Function at 0x402ac0
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x2c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
push esi
push edi
push eax
push 0x14d3b60
mov byte [esp + 0x1b], 0
call ebx
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x50]
mov dword [ecx], 0
test eax, eax
je 0x402af6
mov dword [eax], 0x14d3b60
mov eax, dword [esp + 0x58]
test eax, eax
je 0x402b04
mov dword [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ebx, [ebx]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x14c9b38
push 0x14bfb10
xor edi, edi
push 0x14d3b60
mov dword [esp + 0x68], edi
call fcn.00402360
add esp, 0x14
test al, al
je 0x402f3d
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x38]
push edi
push ecx
push 0x14bfb10
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebp, eax
mov dword [esp + 0x28], ebp
cmp ebp, edi
je 0x402f27
movzx eax, byte [esp + 0x1c]
neg eax
sbb eax, eax
and eax, 0x800000
push eax
lea ecx, [esp + 0x30]
push ecx
push edi
push edi
push 0x14c9b38
push 0x4d56e8
push ebp
mov dword [esp + 0x48], 0x40668c
mov dword [esp + 0x4c], edi
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
test edi, edi
je 0x402eee
mov ebp, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea edx, [esp + 0x18]
push edx
push 0x1f
push edi
mov dword [esp + 0x24], 0x3100
call ebp
push 4
lea eax, [esp + 0x18]
push eax
push 0x3f
push edi
mov dword [esp + 0x24], 2
call ebp
push str.Content_Type:_application_x_www_form_urlencoded_r_n
push 0x14b5ae8
call ebx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
lea ebp, [eax + ecx - 1]
push ebp
push eax
push 0x4065fc
push 0x14abac0
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x14abac0
push 0x14b5ae8
call esi
push 0x4d56e8
push 0x1492ac0
call ebx
push 0x4065f8
push 0x1492ac0
call esi
push 0x14c9b38
push 0x1492ac0
call esi
push str._HTTP_1.1_r_n
push 0x1492ac0
call esi
push str.User_Agent:
push 0x1492ac0
call esi
push str.Preloader_r_n
push 0x1492ac0
call esi
push 0x14b5ae8
push 0x1492ac0
call esi
push 0x4065a4
push 0x1492ac0
call esi
push 0
push 0
push 0x19000
push 0x43a3b0
push 0xffffffffffffffff
push 0x1492ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [0x4df710], 0
je 0x402c9f
push 0x4df710
push 0x43a3b0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0x4df710
call ebx
push eax
push 0x4df710
call ebx
movsx edx, byte [0x4df710]
neg edx
sbb edx, edx
push eax
and edx, 0x4df710
push edx
push 0x14b5ae8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x14b5ae8
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x402d4e
mov eax, dword [esp + 0x38]
push 0x14d3b60
push eax
push edi
call fcn.00402a30
add esp, 0xc
test al, al
je 0x402ed1
push 1
call fcn.004019a0
add esp, 4
push 0
push 0x4df710
call ebx
push eax
push 0x4df710
call ebx
movsx ecx, byte [0x4df710]
neg ecx
sbb ecx, ecx
push eax
and ecx, 0x4df710
push ecx
push 0x14b5ae8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x14b5ae8
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x402ed1
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x402ecd
push 0
lea edx, [esp + 0x28]
push edx
push 0x1479ac0
push 0x4065a0
push 0x16
push edi
mov dword [esp + 0x3c], 0x19000
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push 0
push 0
push 0x19000
push 0x4213b0
push 0xffffffffffffffff
push 0x1479ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x40659c
push 0x4213b0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.00402550
push edi
mov ebx, eax
call fcn.004023f0
mov ecx, eax
push ecx
mov dword [esp + 0x60], ecx
call fcn.00401990
lea eax, [ecx - 0x12c]
add esp, 0xc
cmp eax, 0x63
ja 0x402e29
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ecx
push edx
push 0x14bfb10
push edi
call fcn.00402590
add esp, 0x10
test eax, eax
je 0x402e69
mov ecx, dword [esp + 0x54]
cmp ecx, 0x12e
je 0x402e1b
cmp ecx, 0x12f
je 0x402e1b
mov ecx, dword [esp + 0x58]
mov byte [esp + 0x13], 1
test ecx, ecx
je 0x402e17
mov dword [ecx], eax
push 0x10
jmp 0x402e61
push eax
push 0x14d3b60
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x402e69
cmp ecx, 0xce
jne 0x402e5f
cmp ebx, dword [esp + 0x48]
jne 0x402e5b
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push ebp
push edx
push eax
push edi
call fcn.00402730
add esp, 0x18
mov byte [esp + 0x13], al
jmp 0x402e69
push 0x11
jmp 0x402e61
push 0xe
call fcn.00401970
add esp, 4
mov eax, dword [0x4083a8]
cmp eax, 0x1400
jge 0x402ec4
mov ebp, 0x1400
mov dword [esp + 0x20], 0
sub ebp, eax
lea ecx, [esp + 0x20]
push ecx
push ebp
lea edx, [eax + 0x4083b0]
push edx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x402ebf
mov ecx, dword [esp + 0x20]
test ecx, ecx
jbe 0x402ebf
mov eax, dword [0x4083a8]
sub ebp, ecx
add eax, ecx
mov dword [0x4083a8], eax
test ebp, ebp
jg 0x402e84
mov byte [eax + 0x4083b0], 0
jmp 0x402edb
mov eax, dword [0x4083a8]
mov byte [eax + 0x4083b0], 0
jmp 0x402edb
push 3
jmp 0x402ed3
push 0xd
call fcn.00401970
add esp, 4
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, dword [esp + 0x28]
jmp 0x402ef8
push 0xc
call fcn.00401970
add esp, 4
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp dword [esp + 0x54], 0x12e
je 0x402b10
cmp dword [esp + 0x54], 0x12f
je 0x402b10
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xb
call fcn.00401970
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xa
call fcn.00401970
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret