Function at 0x433354
Capabilities:
Check for software breakpoints
Check http status code
Delete file
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Resolve dns
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b7d4
mov eax, dword fs:[0]
push eax
mov eax, 0x39ac
call fcn.00450110
mov eax, dword [0x49d034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3928], edx
mov dword [ebp - 0x3934], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x39b8]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x392c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3910], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3918], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3954], eax
lea eax, [ebp - 0x38f8]
push eax
push str.PerformRemoteHttpOp
mov dword [ebp - 0x38f8], 0x4b1
call fcn.0041dfa0
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x38f4]
mov eax, dword [0x4a0364]
mov ebx, edx
push 9
pop ecx
mov dword [ebp - 0x3930], eax
xor eax, eax
push 0x80
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x3920], edx
push eax
mov dword [ebp - 0x3938], ebx
mov dword [ebp - 0x391c], edx
mov dword [ebp - 0x38fc], edx
mov dword [ebp - 0x390c], edx
mov dword [ebp - 0x3940], 4
mov dword [ebp - 0x3944], edx
call fcn.00451b90
add esp, 0xc
xor ecx, ecx
mov byte [ebp - 0x3914], cl
call fcn.00409480
push eax
lea ecx, [ebp - 0x3924]
call fcn.00408c39
mov byte [ebp - 4], 2
call fcn.00409480
push eax
lea ecx, [ebp - 0x3908]
call fcn.00408c39
mov byte [ebp - 4], 4
xor eax, eax
push 6
pop ecx
lea edi, [ebp - 0x39ac]
mov dword [ebp - 0x3994], 0x3c
rep stosd dword es:[edi], eax
mov cl, byte [0x4a0368]
lea edi, [ebp - 0x3950]
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x3900], edx
mov dword [ebp - 0x3904], ecx
mov dword [ebp - 0x398c], 0x20
stosd dword es:[edi], eax
mov dword [ebp - 0x3988], edx
stosd dword es:[edi], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x3990], eax
mov edi, 0x800
lea eax, [ebp - 0x10d0]
mov dword [ebp - 0x3980], edi
mov dword [ebp - 0x3984], eax
xor eax, eax
mov word [ebp - 0x397c], ax
lea eax, [ebp - 0x18d0]
mov dword [ebp - 0x3978], eax
lea eax, [ebp - 0x38d0]
mov dword [ebp - 0x3964], edi
mov edi, dword [ebp - 0x3934]
mov edx, 0x400
mov dword [ebp - 0x3970], eax
lea eax, [ebp - 0x30d0]
mov dword [ebp - 0x3968], eax
lea eax, [ebp - 0x20d0]
mov dword [ebp - 0x3974], edx
mov dword [ebp - 0x396c], edx
mov dword [ebp - 0x3960], eax
mov dword [ebp - 0x395c], edx
cmp edi, 5
je 0x43353b
cmp edi, 6
jne 0x433582
mov edx, dword [ebp - 0x392c]
test edx, edx
je 0x433582
xor eax, eax
cmp word [edx], ax
je 0x433582
cmp dword [ebp - 0x3918], eax
je 0x43355c
cmp dword [ebp - 0x3910], eax
je 0x433582
mov eax, dword [0x4a0370]
test esi, esi
cmove esi, eax
mov dword [ebp - 0x3958], esi
cmp esi, 4
jne 0x433631
cmp byte [0x4a0374], 0
jne 0x433667
mov dword [ebp - 0x38f8], 0x57
cmp dword [ebp - 0x394c], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x4335a3
push dword [ebp - 0x394c]
call esi
cmp dword [ebp - 0x3948], 0
je 0x4335b4
push dword [ebp - 0x3948]
call esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
je 0x4335c1
push ebx
call esi
mov eax, dword [ebp - 0x391c]
test eax, eax
je 0x4335ce
push eax
call esi
mov eax, dword [ebp - 0x3920]
test eax, eax
je 0x4335db
push eax
call esi
mov esi, dword [ebp - 0x38f8]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x3908]
lea ecx, [ecx - 0x10]
call fcn.00409575
xor eax, eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x3924]
add ecx, 0xfffffff0
call fcn.00409575
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39b8]
call fcn.0041e015
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044f515
leave
ret
cmp esi, 5
jg 0x433582
cmp esi, 3
jne 0x433667
cmp eax, esi
je 0x433667
call fcn.004340c3
test eax, eax
je 0x43365b
mov dword [ebp - 0x38f8], 0x32
jmp 0x43358c
mov ecx, dword [ebp - 0x3904]
mov edx, dword [ebp - 0x392c]
test cl, cl
je 0x43367c
xor eax, eax
movzx ecx, cl
cmp esi, 4
cmove ecx, eax
mov dword [ebp - 0x3904], ecx
push edx
push str.PerformRemoteHttpOp:_Url:__s
call fcn.0041dafb
mov eax, dword [ebp - 0x3910]
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
je 0x4336ac
cmp dword [ebp - 0x3918], ecx
jne 0x4336ac
mov dword [ebp - 0x3900], eax
cmp word [eax], cx
je 0x433582
cmp dword [0x4a02b0], 0
jle 0x4336c4
mov dword [ebp - 0x38f8], 0x2e3
jmp 0x43358c
xor edx, edx
inc edx
cmp esi, 4
je 0x43371b
cmp esi, 3
je 0x4336f2
push ecx
xor eax, eax
cmp esi, edx
push ecx
push ecx
setne al
push eax
push dword [0x4a0308]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
mov dword [ebp - 0x3920], esi
jmp 0x433763
lea eax, [ebp - 0x10d0]
cmp edi, 5
jne 0x433713
push dword [0x4a0388]
push 0x800
push eax
call fcn.00465410
add esp, 0xc
jmp 0x433742
push dword [0x4a038c]
jmp 0x433703
movzx eax, word [0x4a037c]
push eax
push dword [0x4a0378]
lea eax, [ebp - 0x10d0]
push str._s:_hu
push 0x800
push eax
call fcn.0040af2d
add esp, 0x14
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x10d0]
push eax
push 3
push dword [0x4a0308]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
mov dword [ebp - 0x3920], eax
test esi, esi
je 0x43358c
cmp dword [0x4a02b0], 0
jg 0x4336b5
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x3930]
push 4
push eax
push 3
push esi
call edi
test eax, eax
je 0x43358c
push 4
lea eax, [ebp - 0x3930]
push eax
push 7
push esi
call edi
test eax, eax
je 0x43358c
push 4
lea eax, [ebp - 0x3930]
push eax
push 6
push esi
call edi
test eax, eax
je 0x43358c
push 4
lea eax, [ebp - 0x3930]
push eax
push 5
push esi
call edi
test eax, eax
je 0x43358c
mov eax, dword [ebp - 0x3900]
test eax, eax
je 0x43380c
lea ecx, [ebp - 0x38f4]
push ecx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x433806
push 9
pop ecx
lea edi, [ebp - 0x38f4]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov eax, dword [ebp - 0x3900]
cmp dword [ebp - 0x3928], 1
jne 0x433889
test eax, eax
je 0x433889
cmp dword [ebp - 0x38d4], 0
je 0x433847
push dword [ebp - 0x38d4]
lea eax, [ebp - 0x90]
push str.Range:_bytes_u__n
push 0x40
push eax
call fcn.0040af2d
add esp, 0x10
mov byte [ebp - 0x3914], 1
jmp 0x433889
mov ebx, dword [ebp - 0x3900]
push 9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x43387d
cmp eax, 0x20
je 0x43386d
cmp eax, 5
jne 0x43387d
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x433850
mov ebx, dword [ebp - 0x3938]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x3994]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x392c]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x4338b3
mov dword [ebp - 0x38f8], 0xb
jmp 0x43358c
cmp byte [ebp - 0x3904], 0
je 0x433a2e
mov esi, dword [sym.imp.DNSAPI.dll_DnsQuery_W]
lea eax, [ebp - 0x38fc]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebp - 0x3984]
call esi
test eax, eax
jne 0x43358c
mov eax, dword [ebp - 0x38fc]
test eax, eax
je 0x43358c
xor ecx, ecx
inc ecx
cmp word [eax + 8], cx
je 0x433906
mov eax, dword [eax]
test eax, eax
jne 0x4338f5
jmp 0x43358c
mov eax, dword [eax + 0x18]
push ecx
push dword [ebp - 0x38fc]
mov dword [ebp - 0x3934], eax
call dword [sym.imp.DNSAPI.dll_DnsFree]
mov eax, dword [ebp - 0x3934]
xor ecx, ecx
mov dword [ebp - 0x38fc], ecx
cmp al, 0x7f
je 0x43395e
cmp al, 0xa9
jne 0x433937
cmp ah, 0xfe
jmp 0x433958
cmp al, 0xa
je 0x43395e
cmp al, 0xac
jne 0x43394d
mov al, ah
sub al, 0x10
cmp al, 0xf
ja 0x433a2e
jmp 0x43395e
cmp al, 0xc0
jne 0x433a2e
cmp ah, 0xa8
jne 0x433a2e
push ecx
lea eax, [ebp - 0x38fc]
push eax
push ecx
xor eax, eax
push 0x48
inc eax
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
test eax, eax
jne 0x433a2e
mov esi, dword [ebp - 0x38fc]
test esi, esi
je 0x433a2e
inc eax
cmp word [esi + 8], ax
je 0x43399e
mov esi, dword [esi]
test esi, esi
jne 0x43398d
jmp 0x433a2e
mov ecx, str.Host:
call fcn.0040b056
push eax
push str.Host:
lea ecx, [ebp - 0x3908]
call fcn.0040afd8
lea ecx, [ebp - 0x10d0]
call fcn.0040b056
push eax
lea eax, [ebp - 0x10d0]
push eax
lea ecx, [ebp - 0x3908]
call fcn.0040c3a0
mov ecx, 0x48cd58
call fcn.0040b056
push eax
push 0x48cd58
lea ecx, [ebp - 0x3908]
call fcn.0040c3a0
mov esi, dword [esi + 0x18]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x38fc]
call dword [sym.imp.DNSAPI.dll_DnsFree]
xor eax, eax
push esi
mov dword [ebp - 0x38fc], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x48ff18
lea eax, [ebp - 0x10d0]
push 0x800
push eax
call fcn.0040af2d
add esp, 0x10
mov esi, dword [ebp - 0x3954]
test esi, esi
je 0x433a4c
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x3908]
call fcn.0040c3a0
mov ecx, dword [ebp - 0x3988]
xor edx, edx
inc edx
lea eax, [ecx - 1]
cmp eax, edx
ja 0x433a7b
cmp word [ebp - 0x397c], 0
jne 0x433a7b
cmp ecx, edx
jne 0x433a6f
push 0x50
pop eax
jmp 0x433a74
mov eax, 0x1bb
mov word [ebp - 0x397c], ax
xor eax, eax
push eax
push dword [ebp - 0x397c]
lea eax, [ebp - 0x10d0]
push eax
push dword [ebp - 0x3920]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp - 0x391c], eax
test eax, eax
je 0x43358c
lea ecx, [ebp - 0x30d0]
call fcn.0040b056
push eax
lea eax, [ebp - 0x30d0]
push eax
lea ecx, [ebp - 0x3924]
call fcn.0040afd8
lea ecx, [ebp - 0x20d0]
call fcn.0040b056
push eax
lea eax, [ebp - 0x20d0]
push eax
lea ecx, [ebp - 0x3924]
call fcn.0040c3a0
cmp dword [ebp - 0x3988], 2
mov ecx, 0x800100
mov eax, 0x100
cmove eax, ecx
mov dword [ebp - 0x393c], eax
call fcn.00409480
push eax
lea ecx, [ebp - 0x3904]
call fcn.00408c39
mov byte [ebp - 4], 6
cmp dword [ebp - 0x3928], 0
jne 0x433b20
mov esi, str.POST
jmp 0x433b33
cmp dword [ebp - 0x3910], 0
mov esi, 0x48ff2c
jne 0x433b33
mov esi, str.HEAD
mov ecx, esi
call fcn.0040b056
push eax
push esi
lea ecx, [ebp - 0x3904]
call fcn.0040afd8
push dword [ebp - 0x393c]
mov esi, dword [ebp - 0x3904]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x3924]
push esi
push dword [ebp - 0x391c]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
mov dword [ebp - 0x3938], ebx
test ebx, ebx
jne 0x433b88
mov byte [ebp - 4], 4
lea ecx, [esi - 0x10]
call fcn.00409575
jmp 0x43358c
cmp dword [ebp - 0x3958], 5
jne 0x433be2
xor eax, eax
mov dword [ebp - 0x39a8], 3
inc eax
mov dword [ebp - 0x39ac], eax
mov dword [ebp - 0x3998], eax
lea eax, [ebp - 0x3950]
push eax
lea eax, [ebp - 0x39ac]
push eax
push dword [ebp - 0x392c]
push dword [ebp - 0x3920]
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x433be2
push 0xc
lea eax, [ebp - 0x3950]
push eax
push 0x26
push ebx
call edi
test eax, eax
jne 0x433be2
jmp 0x433b77
cmp word [ebp - 0x18d0], 0
je 0x433c12
xor ecx, ecx
lea eax, [ebp - 0x38d0]
push ecx
push eax
lea eax, [ebp - 0x18d0]
push eax
xor eax, eax
inc eax
push eax
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x433c12
jmp 0x433b77
cmp byte [0x4a037e], 0
je 0x433c59
mov eax, dword [0x4a0380]
push dword [eax - 0xc]
push eax
push 0x1002
push dword [ebp - 0x391c]
call edi
test eax, eax
jne 0x433c3a
jmp 0x433b77
mov eax, dword [0x4a0384]
push dword [eax - 0xc]
push eax
push 0x1003
push dword [ebp - 0x391c]
call edi
test eax, eax
jne 0x433c59
jmp 0x433b77
cmp dword [ebp - 0x3988], 2
jne 0x433c83
push 4
lea eax, [ebp - 0x393c]
mov dword [ebp - 0x393c], 0x3000
push eax
push 0x1f
push ebx
call edi
test eax, eax
jne 0x433c83
jmp 0x433b77
mov eax, dword [ebp - 0x3908]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [eax - 0xc], 0
je 0x433ca9
push 0x10000000
push 0xffffffffffffffff
push eax
push ebx
call edi
test eax, eax
jne 0x433ca9
jmp 0x433b77
cmp dword [ebp - 0x3928], 0
jne 0x433cde
mov edi, dword [ebp - 0x3918]
test edi, edi
je 0x433cc0
mov eax, dword [edi]
jmp 0x433cc6
mov eax, dword [ebp - 0x38d4]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x433d1f
jmp 0x433b77
cmp byte [ebp - 0x3914], 0
je 0x433d01
push 0x10000000
push 0xffffffffffffffff
lea eax, [ebp - 0x90]
push eax
push ebx
call edi
test eax, eax
jne 0x433d01
jmp 0x433b77
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x433d19
jmp 0x433b77
mov edi, dword [ebp - 0x3918]
cmp dword [0x4a02b0], 0
jle 0x433d37
mov dword [ebp - 0x38f8], 0x2e3
jmp 0x433b77
cmp dword [ebp - 0x3928], 0
jne 0x433e03
mov eax, dword [ebp - 0x3910]
test eax, eax
je 0x433d6f
push dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov edx, eax
mov ecx, ebx
push edi
call fcn.0041cc87
mov dword [ebp - 0x38f8], eax
pop ecx
pop ecx
test eax, eax
je 0x433d6f
jmp 0x433b77
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x433d82
jmp 0x433b77
lea eax, [ebp - 0x3944]
push eax
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x390c]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x433daf
jmp 0x433b77
mov eax, dword [ebp - 0x390c]
cmp eax, 0xc8
je 0x433dd9
cmp eax, 0xc9
je 0x433dd9
cmp eax, 0xcc
je 0x433df6
mov dword [ebp - 0x38f8], 9
jmp 0x433b77
cmp eax, 0xcc
je 0x433df6
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, ebx
call fcn.0041ce70
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x38f8], eax
jmp 0x433b77
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x433e16
jmp 0x433b77
lea eax, [ebp - 0x3944]
push eax
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x390c]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x433e43
jmp 0x433b77
cmp dword [ebp - 0x390c], 0xce
je 0x433ebb
cmp dword [ebp - 0x390c], 0xc8
je 0x433e60
jmp 0x433b77
cmp byte [ebp - 0x3914], 0
je 0x433ebb
xor eax, eax
mov byte [ebp - 0x3914], al
cmp dword [ebp - 0x3900], eax
je 0x433ebb
mov esi, dword [ebp - 0x3900]
push 9
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x433eaf
cmp eax, 0x20
je 0x433e9f
cmp eax, 5
jne 0x433eaf
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub ebx, 1
jns 0x433e82
mov esi, dword [ebp - 0x3904]
mov ebx, dword [ebp - 0x3938]
mov eax, dword [ebp - 0x3910]
test eax, eax
je 0x433df6
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edx, eax
mov ecx, ebx
push dword [ebp - 0x3914]
push dword [ebp - 0x3918]
call fcn.0041ce70
add esp, 0xc
mov dword [ebp - 0x38f8], eax
test eax, eax
je 0x433df6
jmp 0x433b77