Function at 0x41ae00
Capabilities:
Check http status code
Check os version
Create http request
Log keystrokes via polling
Read data from internet
Receive data

Disassembly:
mov eax, 0x1150
call fcn.0043b070
mov eax, dword [0x454654]
xor eax, esp
mov dword [esp + 0x114c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x115c]
push esi
push edi
lea eax, [esp + 0x28]
mov esi, ecx
mov edi, edx
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edi
xor ebx, ebx
mov dword [esp + 0x2c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41ae54
cmp dword [esp + 0x2c], 5
jg 0x41ae54
mov ebx, 1
test esi, esi
je 0x41ae5c
test edi, edi
jne 0x41ae94
lea esi, [esp + 0x1168]
call fcn.004015c0
mov eax, dword [esp + 0x1168]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41b184
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41b184
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x14
mov esi, 1
call edi
test eax, 0x8000
je 0x41aec2
push 0x58
call edi
test eax, 0x8000
je 0x41aec2
push 0x5a
call edi
test eax, 0x8000
je 0x41aec2
xor esi, esi
mov eax, dword [esp + 0x1168]
cmp dword [eax - 0xc], 0
push 0
push 0
push 0
push esi
je 0x41aee5
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [esp + 0x14], edi
jmp 0x41aef6
push str.CHM_MSDN
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esp + 0x14], eax
mov edi, eax
test edi, edi
je 0x41ae5c
test ebx, ebx
je 0x41af0f
push 0
push 0x84083180
push 0
push 0
jmp 0x41af7d
push 4
lea ecx, [esp + 0x24]
push ecx
push 0x41
push edi
mov dword [esp + 0x30], 1
call dword [sym.imp.WININET.dll_InternetSetOptionW]
cmp dword [esp + 0x116c], 0
je 0x41af56
mov eax, str.Accept_Encoding:_gzip_r_nConnection:_close
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41af40
sub eax, edx
sar eax, 1
mov ecx, str.Accept_Encoding:_gzip_r_nConnection:_close
jmp 0x41af74
mov eax, str.Accept_Encoding:_gzip
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41af60
sub eax, edx
sar eax, 1
mov ecx, str.Accept_Encoding:_gzip
push 0
push 0x84083180
push eax
push ecx
push ebp
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebp, eax
xor esi, esi
cmp ebp, esi
jne 0x41afbc
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea esi, [esp + 0x1168]
call fcn.004015c0
mov eax, dword [esp + 0x1168]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x41ae7f
xor eax, eax
push esi
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x14e], eax
mov dword [esp + 0x152], eax
mov dword [esp + 0x156], eax
mov dword [esp + 0x15a], eax
mov word [esp + 0x15e], ax
lea eax, [esp + 0x14c]
push eax
push 0x13
xor ecx, ecx
push ebp
mov word [esp + 0x158], cx
mov dword [esp + 0x38], 0x14
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x41b16c
lea ecx, [esp + 0x144]
push ecx
call fcn.0042928f
add esp, 4
cmp eax, 0xc8
jne 0x41b16c
push 0x1000
lea edx, [esp + 0x15d]
push esi
push edx
mov dword [esp + 0x1c], esi
xor edi, edi
mov byte [esp + 0x164], 0
call fcn.00429470
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x1000
lea ecx, [esp + 0x160]
push ecx
push ebp
call ebx
test eax, eax
je 0x41b123
cmp dword [esp + 0x10], 0
jbe 0x41b112
test esi, esi
jne 0x41b0a2
push 0x1001
call fcn.0042770a
push 0x1001
mov esi, eax
push 0
push esi
call fcn.00429470
add esp, 0x10
jmp 0x41b0c4
lea edx, [edi + 0x1001]
push edx
push esi
call fcn.004277d4
mov esi, eax
push 0x1001
lea eax, [esi + edi]
push 0
push eax
call fcn.00429470
add esp, 0x14
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x15c]
push edx
lea eax, [esi + edi]
push eax
call fcn.0042d760
add edi, dword [esp + 0x1c]
push 0x1001
lea ecx, [esp + 0x168]
push 0
push ecx
call fcn.00429470
add esp, 0x18
lea edx, [esp + 0x10]
push edx
push 0x1000
lea eax, [esp + 0x160]
push eax
push ebp
call ebx
test eax, eax
jne 0x41b075
test edi, edi
ja 0x41b13b
test esi, esi
je 0x41b123
push esi
call fcn.0042762d
add esp, 4
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov dword [ecx], 0
mov dword [edx], 0
xor esi, esi
jmp 0x41b14c
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov dword [eax], esi
mov dword [ecx], edi
mov esi, 1
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call edi
mov edx, dword [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x1168]
call fcn.00411300
mov eax, esi
jmp 0x41b186
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push ebp
call esi
push edi
call esi
lea eax, [esp + 0x1168]
call fcn.00411300
xor eax, eax
mov ecx, dword [esp + 0x115c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042761e
add esp, 0x1150
ret