Function at 0x431940
Capabilities:
Connect to http server
Create http request

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b3490
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4d77ac]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x44]
push edx
mov dword [ebp - 0x20], 0
call fcn.00431590
mov byte [ebp - 4], 1
call fcn.004243e0
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4319ab
push 0x80004005
call fcn.00424010
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push 0
push 0
push 0
push 0
push str.User_Agent:_XK9553Downloader_r_n
mov byte [ebp - 4], 2
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x2c], eax
test eax, eax
jne 0x431a3d
push 0x4c0520
mov ecx, ebx
call fcn.004272e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x431a00
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x44]
call fcn.00431e20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x431a29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 3
push 0
push 0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push eax
call dword [sym.imp.WININET.dll_InternetConnectW]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x4319d4
push 0
xor eax, eax
mov edx, 0x800000
cmp dword [ebp - 0x44], 4
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [ebp - 0x38]
push str.HEAD
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x4319d4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.Content_Type:_application_x_www_form_urlencoded_r_n
call edi
mov ebx, dword [sym.imp.WININET.dll_HttpAddRequestHeadersW]
push 0x20000000
push eax
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push dword [ebp - 0x1c]
call ebx
test eax, eax
jne 0x431b29
mov edi, dword [ebp - 0x18]
mov ecx, edi
push 0x4c0520
call fcn.004272e0
lea edx, [esi - 0x10]
mov byte [ebp - 4], 1
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x431ae8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x44]
call fcn.00431e20
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x431dfe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.Accept:___r_n
call edi
mov edi, dword [ebp - 0x1c]
push 0x20000000
push eax
push str.Accept:___r_n
push edi
call ebx
test eax, eax
je 0x431d24
push dword [ebp - 0x40]
lea eax, [ebp - 0x10]
push str.Host:__s_r_n
push eax
call fcn.00426500
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, edi
call fcn.00431780
test eax, eax
je 0x431d24
push dword [ebp - 0x40]
lea eax, [ebp - 0x10]
push str.Referer:__s_r_n
push eax
call fcn.00426500
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, edi
call fcn.00431780
test eax, eax
je 0x431d24
xor ebx, ebx
mov edx, dword [ebp - 0x34]
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431ba0
sub ecx, esi
sar ecx, 1
push ecx
push edx
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x431c00
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x34]
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x431be0
sub eax, esi
sar eax, 1
push eax
push edx
push 0
push 0
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x431bc0
push 0
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x16
push edi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
jne 0x431c62
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x2f76
je 0x431d24
call esi
cmp eax, 0x7a
jne 0x431d17
test ebx, ebx
je 0x431c3f
push ebx
call fcn.00494b53
add esp, 4
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00492db5
add esp, 4
mov ebx, eax
jmp 0x431b97
push ebx
lea ecx, [ebp - 0x14]
call fcn.00425340
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
jl 0x431d5e
push 0x4c1adc
push eax
call fcn.00495401
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x14]
test ecx, ecx
je 0x431c98
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x431cec
cmp dword [eax - 0xc], 0
jl 0x431d5e
push 0x4c1ae4
push eax
call fcn.00495401
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x14]
test ecx, ecx
je 0x431cc2
sub ecx, eax
sar ecx, 1
cmp ecx, 0xffffffff
jne 0x431cec
cmp dword [eax - 0xc], 0
jl 0x431d5e
push 0x4c1aec
push eax
call fcn.00495401
add esp, 8
test eax, eax
je 0x431d5e
sub eax, dword [ebp - 0x14]
sar eax, 1
cmp eax, 0xffffffff
je 0x431d5e
mov eax, dword [0x4d8c1c]
test eax, eax
jle 0x431d5e
dec eax
push 0x12c
mov dword [0x4d8c1c], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00425400
jmp 0x431b97
test ebx, ebx
je 0x431d24
push ebx
call fcn.00494b53
add esp, 4
mov ecx, dword [ebp - 0x18]
push 0x4c0520
call fcn.004272e0
lea ecx, [ebp - 0x10]
call fcn.00425400
lea ecx, [ebp - 0x44]
call fcn.00431e20
lea ecx, [ebp + 8]
call fcn.00425400
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x1c]
call fcn.00425310
mov byte [ebp - 4], 4
test ebx, ebx
je 0x431db0
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.00425f20
add eax, 0x10
lea ecx, [ebp - 0x24]
mov edx, ebx
mov dword [esi], eax
call fcn.004317a0
add esp, 4
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.00425a50
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00425400
push ebx
call fcn.00494b53
add esp, 4
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
push dword [ebp - 0x28]
call esi
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00425f20
mov edi, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
add eax, 0x10
mov dword [edi], eax
call fcn.00425400
lea ecx, [ebp - 0x14]
call fcn.00425400
lea ecx, [ebp - 0x10]
call fcn.00425400
lea ecx, [ebp - 0x44]
call fcn.00431e20
lea ecx, [ebp + 8]
call fcn.00425400
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret