Function at 0x4babf2
Capabilities:
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50bc3c
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x27a4
call fcn.004ec330
mov eax, dword [0x559540]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
movdqa xmm0, xmmword [0x511130]
lea ecx, [ebp - 0xfc]
movdqu xmmword [ebp - 0xfc], xmm0
lea edx, [ecx + 1]
xor ebx, ebx
movdqa xmm0, xmmword [0x511120]
movdqu xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0x2784], ebx
movdqa xmm0, xmmword [str.tless_js_config.64__AppleWebKit_Node_shopperz071SoftwareWow6432_4E26_B4D9_739C4F4C2E9AFBC0652C_7B29_4FB6_8AD2020D47_707DAppDataLocalLe_31.0.1650.63_Sdows_NT_6.2__WOWApplication_DalocalStoreFileNalocalStorageIE_b537.36__KHTML__like_Gecko__ChromMozilla_5.0__WinSHGetKnownFolder6t7.hwcdn.net_exhttp:__cds.q2u3zDA_91F54B267AD4Y]
mov dword [ebp - 0x2780], ebx
mov dword [ebp - 4], ebx
movdqu xmmword [ebp - 0xdc], xmm0
mov word [ebp - 0xcc], 0x736a
mov byte [ebp - 0xca], bl
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bac83
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4bac9b
mov eax, ebx
jmp 0x4bacb8
lea eax, [esi + esi]
call fcn.004ec300
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0xfc]
mov eax, esp
push 3
push esi
push ecx
push eax
call fcn.004b496e
push eax
lea ecx, [ebp - 0x26f4]
call fcn.004b8cc3
movdqa xmm0, xmmword [0x511100]
lea eax, [ebp - 0xc8]
movdqu xmmword [ebp - 0xc8], xmm0
push ebx
movdqa xmm0, xmmword [0x5110a0]
movdqu xmmword [ebp - 0xb8], xmm0
push ebx
movdqa xmm0, xmmword [0x511010]
movdqu xmmword [ebp - 0xa8], xmm0
push ebx
movdqa xmm0, xmmword [0x5110e0]
movdqu xmmword [ebp - 0x98], xmm0
push ebx
movdqa xmm0, xmmword [0x5110f0]
movdqu xmmword [ebp - 0x88], xmm0
push eax
movdqa xmm0, xmmword [0x511090]
movdqu xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x68], 0x72616661
mov dword [ebp - 0x64], 0x33352f69
mov dword [ebp - 0x60], 0x36332e37
mov byte [ebp - 0x5c], bl
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp dword [ebp - 0x26e0], 8
lea ecx, [ebp - 0x26f4]
mov ebx, eax
cmovae ecx, dword [ebp - 0x26f4]
xor eax, eax
push eax
push 0x80000900
push eax
push eax
push ecx
push ebx
mov dword [ebp - 0x2784], ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
xor ecx, ecx
mov dword [ebp - 0x2780], eax
mov dword [ebp - 0x2638], 0xf
mov dword [ebp - 0x263c], ecx
mov byte [ebp - 0x264c], cl
mov byte [ebp - 4], 2
test ebx, ebx
je 0x4badf7
test eax, eax
je 0x4badf7
mov dword [ebp - 0x2618], ecx
mov ebx, 0x1000
lea ecx, [ebp - 0x2618]
push ecx
push ebx
lea ecx, [ebp - 0x2210]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4bae80
push dword [ebp - 0x2618]
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x264c]
call fcn.004be1b8
cmp dword [ebp - 0x2618], 0
mov eax, dword [ebp - 0x2780]
ja 0x4badad
jmp 0x4bae80
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x28], 0x666e6f63
mov dword [ebp - 0x24], 0x6a2e6769
lea edx, [ecx + 1]
mov word [ebp - 0x20], 0x73
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4bae11
sub ecx, edx
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4bae29
xor eax, eax
jmp 0x4bae43
lea eax, [esi + esi]
call fcn.004ec300
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x28]
mov eax, esp
push 3
push esi
push ecx
push eax
call fcn.004b496e
push eax
lea ecx, [ebp - 0x2684]
call fcn.004b8cc3
lea eax, [ebp - 0x264c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x2684]
mov ecx, edi
push eax
call fcn.004bc24b
push 0
push 1
lea ecx, [ebp - 0x2684]
mov byte [ebp - 4], 2
call fcn.004bdd8c
mov ebx, 0x1000
push 1
xor esi, esi
mov byte [ebp - 0x2614], 0x7b
push esi
lea eax, [ebp - 0x2614]
push eax
lea ecx, [ebp - 0x264c]
call fcn.004bf2d6
or edi, 0xffffffff
cmp eax, edi
je 0x4baf03
push eax
push esi
lea ecx, [ebp - 0x264c]
call fcn.004bf13c
lea ecx, [ebp - 0x264c]
cmp ecx, eax
je 0x4baec4
push edi
push esi
push eax
call fcn.004be25a
push 1
push edi
lea eax, [ebp - 0x2614]
mov byte [ebp - 0x2614], 0x7d
push eax
lea ecx, [ebp - 0x264c]
call fcn.004bffc5
cmp eax, edi
je 0x4baf03
inc eax
lea ecx, [ebp - 0x264c]
push eax
call fcn.004bf10d
lea ecx, [ebp - 0x264c]
cmp ecx, eax
je 0x4baf03
push edi
push esi
push eax
call fcn.004be25a
xor eax, eax
lea edi, [ebp - 0x265c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x265c]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004c16f0
push 0x70
lea eax, [ebp - 0x277c]
mov byte [ebp - 4], 4
push esi
push eax
call fcn.004edc70
add esp, 0xc
lea ecx, [ebp - 0x277c]
call fcn.004c2af0
push 1
lea eax, [ebp - 0x265c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x264c]
push eax
lea ecx, [ebp - 0x277c]
call fcn.004c4170
test al, al
je 0x4bb77a
xor eax, eax
mov dword [ebp - 0x2688], 0xf
mov dword [ebp - 0x268c], eax
mov byte [ebp - 0x269c], al
lea edi, [ebp - 0x266c]
mov byte [ebp - 4], 6
stosd dword es:[edi], eax
lea ecx, [ebp - 0x27b4]
mov esi, 0x510adc
mov dword [ebp - 0x48], 0x6e69616d
push esi
mov dword [ebp - 0x44], 0x68746150
stosd dword es:[edi], eax
mov dword [ebp - 0x40], 0x65736552
mov word [ebp - 0x3c], 0x74
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004c1660
lea eax, [ebp - 0x27b4]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x266c]
push eax
lea ecx, [ebp - 0x265c]
call fcn.004c25f0
lea ecx, [ebp - 0x27b4]
mov byte [ebp - 4], 9
call fcn.004c1950
lea ecx, [ebp - 0x266c]
call fcn.004c2670
test al, al
jne 0x4bb4f5
lea ecx, [ebp - 0x266c]
call fcn.004c26a0
test al, al
je 0x4bb4f5
movdqa xmm0, xmmword [0x511030]
lea eax, [ebp - 0x1e6]
push 0xda
movdqu xmmword [ebp - 0x210], xmm0
push 0
movdqa xmm0, xmmword [0x511020]
push eax
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0x1f0], 0x31303231
mov dword [ebp - 0x1ec], 0x33343035
mov word [ebp - 0x1e8], 0x34
call fcn.004edc70
add esp, 0xc
lea ecx, [ebp - 0x2634]
push 0x510e28
call fcn.004b8c38
lea eax, [ebp - 0x2618]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4bb46a
push 0x3f5
push eax
mov byte [ebp - 0x1206], al
lea eax, [ebp - 0x1205]
push eax
mov dword [ebp - 0x1210], 0x6c6f6f54
mov dword [ebp - 0x120c], 0x49726162
mov word [ebp - 0x1208], 0x44
call fcn.004edc70
xor eax, eax
mov dword [ebp - 0xe10], 0x6e616863
push 0x3f4
push eax
lea eax, [ebp - 0xe04]
mov dword [ebp - 0xe0c], 0x5f6c656e
push eax
mov dword [ebp - 0xe08], 0x6469
call fcn.004edc70
xor eax, eax
mov dword [ebp - 0x610], 0x646f7270
mov esi, 0x3f2
mov word [ebp - 0x604], ax
push esi
push eax
lea eax, [ebp - 0x602]
mov dword [ebp - 0x60c], 0x5f746375
push eax
mov dword [ebp - 0x608], 0x656d616e
call fcn.004edc70
xor eax, eax
mov dword [ebp - 0xa10], 0x74736e69
push esi
push eax
mov word [ebp - 0xa04], ax
lea eax, [ebp - 0xa02]
push eax
mov dword [ebp - 0xa0c], 0x5f6c6c61
mov dword [ebp - 0xa08], 0x656d6974
call fcn.004edc70
movdqa xmm0, xmmword [str.product_version]
lea eax, [ebp - 0x25ff]
push 0x3ef
push 0
push eax
movdqu xmmword [ebp - 0x2610], xmm0
mov byte [ebp - 0x2600], 0
call fcn.004edc70
push 0xfff
lea eax, [ebp - 0x220f]
mov byte [ebp - 0x2210], 0
push 0
push eax
call fcn.004edc70
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x261c]
add esp, 0x48
mov dword [ebp - 0x261c], ebx
push eax
lea eax, [ebp - 0x2210]
push eax
push 0
push 0
lea eax, [ebp - 0x1210]
push eax
push dword [ebp - 0x2618]
call edi
test eax, eax
jne 0x4bb243
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x64696274
push eax
mov word [ebp - 0x18], 0x3d
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x2210]
push eax
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
mov esi, 0x510e2c
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
jmp 0x4bb248
mov esi, 0x510e2c
lea eax, [ebp - 0x261c]
mov dword [ebp - 0x261c], ebx
push eax
lea eax, [ebp - 0x2210]
push eax
push 0
push 0
lea eax, [ebp - 0xe10]
push eax
push dword [ebp - 0x2618]
call edi
test eax, eax
jne 0x4bb2ce
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x6c6e6863
push eax
mov word [ebp - 0x18], 0x3d
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x2210]
push eax
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x261c]
mov dword [ebp - 0x261c], ebx
push eax
lea eax, [ebp - 0x2210]
push eax
push 0
push 0
lea eax, [ebp - 0x610]
push eax
push dword [ebp - 0x2618]
call edi
test eax, eax
jne 0x4bb351
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x3d647270
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x2210]
push eax
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x261c]
mov dword [ebp - 0x261c], ebx
push eax
lea eax, [ebp - 0x2210]
push eax
push 0
push 0
lea eax, [ebp - 0xa10]
push eax
push dword [ebp - 0x2618]
call edi
test eax, eax
jne 0x4bb3d4
mov byte [ebp - 0x18], al
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x3d646e69
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x2210]
push eax
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x261c]
mov dword [ebp - 0x261c], ebx
push eax
lea eax, [ebp - 0x2210]
xor ebx, ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x2610]
push eax
push dword [ebp - 0x2618]
call edi
test eax, eax
jne 0x4bb457
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x3d726576
push eax
mov byte [ebp - 0x18], bl
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
lea eax, [ebp - 0x2210]
push eax
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x2210]
push eax
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2634]
call fcn.004be1b8
push dword [ebp - 0x2618]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x510adc
jmp 0x4bb46c
xor ebx, ebx
lea eax, [ebp - 0x270c]
push eax
lea ecx, [ebp - 0x266c]
call fcn.004c2080
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x2634]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x270c]
call fcn.004be0b1
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x3d767264
push eax
mov word [ebp - 0x20], 0x31
call fcn.004bfa2d
pop ecx
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x270c]
call fcn.004be1b8
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x270c]
push eax
lea ecx, [ebp - 0x269c]
call fcn.004be25a
push ebx
push 1
lea ecx, [ebp - 0x270c]
call fcn.004bdd48
push ebx
push 1
lea ecx, [ebp - 0x2634]
mov byte [ebp - 4], 9
call fcn.004bdd48
jmp 0x4bb4f7
xor ebx, ebx
movdqa xmm0, xmmword [0x5110c0]
lea edi, [ebp - 0x26ac]
xor eax, eax
mov dword [ebp - 0x58], 0x61636f6c
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2c]
movdqu xmmword [ebp - 0x2680], xmm0
push esi
movdqa xmm0, xmmword [str.localStoreParam]
stosd dword es:[edi], eax
mov dword [ebp - 0x54], 0x6f74536c
mov dword [ebp - 0x50], 0x61506572
mov word [ebp - 0x4c], 0x6874
stosd dword es:[edi], eax
mov byte [ebp - 0x4a], bl
mov word [ebp - 0x2670], 0x656d
mov byte [ebp - 0x266e], bl
movdqu xmmword [ebp - 0x10c], xmm0
mov dword [ebp - 0x38], 0x6e69616d
mov dword [ebp - 0x34], 0x68746150
mov word [ebp - 0x30], 0x4449
mov byte [ebp - 0x2e], bl
stosd dword es:[edi], eax
call fcn.004c1660
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x26ac]
push eax
lea ecx, [ebp - 0x265c]
call fcn.004c25f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0xe
call fcn.004c1950
xor eax, eax
lea edi, [ebp - 0x26cc]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2794]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004c1660
lea eax, [ebp - 0x2794]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x2680]
push eax
lea eax, [ebp - 0x26cc]
push eax
lea ecx, [ebp - 0x265c]
call fcn.004c25f0
lea ecx, [ebp - 0x2794]
mov byte [ebp - 4], 0x11
call fcn.004c1950
xor eax, eax
lea edi, [ebp - 0x26dc]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x27a4]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004c1660
lea eax, [ebp - 0x27a4]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x26dc]
push eax
lea ecx, [ebp - 0x265c]
call fcn.004c25f0
lea ecx, [ebp - 0x27a4]
mov byte [ebp - 4], 0x14
call fcn.004c1950
xor eax, eax
lea edi, [ebp - 0x26bc]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x262c]
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004c1660
lea eax, [ebp - 0x262c]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x26bc]
push eax
lea ecx, [ebp - 0x265c]
call fcn.004c25f0
lea ecx, [ebp - 0x262c]
mov byte [ebp - 4], 0x17
call fcn.004c1950
lea ecx, [ebp - 0x26ac]
call fcn.004c2070
mov esi, eax
push esi
call fcn.004bce0f
pop ecx
push eax
push esi
mov ecx, 0x563f34
call fcn.004bcbab
lea ecx, [ebp - 0x26cc]
call fcn.004c2070
mov esi, eax
push esi
call fcn.004bce0f
pop ecx
push eax
push esi
mov ecx, 0x563f38
call fcn.004bcbab
lea ecx, [ebp - 0x26dc]
call fcn.004c2070
mov esi, eax
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
mov ecx, 0x559028
call fcn.004be2ee
cmp dword [ebp - 0x2688], 0x10
lea esi, [ebp - 0x269c]
cmovae esi, dword [ebp - 0x269c]
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
mov ecx, 0x559040
call fcn.004be2ee
lea ecx, [ebp - 0x26bc]
call fcn.004c2070
mov esi, eax
push esi
call fcn.004bfa2d
pop ecx
push eax
push esi
mov ecx, 0x559058
call fcn.004be2ee
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x26bc]
call fcn.004c1950
lea ecx, [ebp - 0x26dc]
mov byte [ebp - 4], 0x11
call fcn.004c1950
lea ecx, [ebp - 0x26cc]
mov byte [ebp - 4], 0xe
call fcn.004c1950
lea ecx, [ebp - 0x26ac]
mov byte [ebp - 4], 9
call fcn.004c1950
lea ecx, [ebp - 0x266c]
mov byte [ebp - 4], 6
call fcn.004c1950
push ebx
push 1
lea ecx, [ebp - 0x269c]
call fcn.004bdd48
jmp 0x4bb77c
xor ebx, ebx
mov eax, dword [ebp - 0x2780]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
test eax, eax
je 0x4bb78f
push eax
call esi
mov eax, dword [ebp - 0x2784]
test eax, eax
je 0x4bb79c
push eax
call esi
lea ecx, [ebp - 0x277c]
call fcn.004b9384
lea ecx, [ebp - 0x265c]
mov byte [ebp - 4], 2
call fcn.004c1950
push ebx
push 1
lea ecx, [ebp - 0x264c]
call fcn.004bdd48
push ebx
push 1
lea ecx, [ebp - 0x26f4]
call fcn.004bdd8c
lea esp, [ebp - 0x27c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ebd2c
mov esp, ebp
pop ebp
ret