Function at 0x404a80
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584afd
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push esi
push edi
mov eax, dword [0x5eb1c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x30], 0
mov dword [eax], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 3
call fcn.0042613a
mov ecx, eax
mov byte [ebp - 4], 2
test ecx, ecx
je 0x404edd
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], 6
call fcn.0042613a
mov ecx, eax
mov byte [ebp - 4], 5
test ecx, ecx
je 0x404ee7
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 4], 9
call fcn.0042613a
mov ecx, eax
mov byte [ebp - 4], 8
test ecx, ecx
je 0x404ef1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x70]
xorps xmm0, xmm0
mov dword [ebp - 0x20], ebx
push ecx
push ebx
mov dword [ebp - 0x6c], ebx
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x70], 0x3c
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x38], 0xffffffff
push dword [eax - 0xc]
mov byte [ebp - 4], 0xa
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x404dff
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 0xb
call fcn.0042613a
mov ecx, eax
mov byte [ebp - 4], 0xa
test ecx, ecx
je 0x404efb
cmp dword [ebp - 0x18], ebx
jne 0x404bcd
test esi, esi
jne 0x404ed3
mov eax, dword [ecx]
push 2
push esi
call dword [eax]
mov esi, eax
test esi, esi
je 0x404f05
mov eax, dword [ebp - 0x30]
lea ecx, [esi + 0x10]
mov dword [ebp - 0x28], ecx
test eax, eax
js 0x404ed3
cmp eax, dword [esi + 8]
jg 0x404ed3
mov dword [esi + 4], eax
xor edx, edx
add eax, eax
mov word [eax + ecx], dx
test eax, eax
je 0x404c3a
test ecx, ecx
je 0x404c2a
mov edx, dword [ebp - 0x18]
push eax
test edx, edx
je 0x404c1f
push edx
push ecx
call fcn.0055ddc0
add esp, 0xc
jmp 0x404c3a
push 0
push ecx
call fcn.0055e340
add esp, 0xc
call fcn.00561652
mov dword [eax], 0x16
call fcn.005612ff
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xc
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402490
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404c63
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x30]
call fcn.004021a0
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xd
call fcn.00402490
mov edx, dword [ebp - 0x30]
or eax, 0xffffffff
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404c9a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0_
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x404cc2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [ebp - 0x1c]
jmp 0x404e05
mov esi, dword [ebp - 0x1c]
push 0
push dword [ebp - 0x58]
push esi
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ecx, eax
mov dword [ebp - 0x2c], ecx
test ecx, ecx
je 0x404dff
xor eax, eax
mov edx, 0x800000
cmp dword [ebp - 0x64], 2
cmove eax, edx
push eax
push 0
push 0
push 0
push dword [ebp - 0x24]
push 0x596124
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
mov dword [ebp - 0x18], ebx
test ebx, ebx
je 0x404dff
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
mov ecx, eax
mov dword [ebp - 0x28], ecx
test ecx, ecx
je 0x404d38
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax - 4], 1
jle 0x404d4f
push dword [eax - 0xc]
lea ecx, [ebp + 0xc]
call fcn.00404180
mov eax, dword [ebp + 0xc]
push 0x596144
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00561ec9
add esp, 0xc
test eax, eax
jne 0x404dff
cmp dword [ebp - 0x28], eax
je 0x404e08
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x404dff
mov eax, dword [ebp - 0x10]
inc eax
push eax
call fcn.0042505a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x404df3
mov ecx, dword [ebp - 0x10]
inc ecx
push ecx
push 0
push ebx
call fcn.0055e340
add esp, 0xc
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x404dd8
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x28]
push ebx
call fcn.0056b1f2
add esp, 0x10
push ebx
call fcn.00425063
mov ecx, dword [ebp + 0x10]
add esp, 4
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
add dword [ecx], eax
test eax, eax
jmp 0x404d6c
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x10], 0
jmp 0x404e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x404e18
push eax
call fcn.0056af4f
add esp, 4
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
je 0x404e29
push ebx
call eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x404e33
push ecx
call eax
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x404e41
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov edx, dword [ebp - 0x24]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404e5e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x404e75
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x404e8c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x404ea6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0xc]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x404ebe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00403690
push 0x80004005
call fcn.00403690
push 0x80004005
call fcn.00403690
push 0x80004005
call fcn.00403690
push 0x80004005
call fcn.00403690
call fcn.00409660
int3