Function at 0x406d06
Capabilities:
Contain obfuscated stackstrings
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
sub esp, 0x4a4
lea ebp, [esp - 4]
mov eax, dword [0x41e16c]
xor eax, ebp
mov dword [ebp + 0x4a4], eax
push 0x38
mov eax, 0x418b31
call fcn.00408d6b
mov eax, dword [ebp + 0x4b4]
mov edi, dword [ebp + 0x4b0]
mov esi, dword [ebp + 0x4bc]
xor ebx, ebx
mov dword [ebp - 0x20], ecx
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0xd], bl
mov dword [ebp + 0x34], 0xf
call fcn.00401712
push ebx
lea ecx, [ebp + 0x54]
mov dword [ebp - 4], ebx
mov dword [ebp + 0x6c], 0xf
call fcn.00401712
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
mov byte [ebp - 4], 1
call fcn.0040668e
add esp, 0x14
test al, al
je 0x4070aa
push dword [ebp - 0x1c]
xor edi, edi
inc edi
call fcn.00406a98
pop ecx
test al, al
je 0x406dad
mov ecx, dword [ebp - 0x20]
call fcn.004064f9
test al, al
jne 0x406dad
xor edi, edi
push edi
push dword [ebp - 0x14]
lea eax, [ebp + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.0040204a
mov edi, dword [ebp - 0x20]
mov ecx, edi
call fcn.00405c01
cmp byte [edi + 0x1c], bl
je 0x4070a3
cmp dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ebx
jne 0x406de5
mov dword [ebp - 0x14], 0x803000
push dword [ebp + 0x4b8]
lea eax, [ebp - 0x44]
push eax
call fcn.004062a3
cmp dword [ebp + 0x6c], 0x10
pop ecx
pop ecx
mov ecx, dword [ebp + 0x58]
jae 0x406e02
lea ecx, [ebp + 0x58]
cmp dword [eax + 0x18], 0x10
jb 0x406e0d
mov eax, dword [eax + 4]
jmp 0x406e10
add eax, 4
push ebx
push dword [ebp - 0x14]
push ebx
push ebx
push str.HTTP_1.0
push ecx
push eax
push dword [edi + 0x40]
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
push ebx
push 1
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x18], eax
call fcn.00401877
cmp dword [ebp - 0x18], ebx
je 0x40709a
cmp dword [ebp - 0x1c], 1
jne 0x406e73
push 4
pop edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x1f
push dword [ebp - 0x18]
mov dword [ebp - 0x24], edi
call dword [sym.imp.WININET.dll_InternetQueryOptionA]
or dword [ebp - 0x1c], 0x100
push edi
lea eax, [ebp - 0x1c]
push eax
push 0x1f
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetSetOptionA]
cmp dword [ebp + 0x4b8], 1
jne 0x407017
lea eax, [ebp + 0x474]
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp + 0x48b], 0x6f
mov byte [ebp + 0x48e], 0x78
mov byte [ebp + 0x482], 0x61
mov byte [ebp + 0x478], 0x65
mov byte [ebp + 0x47c], 0x54
mov byte [ebp + 0x475], 0x6f
mov byte [ebp + 0x497], 0x6d
mov byte [ebp + 0x49c], 0x65
mov byte [ebp + 0x49e], 0x63
mov byte [ebp + 0x47d], 0x79
mov byte [ebp + 0x48c], 0x6e
mov byte [ebp + 0x494], 0x66
mov byte [ebp + 0x491], 0x77
mov byte [ebp + 0x493], 0x2d
mov byte [ebp + 0x49d], 0x6e
mov byte [ebp + 0x4a1], 0x65
mov byte [ebp + 0x47f], 0x65
mov byte [ebp + 0x485], 0x6c
mov byte [ebp + 0x477], 0x74
mov byte [ebp + 0x49f], 0x6f
mov byte [ebp + 0x498], 0x2d
mov byte [ebp + 0x481], 0x20
mov byte [ebp + 0x4a0], 0x64
mov byte [ebp + 0x47a], 0x74
mov byte [ebp + 0x479], 0x6e
mov byte [ebp + 0x488], 0x61
mov byte [ebp + 0x492], 0x77
mov byte [ebp + 0x495], 0x6f
mov byte [ebp + 0x490], 0x77
mov byte [ebp + 0x476], 0x6e
mov byte [ebp + 0x489], 0x74
mov byte [ebp + 0x487], 0x63
mov byte [ebp + 0x486], 0x69
mov byte [ebp + 0x49b], 0x6c
mov byte [ebp + 0x48f], 0x2d
mov byte [ebp + 0x4a3], bl
mov byte [ebp + 0x49a], 0x72
mov byte [ebp + 0x47b], 0x2d
mov byte [ebp + 0x4a2], 0x64
mov byte [ebp + 0x474], 0x43
mov byte [ebp + 0x484], 0x70
mov byte [ebp + 0x496], 0x72
mov byte [ebp + 0x480], 0x3a
mov byte [ebp + 0x48d], 0x2f
mov byte [ebp + 0x47e], 0x70
mov byte [ebp + 0x483], 0x70
mov byte [ebp + 0x48a], 0x69
mov byte [ebp + 0x499], 0x75
call fcn.00402235
cmp dword [esi + 0x18], 0x10
mov eax, dword [esi + 0x14]
jb 0x406fec
mov esi, dword [esi + 4]
jmp 0x406fef
add esi, 4
cmp dword [ebp + 0x50], 0x10
mov ecx, dword [ebp + 0x3c]
jae 0x406ffb
lea ecx, [ebp + 0x3c]
push eax
push esi
push dword [ebp + 0x4c]
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.00401877
jmp 0x40702c
cmp dword [ebp + 0x4b8], ebx
jne 0x40702c
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.00401712
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
mov byte [ebp - 4], 2
mov dword [ebp - 0x14], ebx
mov edi, 0x400
jmp 0x407067
mov eax, dword [ebp - 0x14]
cmp eax, ebx
je 0x407079
mov byte [ebp + eax + 0x70], bl
lea eax, [ebp + 0x70]
push eax
lea ecx, [ebp]
call fcn.00401f2f
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp + 0x70]
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
jne 0x407050
mov ecx, dword [ebp - 0x28]
push 0xffffffffffffffff
push ebx
lea eax, [ebp]
push eax
call fcn.00401e01
push ebx
push 1
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
call fcn.00401877
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, edi
call fcn.00405575
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.00401877
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.00401877
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x4a4]
xor ecx, ebp
call fcn.00407cd7
add ebp, 0x4a8
leave
ret 0x10