Function at 0x426100
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Link many functions at runtime
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d40e8
mov eax, dword fs:[0]
push eax
mov eax, 0x1806c
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x1805c], esi
mov ebx, ecx
mov dword [ebp - 0x18010], ebx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x18078], ebx
mov dword [ebp - 0x17fd8], eax
mov dword [ebp - 0x18018], edi
mov dword [ebp - 0x17ff4], 0
call fcn.00425280
test al, al
je 0x426217
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17fd0], eax
mov dword [ebp - 4], 1
mov eax, str.this_module_doesnt_support_file_request
test eax, 0xffff0000
jne 0x4261b9
movzx esi, ax
mov ecx, esi
call fcn.00401b90
test eax, eax
je 0x4261c9
push esi
push eax
lea ecx, [ebp - 0x17fd0]
call fcn.00402860
jmp 0x4261c9
push str.this_module_doesnt_support_file_request
lea ecx, [ebp - 0x17fd0]
call fcn.00403570
mov dword [ebp - 4], 2
lea edx, [ebp - 0x17fd0]
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x17fd0]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428422
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x428422
test esi, esi
jne 0x426271
push str.InternetOpen_Failed
lea ecx, [ebp - 0x17fd8]
call fcn.004033d0
mov dword [ebp - 4], 4
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x17fd8]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x428422
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x428422
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17fe8], eax
mov dword [ebp - 4], 7
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17ff0], eax
mov byte [ebp - 4], 9
push 0x51c3b0
mov ecx, edi
mov dword [ebp - 0x17fd0], 0
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17fcc], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17fe4]
call fcn.0041c510
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x17fd0]
push eax
lea eax, [ebp - 0x17ff0]
push eax
lea edx, [ebp - 0x17fe8]
lea ecx, [ebp - 0x17fe4]
call fcn.00424f00
movzx eax, al
add esp, 0x20
test eax, eax
jne 0x4263d4
push str.InternetCrackUrl_Failed
lea ecx, [ebp - 0x17fd8]
call fcn.004033d0
mov byte [ebp - 4], 0xc
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x17fd8]
add edx, 0xfffffff0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x426361
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x17fe4]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x426384
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x17ff0]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4263a7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x17fe8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x428422
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x428422
push 0x51c3c8
mov ecx, edi
mov byte [ebp - 0x17fd1], 0
call fcn.0042ef30
test al, al
je 0x426416
push str.redirectCheck
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 5
jne 0x426416
push 0x51c3f0
mov ecx, edi
call fcn.0042edc0
mov ecx, eax
call fcn.0042e7d0
mov byte [ebp - 0x17fd1], al
push ecx
mov ecx, dword [ebp - 0x17fe4]
mov esi, esp
lea ecx, [ecx - 0x10]
mov byte [ebp - 0x17fc1], 0
mov dword [ebp - 0x17fc8], 0x50
mov dword [ebp - 0x17fcc], esp
mov dword [ebp - 0x1801c], esi
call fcn.00402720
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x17fc8]
lea ecx, [ebp - 0x17fc1]
call fcn.00424fe0
add esp, 4
mov ecx, edi
push str.port
call fcn.0042edc0
cmp byte [eax + 8], 1
jne 0x42648c
push 0x51c410
mov ecx, edi
call fcn.0042edc0
mov ecx, eax
call fcn.0042e3f0
jmp 0x42649b
mov eax, dword [ebp - 0x17fd0]
test eax, eax
cmove eax, dword [ebp - 0x17fc8]
mov ecx, dword [ebp - 0x17fd8]
push eax
lea edx, [ebp - 0x17fe8]
mov dword [ebp - 0x17fd0], eax
mov byte [ebp - 0x17fc2], 0
call fcn.004250d0
mov esi, eax
add esp, 4
mov dword [ebp - 0x17fe0], esi
test esi, esi
jne 0x426568
mov eax, dword [0x53fb04]
test eax, eax
jne 0x426501
push 0x51c434
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4264f8
push str.InternetConnectW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x53fb04], eax
jmp 0x4264fd
mov eax, dword [0x53fb04]
test eax, eax
je 0x42652b
push 0
push 0
push 3
push 0
push 0
push dword [ebp - 0x17fd0]
push dword [ebp - 0x17fe8]
push dword [ebp - 0x1805c]
call eax
mov esi, eax
mov dword [ebp - 0x17fe0], eax
test esi, esi
jne 0x426561
push str.InternetConnect_Failed
lea ecx, [ebp - 0x17fd8]
call fcn.004033d0
mov byte [ebp - 4], 0x13
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x17fd8]
jmp 0x4283f0
mov byte [ebp - 0x17fc2], 1
cmp byte [ebp - 0x17fd1], 0
mov eax, 0x80400200
mov ecx, 0x80600200
cmovne eax, ecx
or eax, 0xc000
cmp byte [ebp - 0x17fc1], 0
mov dword [ebp - 0x17fd0], eax
je 0x42659b
or eax, 0x803080
mov dword [ebp - 0x17fd0], eax
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18008], eax
mov byte [ebp - 4], 0x18
push 0x51c44c
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x42661a
push 0x51c474
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17fcc], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x17fd8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x18008]
call fcn.00402510
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17ff8], eax
mov byte [ebp - 4], 0x1c
push 0x51c46c
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x426699
push str.version
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17fcc], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x17fd8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x17ff8]
call fcn.00402510
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1800c], eax
mov byte [ebp - 4], 0x20
push 0x51c47c
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x426718
push str.referer
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17fcc], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x17fd8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x1800c]
call fcn.00402510
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18004], eax
mov byte [ebp - 4], 0x24
push 0x51c48c
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x426797
push 0x51c4b8
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x17fcc], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x17fd8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x18004]
call fcn.00402510
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov eax, dword [ebp - 0x18004]
mov edx, dword [ebp - 0x1800c]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x18070], ecx
cmove eax, ecx
mov ecx, dword [ebp - 0x17ff8]
mov dword [ebp - 0x18074], eax
xor eax, eax
cmp dword [edx - 0xc], eax
push 1
push dword [ebp - 0x17fd0]
cmove edx, eax
cmp dword [ecx - 0xc], eax
cmove ecx, eax
mov eax, dword [ebp - 0x18008]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
cmove eax, ebx
lea ebx, [ebp - 0x18074]
push ebx
push edx
push ecx
push dword [ebp - 0x17ff0]
push eax
push esi
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ebx, dword [ebp - 0x18010]
mov esi, eax
mov dword [ebp - 0x17fd0], esi
test esi, esi
jne 0x426840
push str.HttpOpenRequest_Failed
lea ecx, [ebp - 0x17fd8]
call fcn.004033d0
mov byte [ebp - 4], 0x27
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x17fd8]
jmp 0x4283b4
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17fec], eax
mov byte [ebp - 4], 0x29
push 0x51c4cc
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x42695f
push 0x51c4c4
lea ecx, [ebp - 0x17fc8]
call fcn.00402400
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x17fc8]
push eax
push str.contentType
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x17fcc]
call fcn.0041c510
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 0x2c
push str.Content_Type:
lea ecx, [ebp - 0x1801c]
call fcn.004033d0
mov byte [ebp - 4], 0x2d
push esi
mov edx, eax
lea ecx, [ebp - 0x1805c]
call fcn.0041c910
add esp, 4
mov byte [ebp - 4], 0x2e
mov edx, eax
lea ecx, [ebp - 0x17fd8]
call fcn.0041c910
add esp, 4
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x17fec]
call fcn.00402510
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x1805c]
call fcn.004024b0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1801c]
call fcn.004024b0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
mov esi, dword [ebp - 0x17fd0]
push 0x51c510
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x4269fd
push 0x51c4f4
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17fcc]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x31
mov eax, dword [eax]
lea ecx, [ebp - 0x17fec]
push dword [eax - 0xc]
push eax
call fcn.0040fda0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
lea eax, [ebp - 0x17fec]
push eax
lea ecx, [ebp - 0x17fc8]
call fcn.00403370
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x17fc8]
call fcn.00428440
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x17ffc], eax
mov byte [ebp - 4], 0x34
push str.postData
mov ecx, edi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x426a7c
push 0x51c52c
mov ecx, edi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x17fcc]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x17ffc]
call fcn.00402510
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov ecx, dword [ebp - 0x17ffc]
lea ecx, [ecx - 0x10]
call fcn.00402720
add eax, 0x10
mov dword [ebp - 0x18000], eax
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x17ffc]
mov eax, dword [eax - 0xc]
add eax, eax
cmp byte [ebp - 0x17fd1], 0
mov dword [ebp - 0x17fcc], eax
je 0x426ae2
push 4
lea eax, [ebp - 0x17fc8]
push eax
push 6
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
mov dword [ebp - 0x17fc8], 0x2710
call esi
push 4
lea eax, [ebp - 0x17fc8]
push eax
push 5
push dword [ebp - 0x17fd0]
call esi
mov eax, dword [ebp - 0x17fec]
xor edx, edx
cmp dword [eax - 0xc], edx
mov ecx, eax
cmove ecx, edx
mov dword [ebp - 0x1801c], ecx
mov ecx, dword [ebp - 0x18000]
mov esi, 1
sub esi, dword [ecx - 4]
mov edx, dword [ecx - 8]
or edx, esi
jge 0x426b26
push 0
lea ecx, [ebp - 0x18000]
call fcn.004026b0
mov eax, dword [ebp - 0x17fec]
mov ecx, dword [ebp - 0x18000]
push dword [ebp - 0x17fcc]
push ecx
push dword [eax - 0xc]
push dword [ebp - 0x1801c]
call fcn.004234d0
mov esi, dword [ebp - 0x17fd0]
mov edx, esi
mov ecx, eax
call fcn.00435090
test eax, eax
jne 0x426bfb
call fcn.004244f0
test al, al
jne 0x426b63
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
lea ecx, [ebp - 0x18010]
call fcn.00421960
mov byte [ebp - 4], 0x39
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x426b8c
push dword [ebp - 0x17fe0]
call esi
push str.HttpSendRequest_Failed_with:
lea ecx, [ebp - 0x1801c]
call fcn.004033d0
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x18010]
push ecx
mov edx, eax
lea ecx, [ebp - 0x17fcc]
call fcn.0041c910
add esp, 4
mov byte [ebp - 4], 0x3b
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x1801c]
call fcn.004024b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x18010]
jmp 0x428387
mov ecx, edi
call fcn.004251c0
test al, al
jne 0x426d13
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x426c24
push dword [ebp - 0x17fe0]
call esi
mov eax, dword [ebp - 0x18038]
and eax, 0xffffff00
mov dword [ebp - 0x18038], eax
and eax, 0xfffffeff
mov dword [ebp - 0x18038], eax
mov dword [ebp - 0x18034], 0
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x18028]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x18028], eax
mov dword [ebp - 0x18024], 0
mov byte [ebp - 0x18030], 1
mov byte [ebp - 4], 0x42
lea eax, [ebp - 0x18030]
push eax
push ecx
push 0x51c544
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x18030]
call fcn.0042e0c0
push str.no_response_needed
lea ecx, [ebp - 0x18058]
call fcn.0042ddf0
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x18058]
push eax
push ecx
push 0x51c580
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
lea eax, [ebp - 0x18040]
push eax
mov ecx, ebx
call fcn.0042df60
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x18040]
call fcn.0042e0c0
jmp 0x42838c
push 0x400
lea eax, [ebp - 0x417]
push 0
push eax
mov byte [ebp - 0x418], 0
call fcn.004b1a50
add esp, 0xc
mov dword [ebp - 0x1806c], 0x400
push 0x51c5a0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x426d99
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x426d63
push dword [ebp - 0x17fe0]
call esi
push 0x51c588
lea ecx, [ebp - 0x17fcc]
call fcn.004033d0
mov byte [ebp - 4], 0x44
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17fcc]
jmp 0x428387
push 0x51c5d0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x426e57
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push esi
call edi
mov esi, dword [0x53ed90]
mov eax, esi
imul eax, esi
imul eax, esi
and eax, 0x8000000f
jns 0x426dd0
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 2
jne 0x426e10
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x63]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004abd49
add esp, 4
push eax
call fcn.004acddb
add esp, 4
cmp byte [ebp - 0x17fc2], 0
je 0x426e21
push dword [ebp - 0x17fe0]
call edi
push 0x51c5b8
lea ecx, [ebp - 0x17fcc]
call fcn.004033d0
mov byte [ebp - 4], 0x45
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17fcc]
jmp 0x428387
push 0
lea ecx, [ebp - 0x1806c]
push ecx
lea ecx, [ebp - 0x418]
push ecx
push 0x13
push esi
call eax
test eax, eax
jne 0x426eef
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov edx, dword [0x53ed90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x13
idiv ecx
mov eax, dword [0x53f4ac]
mov ecx, 0x64042132
cmp edx, 8
cmove eax, ecx
cmp byte [ebp - 0x17fc2], 0
mov dword [0x53f4ac], eax
je 0x426eb9
push dword [ebp - 0x17fe0]
call esi
push str.HttpQueryInfo_Failed
lea ecx, [ebp - 0x17fcc]
call fcn.004033d0
mov byte [ebp - 4], 0x46
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17fcc]
jmp 0x428387
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x17fdc]
call fcn.004241e0
mov byte [ebp - 4], 0x47
push 0x51c5e0
mov ecx, edi
mov byte [ebp - 0x17fc1], 0
call fcn.0042edc0
mov edi, eax
mov al, byte [edi + 8]
test al, al
je 0x4270bc
cmp al, 6
je 0x4270bc
cmp al, 7
jne 0x4270a7
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x17fd8], esi
call fcn.0042e840
test eax, eax
jle 0x427291
lea esp, [esp]
lea ecx, [ebp - 0x17fc8]
call fcn.004023a0
mov byte [ebp - 4], 0x4d
push esi
lea eax, [ebp - 0x17fc8]
push 0x51c614
push eax
call fcn.00428640
add esp, 0xc
mov ecx, edi
push dword [ebp - 0x17fc8]
call fcn.0042edc0
cmp byte [eax + 8], 4
push dword [ebp - 0x17fc8]
mov ecx, edi
jne 0x426fe4
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x17fcc]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x4f
mov edx, eax
lea ecx, [ebp - 0x17fdc]
call fcn.00417e30
mov byte [ebp - 0x17fc1], al
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
jmp 0x427060
call fcn.0042edc0
cmp byte [eax + 8], 1
jne 0x427069
lea ecx, [ebp - 0x1801c]
call fcn.004023a0
mov esi, eax
mov byte [ebp - 4], 0x50
push dword [ebp - 0x17fc8]
mov ecx, edi
call fcn.0042edc0
mov ecx, eax
call fcn.0042e3f0
push eax
mov edx, esi
lea ecx, [ebp - 0x1805c]
call fcn.0041c850
add esp, 4
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x1801c]
call fcn.004024b0
lea edx, [ebp - 0x1805c]
lea ecx, [ebp - 0x17fdc]
call fcn.00417e30
mov byte [ebp - 0x17fc1], al
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1805c]
call fcn.004024b0
mov esi, dword [ebp - 0x17fd8]
cmp byte [ebp - 0x17fc1], 0
jne 0x427093
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
inc esi
mov ecx, edi
mov dword [ebp - 0x17fd8], esi
call fcn.0042e840
cmp esi, eax
jl 0x426f50
jmp 0x427291
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
jmp 0x427283
mov edx, 0x51c60c
lea ecx, [ebp - 0x17fdc]
call fcn.00417e80
jmp 0x427289
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x17fc8], esi
call fcn.0042e840
test eax, eax
jle 0x4271d9
push esi
mov ecx, edi
call fcn.0042eaf0
cmp byte [eax + 8], 4
push esi
mov ecx, edi
jne 0x42713b
call fcn.0042eaf0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x48
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x17fcc]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x49
mov edx, eax
lea ecx, [ebp - 0x17fdc]
call fcn.00417e30
mov bl, al
mov byte [ebp - 0x17fc1], bl
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
jmp 0x4271b9
call fcn.0042eaf0
cmp byte [eax + 8], 1
jne 0x4271bd
lea ecx, [ebp - 0x1801c]
call fcn.004023a0
mov esi, eax
mov byte [ebp - 4], 0x4a
push dword [ebp - 0x17fc8]
mov ecx, edi
call fcn.0042eaf0
mov ecx, eax
call fcn.0042e3f0
push eax
mov edx, esi
lea ecx, [ebp - 0x17fd8]
call fcn.0041c850
add esp, 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1801c]
call fcn.004024b0
lea edx, [ebp - 0x17fd8]
lea ecx, [ebp - 0x17fdc]
call fcn.00417e30
mov bl, al
mov byte [ebp - 0x17fc1], al
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x17fd8]
call fcn.004024b0
mov esi, dword [ebp - 0x17fc8]
test bl, bl
jne 0x4271d3
inc esi
mov ecx, edi
mov dword [ebp - 0x17fc8], esi
call fcn.0042e840
cmp esi, eax
jl 0x4270d3
mov ebx, dword [ebp - 0x18010]
mov esi, dword [0x53ed90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x14
idiv ecx
cmp edx, 0x13
jne 0x427283
xor edx, edx
mov edi, edi
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x427200
mov dword [0x53ed90], esi
mov al, byte [ebp - 0x17fc1]
test al, al
jne 0x42731a
push dword [ebp - 0x17fd0]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x4272b0
push dword [ebp - 0x17fe0]
call esi
push 3
push dword [ebp - 0x17fdc]
lea eax, [ebp - 0x17fbc]
lea ecx, [ebp - 0x17fc0]
mov dword [ebp - 0x17fc0], eax
call fcn.004182b0
mov byte [ebp - 4], 0x53
push dword [ebp - 0x17fc0]
call fcn.004ad81d
add esp, 4
mov edx, eax
mov ecx, ebx
call fcn.00424c30
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x17fc0]
lea ecx, [ebp - 0x17fbc]
cmp eax, ecx
je 0x42837d
push eax
call fcn.004ad114
add esp, 4
jmp 0x42837d
push 0x51c354
mov dword [ebp - 0x18064], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42735b
push str.HttpQueryInfoW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [ebp - 0x17fd0]
test eax, eax
je 0x427361
push 0
lea ecx, [ebp - 0x18064]
push ecx
push 0
push 0x16
push edi
call eax
jmp 0x427361
mov edi, dword [ebp - 0x17fd0]
lea ecx, [ebp - 0x18014]
call fcn.004023a0
mov byte [ebp - 4], 0x54
mov eax, dword [ebp - 0x18064]
test eax, eax
je 0x4273eb
push eax
call fcn.004abd49
mov esi, eax
add esp, 4
test esi, esi
je 0x4273eb
push 0x51c628
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x4273b7
push 0x51c618
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4273b7
push 0
lea ecx, [ebp - 0x18064]
push ecx
push esi
push 0x16
push edi
call eax
push esi
lea ecx, [ebp - 0x17fcc]
call fcn.004241e0
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x18014]
call fcn.00402510
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
push esi
call fcn.004acddb
add esp, 4
cmp byte [ebp - 0x17fd1], 0
je 0x427908
mov eax, dword [ebp - 0x18038]
and eax, 0xffffff00
mov dword [ebp - 0x18038], eax
and eax, 0xfffffeff
mov dword [ebp - 0x18038], eax
mov dword [ebp - 0x18034], 0
mov byte [ebp - 4], 0x5b
mov edx, 0x51c648
lea ecx, [ebp - 0x17fdc]
call fcn.00417ed0
test al, al
je 0x42749e
mov edx, 0x51c640
lea ecx, [ebp - 0x17fdc]
call fcn.00417ed0
test al, al
je 0x42749e
mov edx, 0x51c658
lea ecx, [ebp - 0x17fdc]
call fcn.00417ed0
test al, al
je 0x42749e
mov edx, 0x51c650
lea ecx, [ebp - 0x17fdc]
call fcn.00417ed0
test al, al
je 0x42749e
lea eax, [ebp - 0x18040]
push eax
mov ecx, ebx
call fcn.0042df60
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x18040]
call fcn.0042e0c0
jmp 0x42836e
lea ecx, [ebp - 0x17fe0]
call fcn.004023a0
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x18014]
push eax
lea ecx, [ebp - 0x17fc8]
call fcn.00403370
mov byte [ebp - 4], 0x5d
mov esi, dword [0x53ed90]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 0xe
jne 0x427544
test esi, esi
je 0x427544
mov ecx, esi
and ecx, 0x80000001
jns 0x4274f5
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x427502
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x427509
lea esi, [esi*2 + 1]
mov eax, 0x55555556
imul esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*2]
sub ecx, eax
mov dword [0x53ed90], esi
sub ecx, 0
je 0x427533
sub ecx, 2
je 0x427536
dec ecx
je 0x427537
jmp 0x427540
add esi, 2
inc esi
add esi, 2
mov dword [0x53ed90], esi
test esi, esi
jne 0x4274e6
lea ecx, [ebp - 0x17fc8]
call fcn.004210a0
mov eax, dword [ebp - 0x17fc8]
cmp dword [eax - 0xc], 0
jl 0x4278be
push str.location:
push eax
call fcn.004ad3c6
mov esi, eax
add esp, 8
test esi, esi
je 0x4278be
sub esi, dword [ebp - 0x17fc8]
sar esi, 1
cmp esi, 0xffffffff
je 0x4278be
push esi
push 0x51c660
lea ecx, [ebp - 0x17fc8]
call fcn.0040ef60
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x17fcc]
push eax
lea ecx, [ebp - 0x17fc8]
call fcn.0040efa0
mov byte [ebp - 4], 0x5e
push eax
lea ecx, [ebp - 0x17fe0]
call fcn.00402510
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov ecx, dword [ebp - 0x17fe0]
cmp dword [ecx - 0xc], 0
jge 0x4275df
or edi, 0xffffffff
jmp 0x427602
push str.http
push ecx
call fcn.004ad3c6
mov ecx, dword [ebp - 0x17fe0]
mov edi, eax
add esp, 8
test edi, edi
jne 0x4275fe
or edi, 0xffffffff
jmp 0x427602
sub edi, ecx
sar edi, 1
mov esi, dword [0x53ed90]
lea edx, [esi + 1]
lea eax, [esi + 2]
imul eax, edx
imul eax, esi
cdq
mov esi, 0x14
idiv esi
cmp edx, 0xf
jne 0x427648
push 4
call fcn.004ace0a
add esp, 4
mov esi, eax
call fcn.004acfe8
push esi
mov dword [esi], eax
mov dword [0x53ed90], eax
call fcn.004ac575
mov ecx, dword [ebp - 0x17fe0]
add esp, 4
cmp edi, 0xffffffff
je 0x4278be
mov eax, dword [ecx - 0xc]
sub eax, edi
push eax
lea eax, [ebp - 0x17fcc]
push eax
lea ecx, [ebp - 0x17fe0]
call fcn.00417ae0
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x17fe0]
call fcn.00402510
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov eax, dword [ebp - 0x18028]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x18028], eax
mov dword [ebp - 0x18024], 0
mov byte [ebp - 0x18030], 1
mov byte [ebp - 4], 0x60
lea eax, [ebp - 0x18030]
push eax
push ecx
push str.urlRedirected
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x18030]
call fcn.0042e0c0
lea edx, [ebp - 0x17fe4]
lea ecx, [ebp - 0x17f08]
call fcn.0041c5f0
mov byte [ebp - 4], 0x61
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x18058]
push eax
push ecx
push str.requestUrl
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x17f08]
call fcn.004014d0
lea edx, [ebp - 0x17fe0]
lea ecx, [ebp - 0x17f38]
call fcn.0041c5f0
mov byte [ebp - 4], 0x63
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x64
lea eax, [ebp - 0x18058]
push eax
push ecx
push str.redirectUrl
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x17f38]
call fcn.004014d0
mov eax, dword [ebp - 0x17fdc]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x4277cb
push 0
lea ecx, [ebp - 0x17fdc]
call fcn.004026b0
mov eax, dword [ebp - 0x17fdc]
push eax
call fcn.004ad778
mov ecx, dword [ebp - 0x18028]
and ecx, 0xffffff01
or ecx, 1
add esp, 4
mov dword [ebp - 0x18028], ecx
mov dword [ebp - 0x18024], 0
mov dword [ebp - 0x18030], eax
mov byte [ebp - 4], 0x65
lea eax, [ebp - 0x18030]
push eax
push ecx
push str.statusCode
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x18030]
call fcn.0042e0c0
mov edx, dword [0x53ed90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x12
idiv ecx
cmp edx, 0xa
jne 0x4278be
xor eax, eax
push 0x176b0
push eax
mov word [ebp - 0x17ed8], ax
lea eax, [ebp - 0x17ed6]
push eax
call fcn.004b1a50
add esp, 0xc
xor edi, edi
xor esi, esi
lea esp, [esp]
xor edx, edx
test edi, edi
je 0x42789a
test edx, edx
je 0x42789a
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x1808e]
inc ax
add ax, word [ebp + ecx*2 - 0x17eda]
mov word [ebp + ecx*2 - 0x17ed8], ax
inc edx
cmp edx, 0xdb
jl 0x427872
add esi, 0xdb
inc edi
cmp esi, 0xbb59
jl 0x427870
movsx eax, word [ebp - 0x828]
mov dword [0x53ed90], eax
lea eax, [ebp - 0x18040]
push eax
mov ecx, ebx
call fcn.0042df60
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x17fe0]
call fcn.004024b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x18040]
call fcn.0042e0c0
jmp 0x42836e
xor eax, eax
mov dword [ebp - 0x1802c], eax
xor esi, esi
mov dword [ebp - 0x18028], esi
mov dword [ebp - 0x18024], eax
mov byte [ebp - 4], 0x66
mov dword [ebp - 0x18060], esi
jmp 0x427930
sub esi, eax
lea ecx, [ebp - 0x1802c]
lea eax, [esi + 0x400]
push eax
call fcn.00424280
mov eax, dword [ebp - 0x1802c]
lea ecx, [ebp - 0x18060]
push ecx
add eax, esi
push ecx
push eax
mov dword [ebp - 0x18060], 0
call fcn.004234d0
mov edx, edi
mov ecx, eax
call fcn.00434c80
test eax, eax
je 0x42830f
mov eax, dword [ebp - 0x18060]
add eax, esi
push eax
lea ecx, [ebp - 0x1802c]
call fcn.00424280
cmp dword [ebp - 0x18060], 0
je 0x4279a0
mov esi, dword [ebp - 0x18028]
mov eax, dword [ebp - 0x1802c]
jmp 0x427930
push 0x400
lea eax, [ebp - 0x81f]
push 0
push eax
mov byte [ebp - 0x820], 0
call fcn.004b1a50
add esp, 0xc
mov dword [ebp - 0x18068], 0x400
push str.Wininet.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x427a62
push str.HttpQueryInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [0x53ed90]
lea edx, [esi + 2]
lea ecx, [esi + 1]
imul edx, ecx
imul edx, esi
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x427a05
dec edx
or edx, 0xfffffff8
inc edx
cmp edx, 7
jne 0x427a64
movsd xmm3, qword [0x522870]
movsd xmm6, qword [0x522898]
movsd xmm5, qword [0x522868]
movd xmm4, esi
xorps xmm2, xmm2
cvtdq2pd xmm4, xmm4
lea ecx, [ecx]
addsd xmm2, xmm3
movapd xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x427a4a
subsd xmm2, xmm3
divsd xmm3, xmm6
movapd xmm1, xmm2
mulsd xmm1, xmm2
movapd xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm5
ja 0x427a30
jmp 0x427a64
xor eax, eax
push 0
lea ecx, [ebp - 0x18068]
push ecx
lea ecx, [ebp - 0x820]
push ecx
push 0x1d
push edi
call eax
test eax, eax
je 0x427bb1
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x17fd0]
call fcn.004241e0
mov byte [ebp - 4], 0x68
mov edx, str.gzip
lea ecx, [ebp - 0x17fd0]
call fcn.00417e80
test al, al
je 0x427ba2
mov dword [ebp - 0x1803c], 0
mov dword [ebp - 0x18038], 0
mov dword [ebp - 0x18034], 0
mov byte [ebp - 4], 0x69
mov ecx, dword [0x53ed90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 1
jne 0x427af2
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 0x1802c]
mov edx, dword [ebp - 0x18028]
lea eax, [ebp - 0x1803c]
sub edx, ecx
push eax
call fcn.00424520
add esp, 4
test eax, eax
jne 0x427b81
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x427b2d
push dword [ebp - 0x17fe0]
call esi
push str.gzip_decompressing_error
lea ecx, [ebp - 0x17fcc]
call fcn.004033d0
mov byte [ebp - 4], 0x6a
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x1803c]
call fcn.00424250
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x17fd0]
jmp 0x42835a
lea eax, [ebp - 0x1803c]
push eax
lea ecx, [ebp - 0x1802c]
call fcn.004284c0
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x1803c]
call fcn.00424250
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x17fd0]
call fcn.004024b0
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x427bcb
push dword [ebp - 0x17fe0]
call esi
mov esi, dword [ebp - 0x18018]
push 0x51c724
mov ecx, esi
mov byte [ebp - 0x17fd1], 0
mov byte [ebp - 0x17fd0], 0
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x427c82
push str.responseType
mov ecx, esi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x17fc8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x6c
mov edx, str.base64
lea ecx, [ebp - 0x17fc8]
call fcn.00417e80
test al, al
je 0x427c4a
mov byte [ebp - 0x17fd1], 1
jmp 0x427c73
mov edx, str.binary
lea ecx, [ebp - 0x17fc8]
call fcn.00417e80
mov ecx, dword [ebp - 0x17fd0]
movzx ecx, cl
test al, al
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x17fd0], ecx
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
lea ecx, [ebp - 0x18044]
call fcn.004023a0
mov byte [ebp - 4], 0x6d
cmp byte [ebp - 0x17fd1], 0
mov edi, dword [ebp - 0x1802c]
je 0x427e28
mov eax, dword [ebp - 0x18028]
sub eax, edi
push eax
mov edx, edi
lea ecx, [ebp - 0x18018]
call fcn.0041c3a0
add esp, 4
mov byte [ebp - 4], 0x6e
push eax
lea ecx, [ebp - 0x18044]
call fcn.00402510
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x18018]
call fcn.004024b0
lea ecx, [ebp - 0x17fcc]
call fcn.00422b40
mov byte [ebp - 4], 0x6f
mov edx, eax
lea ecx, [ebp - 0x18044]
call fcn.00417e30
mov bl, al
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x17fcc]
call fcn.004024b0
test bl, bl
je 0x427ecf
push str.Base64_encdng_error
lea ecx, [ebp - 0x18018]
call fcn.004033d0
mov byte [ebp - 4], 0x70
mov ecx, dword [ebp - 0x18010]
mov edx, eax
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x18018]
call fcn.004024b0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x18044]
call fcn.004024b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x1802c]
call fcn.00424250
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x18014]
call fcn.004024b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17fdc]
call fcn.004024b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x18000]
call fcn.004024b0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17ffc]
call fcn.004024b0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x17fec]
call fcn.004024b0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x18004]
call fcn.004024b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1800c]
call fcn.004024b0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x17ff8]
call fcn.004024b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x18008]
call fcn.004024b0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17fe4]
call fcn.004024b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x17ff0]
call fcn.004024b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x17fe8]
call fcn.004024b0
mov eax, dword [ebp - 0x18010]
jmp 0x428424
cmp byte [ebp - 0x17fd0], 0
jne 0x427ed5
mov eax, dword [ebp - 0x18028]
sub eax, edi
mov dword [ebp - 0x18018], eax
cmp byte [eax + edi - 1], 0
je 0x427e67
inc eax
push eax
lea ecx, [ebp - 0x1802c]
call fcn.00424280
mov edi, dword [ebp - 0x1802c]
mov eax, dword [ebp - 0x18018]
mov byte [eax + edi], 0
mov eax, dword [ebp - 0x18028]
sub eax, edi
cmp eax, 3
jbe 0x427ea2
cmp byte [edi], 0xef
jne 0x427ea2
cmp byte [edi + 1], 0xbb
jne 0x427ea2
cmp byte [edi + 2], 0xbf
jne 0x427ea2
lea eax, [edi + 3]
push eax
push edi
lea eax, [ebp - 0x18048]
push eax
lea ecx, [ebp - 0x1802c]
call fcn.00424360
mov edi, dword [ebp - 0x1802c]
push edi
lea ecx, [ebp - 0x18018]
call fcn.004033d0
mov byte [ebp - 4], 0x71
push eax
lea ecx, [ebp - 0x18044]
call fcn.00402510
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x18018]
call fcn.004024b0
jmp 0x427ed5
mov ebx, dword [ebp - 0x18010]
push 0x51c794
mov ecx, esi
mov byte [ebp - 0x18010], 0
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x427fec
push 0x51c788
mov ecx, esi
call fcn.0042edc0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18048], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x17fc8]
call fcn.0041c510
add esp, 0x18
mov byte [ebp - 4], 0x73
mov eax, dword [ebp - 0x17fc8]
cmp dword [eax - 0xc], 0
je 0x427fdd
cmp byte [ebp - 0x17fd0], 0
je 0x427f99
push 0x51c7a8
push eax
lea eax, [ebp - 0x17fd0]
push eax
mov dword [ebp - 0x17fd0], 0
call fcn.004af275
add esp, 0xc
test eax, eax
jne 0x427fdd
mov eax, dword [ebp - 0x17fd0]
test eax, eax
je 0x427fdd
push eax
mov eax, dword [ebp - 0x18028]
sub eax, edi
push eax
push 1
push edi
call fcn.004af633
push dword [ebp - 0x17fd0]
call fcn.004ae610
add esp, 0x14
mov byte [ebp - 0x18010], 1
jmp 0x427fdd
push ecx
lea eax, [ebp - 0x18044]
mov ecx, esp
mov dword [ebp - 0x18048], esp
push eax
call fcn.00403370
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x17fc8]
call fcn.00423aa0
mov ecx, dword [ebp - 0x18010]
add esp, 4
movzx ecx, cl
test al, al
mov eax, 1
cmovne ecx, eax
mov dword [ebp - 0x18010], ecx
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x17fc8]
call fcn.004024b0
mov eax, dword [ebp - 0x18038]
and eax, 0xffffff00
mov dword [ebp - 0x18038], eax
and eax, 0xfffffeff
mov dword [ebp - 0x18038], eax
mov dword [ebp - 0x18034], 0
mov byte [ebp - 4], 0x7a
mov eax, dword [ebp - 0x18050]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x18050], eax
mov dword [ebp - 0x1804c], 0
mov byte [ebp - 0x18058], 1
mov byte [ebp - 4], 0x7b
lea eax, [ebp - 0x18058]
push eax
push ecx
push str.result
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
lea edx, [ebp - 0x18044]
mov ecx, edx
call fcn.00422100
lea edx, [ebp - 0x18044]
lea ecx, [ebp - 0x17f38]
call fcn.0041c5f0
mov byte [ebp - 4], 0x7c
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x7d
lea eax, [ebp - 0x18058]
push eax
push ecx
push str.content
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x17f38]
call fcn.004014d0
lea edx, [ebp - 0x18014]
lea ecx, [ebp - 0x17f08]
call fcn.0041c5f0
mov byte [ebp - 4], 0x7e
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x7f
push ecx
push 0x51c7b0
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
lea ecx, [ebp - 0x18058]
push ecx
push ecx
push str.headers
mov ecx, eax
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x17f08]
call fcn.004014d0
lea edx, [ebp - 0x17fdc]
lea ecx, [ebp - 0x17f20]
call fcn.0041c5f0
mov byte [ebp - 4], 0x80
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x81
push ecx
push str.additionalInfo
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
lea ecx, [ebp - 0x18058]
push ecx
push ecx
push str.httpCode
mov ecx, eax
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x17f20]
call fcn.004014d0
push str.empty
lea ecx, [ebp - 0x17ef0]
call fcn.00401470
mov byte [ebp - 4], 0x82
push eax
lea ecx, [ebp - 0x18058]
call fcn.0042dea0
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x18058]
push eax
push ecx
push str.noData
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x17ef0]
call fcn.004014d0
push str.outputFile
mov ecx, esi
call fcn.0042edc0
cmp byte [eax + 8], 4
jne 0x4282dc
mov eax, dword [ebp - 0x18050]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x18050], eax
mov eax, dword [ebp - 0x18010]
mov dword [ebp - 0x1804c], 0
mov byte [ebp - 0x18058], al
mov byte [ebp - 4], 0x84
push str.outputFi
lea ecx, [ebp - 0x17f20]
call fcn.00401470
mov byte [ebp - 4], 0x85
push str.leResult
mov edx, eax
lea ecx, [ebp - 0x17ef0]
call fcn.00428660
add esp, 4
mov byte [ebp - 4], 0x86
cmp dword [eax + 0x14], 0x10
jb 0x428294
mov eax, dword [eax]
lea ecx, [ebp - 0x18058]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x18040]
call fcn.0042eb90
mov ecx, eax
call fcn.0042e190
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x17ef0]
call fcn.004014d0
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x17f20]
call fcn.004014d0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x18058]
call fcn.0042e0c0
lea eax, [ebp - 0x18040]
push eax
mov ecx, ebx
call fcn.0042df60
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x18040]
call fcn.0042e0c0
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x18044]
jmp 0x42835a
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
cmp byte [ebp - 0x17fc2], 0
je 0x428329
push dword [ebp - 0x17fe0]
call esi
push str.InternetReadFile_Failed
lea ecx, [ebp - 0x18018]
call fcn.004033d0
mov byte [ebp - 4], 0x67
mov edx, eax
mov ecx, ebx
call fcn.00424a80
mov dword [ebp - 0x17ff4], 1
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x18018]
call fcn.004024b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x1802c]
call fcn.00424250
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x18014]
call fcn.004024b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x17fdc]
call fcn.004024b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x18000]
call fcn.004024b0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x17ffc]
call fcn.004024b0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x17fec]
call fcn.004024b0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x18004]
call fcn.004024b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1800c]
call fcn.004024b0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x17ff8]
call fcn.004024b0
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x18008]
call fcn.004024b0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17fe4]
call fcn.004024b0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x17ff0]
call fcn.004024b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x17fe8]
call fcn.004024b0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret