eax, [ebp - 0x954]
mov dword [ebp - 0x11ac], 7
mov dword [ebp - 0x11b0], ebx
mov word [ebp - 0x11c0], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10004674
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x954]
lea esi, [ebp - 0x11c4]
call fcn.10009fd0
push 0xffffffffffffffff
mov byte [ebp - 4], 2
push ebx
lea ecx, [edi + 0x230]
mov eax, esi
mov dword [edi + 0x22c], 1
call fcn.10009c90
mov edx, dword [ebp - 0x117c]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x11ac], 8
mov dword [edi + 0x228], edx
jb 0x100046da
mov eax, dword [ebp - 0x11c0]
push eax
call fcn.10128f9e
add esp, 4
xor ecx, ecx
mov word [ebp - 0x11c0], cx
push 2
mov ecx, edi
mov dword [ebp - 0x11ac], 7
mov dword [ebp - 0x11b0], ebx
call fcn.10004b60
mov al, byte [ebp - 0x1175]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10127db1
mov esp, ebp
pop ebp
ret 0x1c