Function at 0x430380
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x271c
call fcn.00449aa0
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x26fc], ecx
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430c6e
mov eax, dword [ecx]
push ebx
push esi
push edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x2718], esi
mov dword [ebp - 0x270c], esi
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430c78
mov eax, dword [ecx]
call dword [eax + 0xc]
mov ecx, dword [0x4c10b8]
xor ebx, ebx
lea edi, [eax + 0x10]
mov eax, dword [0x4c10bc]
sub eax, ecx
mov dword [ebp - 0x2708], edi
sar eax, 2
test eax, eax
je 0x430421
mov eax, dword [ecx + ebx*4]
push str.saayaa
push dword [eax]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x430467
mov eax, dword [0x4c10bc]
inc ebx
mov ecx, dword [0x4c10b8]
sub eax, ecx
sar eax, 2
cmp ebx, eax
jb 0x4303f6
or ebx, 0xffffffff
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x43043b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2718]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
pop edi
pop esi
test ebx, ebx
pop ebx
jg 0x430459
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004495f3
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4c10b8]
lea ecx, [ebx*4]
mov dword [ebp - 0x2700], ecx
lea ebx, [esi - 0x10]
mov eax, dword [ecx + eax]
mov ecx, dword [eax + 0xc]
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x4304e1
cmp dword [ebx + 0xc], 0
lea esi, [ebx + 0xc]
jl 0x4304c6
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x4304c6
push edx
call fcn.00403380
add esp, 4
mov dword [ebp - 0x2714], eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x4304c1
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x2714]
lea esi, [eax + 0x10]
jmp 0x4304db
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x270c]
call fcn.00402620
mov esi, dword [ebp - 0x270c]
mov dword [ebp - 0x2718], esi
mov ecx, dword [ebp - 0x2700]
lea ebx, [edi - 0x10]
mov eax, dword [0x4c10b8]
mov eax, dword [ecx + eax]
mov ecx, dword [eax + 0x10]
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x43054e
cmp dword [ebx + 0xc], 0
lea edi, [ebx + 0xc]
jl 0x430539
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x430539
push edx
call fcn.00403380
add esp, 4
mov dword [ebp - 0x2714], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x430534
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x2714]
lea edi, [eax + 0x10]
jmp 0x43054e
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x2708]
call fcn.00402620
mov edi, dword [ebp - 0x2708]
mov eax, dword [0x4c10b8]
mov ecx, dword [ebp - 0x2700]
mov eax, dword [ecx + eax]
mov al, byte [eax + 0x24]
test al, al
je 0x430421
mov ecx, dword [ebp - 0x26fc]
lea eax, [ebp - 0x270c]
push eax
call fcn.0041d690
push dword [ebp - 0x270c]
lea eax, [ebp - 0x2714]
push eax
call fcn.0041d210
add esp, 8
test edi, edi
je 0x430c82
push edi
push dword [ebp - 0x2714]
xor ebx, ebx
call fcn.0046b1da
add esp, 8
mov ecx, 1
test eax, eax
cmove ebx, ecx
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430c8c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2700], eax
lea eax, [ebp - 0x2700]
push eax
call fcn.0041bbd0
mov eax, dword [ebp - 0x2700]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x4305f8
lea eax, [ebp - 0x2700]
push eax
call fcn.0041bdc0
add esp, 4
lea ecx, [ebp - 0x2700]
call fcn.00432480
lea ecx, [ebp - 0x2700]
call fcn.00432640
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430c96
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x26f8], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430ca0
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp - 0x270c]
add eax, 0x10
push dword [ebp - 0x2700]
mov dword [ebp - 0x271c], eax
lea eax, [ebp - 0x26f8]
push esi
push ebx
push str.n:saayaa.exe_d:_d_v:_s_s:_dns:_o:_disk:_s_path:_s_redown:0_size:0_
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x26f8]
add esp, 0x18
cmp dword [esi - 4], 1
jle 0x43068a
push dword [esi - 0xc]
lea ecx, [ebp - 0x26f8]
call fcn.00402190
mov esi, dword [ebp - 0x26f8]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
push ebx
call fcn.00448f65
push ebx
push 0
push eax
mov dword [ebp - 0x2710], eax
call fcn.0044c180
add esp, 0x10
push 0
push 0
push ebx
mov ebx, dword [ebp - 0x2710]
push ebx
push 0xffffffffffffffff
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push str.q_2D8lJ
lea ecx, [ebp - 0x26f0]
call fcn.004237d0
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x4306e7
sub ebx, ecx
mov ecx, ebx
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x4306ff
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x43070a
mov eax, 8
sub eax, ecx
add ebx, eax
lea esi, [ebx*8 + 1]
push esi
call fcn.00448f65
push esi
mov dword [ebp - 0x2708], eax
call fcn.00448f65
lea ecx, [ebx + 1]
mov dword [ebp - 0x2704], eax
push ecx
call fcn.00448f65
push esi
push 0
push dword [ebp - 0x2708]
mov dword [ebp - 0x26f4], eax
call fcn.0044c180
push esi
push 0
push dword [ebp - 0x2704]
call fcn.0044c180
push ebx
push 0
push dword [ebp - 0x26f4]
call fcn.0044c180
mov esi, dword [ebp - 0x2710]
add esp, 0x30
mov edx, dword [ebp - 0x26f4]
mov ecx, esi
sub edx, esi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x430775
push esi
call fcn.00448f6e
add esp, 4
lea ecx, [ebp - 0x26f0]
push 0
push ebx
push dword [ebp - 0x26f4]
call fcn.00419a80
shl ebx, 3
xor edx, edx
test ebx, ebx
je 0x4307d1
mov esi, dword [ebp - 0x2708]
nop
mov eax, edx
mov ecx, edx
shr eax, 3
and ecx, 7
movsx eax, byte [ebp + eax - 0x2005]
shl eax, cl
sar eax, 7
and al, 1
mov byte [edx + esi], al
inc edx
cmp edx, ebx
jb 0x4307b0
push ebx
push dword [ebp - 0x2708]
mov ebx, dword [ebp - 0x2704]
lea ecx, [ebp - 0x26f0]
push ebx
call fcn.0040c940
push dword [ebp - 0x26f4]
call fcn.00448f6e
add esp, 4
lea ecx, [ebp - 0x26f8]
push 0x2f
push str.http:__union.ruanmei.com_receive_rmup.aspx_uid
call fcn.00402620
mov eax, dword [ebp - 0x26f8]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x430822
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x430838
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x430caa
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x26f4], esi
test ebx, ebx
je 0x43087e
test ebx, 0xffff0000
jne 0x43087e
movzx eax, bx
push 0
push eax
mov dword [ebp - 0x2704], eax
call fcn.00403a80
add esp, 8
test eax, eax
je 0x430890
push dword [ebp - 0x2704]
lea ecx, [ebp - 0x26f4]
push eax
call fcn.004041c0
jmp 0x43088a
push ebx
lea ecx, [ebp - 0x26f4]
call fcn.00409a90
mov esi, dword [ebp - 0x26f4]
push dword [esi - 0xc]
lea ecx, [ebp - 0x26f8]
push esi
call fcn.00403910
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4308b7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x2708]
call fcn.00448f6e
push ebx
call fcn.00448f6e
mov ebx, dword [ebp - 0x26fc]
add esp, 8
mov eax, dword [ebx + 0x594]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4308e9
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4308ff
call fcn.00402250
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x430cb4
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov eax, dword [ebx + 0x594]
mov dword [ebp - 0x26fc], esi
mov dword [ebp - 0x2704], eax
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0x2710], ebx
lea ecx, [ebx + 8]
test ecx, ecx
js 0x430cbe
mov eax, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
sub eax, ecx
or edx, eax
jge 0x430950
push ecx
lea ecx, [ebp - 0x26fc]
call fcn.004024d0
mov esi, dword [ebp - 0x26fc]
add ebx, ebx
push ebx
push dword [ebp - 0x2704]
push ebx
push esi
call fcn.00437560
push 0x10
push 0x4a5638
lea eax, [ebx + esi]
push 0x10
push eax
call fcn.00437560
mov eax, dword [ebp - 0x2710]
add esp, 0x20
add eax, 8
cmp eax, dword [esi - 8]
jg 0x430cbe
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
lea eax, [ebp - 0x2704]
push esi
push eax
call fcn.0041d210
or ebx, 0xffffffff
add esp, 8
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4309ba
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430cc8
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp - 0x2704]
add eax, 0x10
mov dword [ebp - 0x26f4], eax
lea eax, [ebp - 0x26f4]
push str.v_s
push eax
call fcn.0041ad10
mov eax, dword [ebp - 0x26f4]
lea ecx, [ebp - 0x26f8]
add esp, 0xc
push dword [eax - 0xc]
push eax
call fcn.00403910
push 0
lea eax, [ebp - 0x26f4]
push str.s_d
push eax
call fcn.0041ad10
mov eax, dword [ebp - 0x26f4]
lea ecx, [ebp - 0x26f8]
add esp, 0xc
push dword [eax - 0xc]
push eax
call fcn.00403910
push 0
lea eax, [ebp - 0x26f4]
push str.e_d
push eax
call fcn.0041ad10
mov eax, dword [ebp - 0x26f4]
lea ecx, [ebp - 0x26f8]
add esp, 0xc
push dword [eax - 0xc]
push eax
call fcn.00403910
lea eax, [ebp - 0x26f4]
push str.ahijactcontent:_filecontent:_
push eax
call fcn.0041ad10
mov eax, dword [ebp - 0x26f4]
lea ecx, [ebp - 0x26f8]
add esp, 8
push dword [eax - 0xc]
push eax
call fcn.00403910
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x430cd2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
push 0
mov dword [ebp - 0x26fc], eax
call fcn.0046ead0
push eax
call fcn.0046a4be
call fcn.0046a49d
push eax
lea eax, [ebp - 0x26fc]
push str.r_d
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x26fc]
lea ecx, [ebp - 0x26f8]
add esp, 0x14
push dword [esi - 0xc]
push esi
call fcn.00403910
push 0
push 0
push 0
push 1
push 0
mov dword [ebp - 0x2710], 0
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x26fc], eax
test eax, eax
je 0x430b4c
push 4
lea ecx, [ebp - 0x2710]
push ecx
push 2
push eax
call dword [sym.imp.WININET.dll_InternetSetOptionW]
push 0
push 0x102
push 0
push 0
push dword [ebp - 0x26f8]
push dword [ebp - 0x26fc]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ecx, eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
test ecx, ecx
je 0x430b44
push ecx
call eax
mov eax, dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x26fc]
call eax
push 0
push str._PCMasterTray
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x26fc], eax
test eax, eax
je 0x430b83
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x430b83
push 0
push 4
push 0x708
push dword [ebp - 0x26fc]
call dword [sym.imp.USER32.dll_PostMessageW]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x430b9a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x26f4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430bb7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2704]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430bd4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x271c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430bf1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x26f8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430c0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2700]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430c2b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2714]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430c48
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x270c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430424
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x430424
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80070057
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
int3