Function at 0x41b2e0
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x587ccd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push ebx
push ebp
mov ebp, dword [esp + 0x88]
push esi
mov ebx, 1
push edi
lea edi, [ecx + 0x23e0]
push ebx
lea eax, [esp + 0x14]
mov dword [esp + 0x20], ecx
push ebp
push eax
mov ecx, edi
mov dword [esp + 0x40], 0
call fcn.0054f84d
push 2
lea ecx, [esp + 0x94]
push ebp
push ecx
mov ecx, edi
mov dword [esp + 0x90], ebx
call fcn.0054f84d
mov eax, dword [esp + 0x90]
mov byte [esp + 0x84], 2
mov esi, 0x602204
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41b379
test cl, cl
je 0x41b375
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41b379
add eax, 2
add esi, 2
test cl, cl
jne 0x41b355
xor eax, eax
jmp 0x41b37e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41b393
lea eax, [esp + 0x10]
lea ecx, [esp + 0x90]
push eax
call fcn.00557257
push 0
push str.http:__
lea ecx, [esp + 0x18]
call fcn.0054e010
test eax, eax
je 0x41b45f
mov eax, dword [esp + 0x10]
cmp dword [eax - 8], ebx
jle 0x41b45f
cmp byte [eax + 1], 0x3a
je 0x41b45f
mov ecx, 0x603180
call fcn.0049f740
test eax, eax
je 0x41b45f
lea ecx, [esp + 0x28]
push ecx
mov ecx, 0x603180
call fcn.0049f750
mov ecx, eax
call fcn.004417b0
push 0x5ec3bc
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0x90], 3
call fcn.005573b3
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push eax
push edx
mov byte [esp + 0x90], 4
call fcn.0055734d
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x88], 5
call fcn.00557257
lea ecx, [esp + 0x20]
mov byte [esp + 0x84], 4
call fcn.0055711e
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 3
call fcn.0055711e
lea ecx, [esp + 0x28]
mov byte [esp + 0x84], 2
call fcn.0055711e
push 0
push str.http:__
lea ecx, [esp + 0x98]
call fcn.0054e010
test eax, eax
je 0x41b537
mov eax, dword [esp + 0x90]
cmp dword [eax - 8], ebx
jle 0x41b537
cmp byte [eax + 1], 0x3a
je 0x41b537
mov ecx, 0x603180
call fcn.0049f740
test eax, eax
je 0x41b537
lea eax, [esp + 0x20]
mov ecx, 0x603180
push eax
call fcn.0049f750
mov ecx, eax
call fcn.004417b0
push 0x5ec3bc
lea ecx, [esp + 0x28]
push eax
push ecx
mov byte [esp + 0x90], 6
call fcn.005573b3
lea edx, [esp + 0x90]
mov bl, 7
push edx
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x8c], bl
push eax
call fcn.0055734d
push eax
lea ecx, [esp + 0x94]
mov byte [esp + 0x88], 8
call fcn.00557257
lea ecx, [esp + 0x28]
mov byte [esp + 0x84], bl
call fcn.0055711e
lea ecx, [esp + 0x24]
mov byte [esp + 0x84], 6
call fcn.0055711e
lea ecx, [esp + 0x20]
mov byte [esp + 0x84], 2
call fcn.0055711e
push 3
lea ecx, [esp + 0x1c]
push ebp
push ecx
mov ecx, edi
call fcn.0054f84d
push 4
lea edx, [esp + 0x18]
push ebp
push edx
mov ecx, edi
mov byte [esp + 0x90], 9
call fcn.0054f84d
mov eax, dword [esp + 0x18]
mov byte [esp + 0x84], 0xa
mov esi, 0x602204
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41b596
test cl, cl
je 0x41b592
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41b596
add eax, 2
add esi, 2
test cl, cl
jne 0x41b56e
xor eax, eax
jmp 0x41b59b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41b5ad
push 0x5eca80
lea ecx, [esp + 0x1c]
call fcn.005572a7
mov eax, dword [esp + 0x14]
mov esi, 0x602204
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x41b5de
test cl, cl
je 0x41b5da
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x41b5de
add eax, 2
add esi, 2
test cl, cl
jne 0x41b5b6
xor eax, eax
jmp 0x41b5e3
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41b5f5
push 0x5eca80
lea ecx, [esp + 0x18]
call fcn.005572a7
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x2c]
push eax
push 0x5ec498
push ecx
call fcn.0053d438
mov eax, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x30]
push edx
push 0x5ec498
push eax
call fcn.0053d438
mov edx, dword [esp + 0x28]
add esp, 0xc
lea ecx, [esp + 0x54]
mov dword [esp + 0x54], 2
mov eax, dword [edx + 0x23fc]
push ecx
push 0
push 0x1005
push eax
mov dword [esp + 0x68], ebp
mov dword [esp + 0x6c], 0
call dword [0x5e92a4]
lea ecx, [esp + 0x38]
call fcn.0048efe0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x90]
mov bl, 0xb
mov dword [esp + 0x48], ecx
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x88], bl
mov dword [esp + 0x48], edx
call fcn.00557257
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x50]
call fcn.00557257
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push ebp
push edx
call fcn.0041b0c0
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x88], 0xc
call fcn.00557257
lea ecx, [esp + 0x28]
mov byte [esp + 0x84], bl
call fcn.0055711e
mov esi, dword [esp + 0x8c]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x3c], eax
mov dword [esi + 4], eax
lea eax, [esp + 0x40]
push eax
lea ecx, [esi + 8]
call fcn.00556e93
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x4c]
mov dword [esi + 0xc], ecx
push eax
lea ecx, [esi + 0x14]
mov byte [esp + 0x88], 0xd
mov dword [esi + 0x10], edx
call fcn.00556e93
lea ecx, [esp + 0x50]
mov byte [esp + 0x84], 0xe
push ecx
lea ecx, [esi + 0x18]
call fcn.00556e93
mov dword [esi], 0x5a99bc
mov dword [esp + 0x34], 1
lea ecx, [esp + 0x38]
mov byte [esp + 0x84], 0xa
call fcn.0048f080
lea ecx, [esp + 0x14]
mov byte [esp + 0x84], 9
call fcn.0055711e
lea ecx, [esp + 0x18]
mov byte [esp + 0x84], 2
call fcn.0055711e
lea ecx, [esp + 0x90]
mov byte [esp + 0x84], 1
call fcn.0055711e
lea ecx, [esp + 0x10]
mov byte [esp + 0x84], 0
call fcn.0055711e
mov ecx, dword [esp + 0x7c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x78
ret 8