Function at 0x402213
Capabilities:
Receive http response
Write file on windows

Disassembly:
push 0x94
push 0x47eb18
call fcn.00469d60
mov ebx, ecx
mov dword [ebp - 0x34], ebx
mov edi, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [ebx + 0x1c], ecx
jle 0x4027d1
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x28]
jne 0x4027d1
mov eax, dword [ebp + 0xc]
mov edx, 0x80
cmp eax, edx
ja 0x402305
je 0x4022f9
dec eax
je 0x4022d0
dec eax
je 0x4022b3
dec eax
dec eax
je 0x4022a7
push 4
pop ecx
sub eax, ecx
je 0x40229b
sub eax, 8
je 0x40228f
sub eax, 0x10
je 0x402287
sub eax, 0x20
jne 0x4027d1
mov dword [ebx + 0x1c], 0xc
jmp 0x4027d1
mov dword [ebx + 0x1c], ecx
jmp 0x4027d1
mov dword [ebx + 0x1c], 3
jmp 0x4027d1
mov dword [ebx + 0x1c], 9
jmp 0x4027d1
mov dword [ebx + 0x1c], 8
jmp 0x4027d1
mov dword [ebx + 0x1c], 7
lea esi, [ebx + 0x206c]
mov ecx, esi
call fcn.00401364
or dword [ebp - 0x7c], 0xffffffff
lea edx, [ebp - 0x7c]
jmp 0x4022eb
mov dword [ebx + 0x1c], 6
lea esi, [ebx + 0x2068]
mov ecx, esi
call fcn.00401364
or dword [ebp - 0x3c], 0xffffffff
lea edx, [ebp - 0x3c]
mov ecx, edi
call fcn.0040144e
mov dword [esi], eax
jmp 0x4027d1
mov dword [ebx + 0x1c], 0xd
jmp 0x4027d1
cmp eax, 0x100
je 0x4027ca
cmp eax, 0x200
je 0x4027c1
cmp eax, 0x20000
je 0x4025cb
cmp eax, 0x40000
je 0x4024b4
cmp eax, 0x80000
je 0x40236e
cmp eax, 0x200000
je 0x402360
cmp eax, 0x400000
jne 0x4027d1
mov dword [ebx + 0x1c], 5
push ecx
push dword [ebx + 0x28]
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
jmp 0x4027d1
push ecx
push edi
mov ecx, ebx
call fcn.0040215c
jmp 0x4027d1
mov dword [ebx + 0x1c], 0x10
mov esi, dword [ebp + 0x14]
sub dword [ebx + 0x205c], esi
add dword [ebx + 0x2060], esi
adc dword [ebx + 0x2064], ecx
cmp dword [ebx + 0x38], ecx
jne 0x4023b0
call fcn.004015b7
mov dword [ebx + 0x38], eax
test eax, eax
jne 0x4023ae
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FILE_API_COULD_NOT_CREATE_FILE
jmp 0x402528
xor ecx, ecx
lea edi, [ebx + 0x59]
mov eax, dword [ebx + 0x38]
mov dword [ebp - 0x3c], eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0x3c]
call fcn.00401637
test al, al
je 0x4024a2
test edi, edi
je 0x4024a2
and dword [ebp - 0x44], 0
push 0
lea eax, [ebp - 0x44]
push eax
push esi
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4024a2
cmp dword [ebp - 0x44], esi
jne 0x4024a2
mov edi, dword [ebx + 0x20b0]
test edi, edi
je 0x402490
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
mov esi, dword [ebx + 0x40]
mov edx, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x50]
add ecx, esi
mov eax, dword [ebx + 0x54]
adc eax, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
add esi, dword [ebx + 0x2060]
adc edx, dword [ebx + 0x2064]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], edx
and dword [ebp - 0x70], 0
and dword [ebp - 0x6c], 0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x74], eax
mov byte [ebp - 0x70], 1
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x6c], eax
mov byte [ebp - 0x2e], 0
mov dword [ebp - 4], 4
lea eax, [ebp - 0x74]
push eax
push dword [ebx + 0x20b4]
call edi
mov dword [ebp - 4], 0xfffffffe
mov al, byte [ebp - 0x2e]
jmp 0x402488
test al, al
jne 0x4027d1
mov eax, dword [ebx + 0x205c]
push 0
test eax, eax
je 0x402789
jmp 0x4024d2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FILE_API_COULD_NOT_WRITE_FILE
jmp 0x402528
mov dword [ebx + 0x1c], 0xf
mov eax, dword [edi]
test eax, eax
je 0x4024c7
add dword [ebx + 0x205c], eax
mov eax, dword [ebx + 0x205c]
test eax, eax
je 0x4024ef
push ecx
mov edx, 0x2000
cmp eax, edx
cmova eax, edx
push eax
lea eax, [ebx + 0x59]
push eax
push dword [ebx + 0x28]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
jmp 0x4027d1
mov dword [ebx + 0x1c], 0x11
mov ecx, dword [ebx + 0x38]
call fcn.00401637
test al, al
je 0x402509
push ecx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [ebx + 0x38]
call fcn.004016eb
mov edx, eax
mov dword [ebp - 0x78], edx
test edx, edx
jne 0x402534
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.FILE_API_COULD_NOT_MAP_FILE
mov ecx, ebx
call fcn.00402059
jmp 0x4027d1
mov dword [ebp - 4], 2
mov esi, dword [ebx + 0x20b0]
test esi, esi
je 0x4025ac
xor ecx, ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x84], ecx
mov dword [ebp - 0x80], ecx
mov eax, dword [edx]
mov dword [ebp - 0x8c], eax
mov eax, dword [edx + 4]
mov dword [ebp - 0x84], eax
mov eax, dword [edx + 8]
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov byte [ebp - 0x58], 2
mov eax, dword [ebx + 4]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0x54], eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x5c]
push eax
push dword [ebx + 0x20b4]
call esi
jmp 0x4025a5
mov dword [ebp - 4], 2
mov dword [ebp - 4], 0xfffffffe
call fcn.004025bd
jmp 0x4027d1
mov dword [ebx + 0x1c], 0xe
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], ecx
push ecx
push 0x13
pop edx
mov ecx, dword [ebx + 0x28]
call fcn.004018b0
mov edi, eax
mov dword [ebp - 0x38], edi
push 0
push 5
pop edx
mov ecx, dword [ebx + 0x28]
call fcn.004018b0
pop ecx
pop ecx
mov esi, eax
mov dword [ebp - 0x4c], esi
lea ecx, [ebx + 0x50]
xor eax, eax
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea edx, [ebx + 0x2c]
mov dword [edx], eax
test edi, edi
je 0x40262c
push edx
push 0x80000000
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_VarI4FromDisp]
xor eax, eax
lea ecx, [ebx + 0x50]
test esi, esi
je 0x40263e
push ecx
push 0x80000000
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_VarUI8FromDisp]
xor esi, esi
inc esi
cmp dword [ebx + 0x30], esi
ja 0x40273c
push 0
push 0x2a
pop edx
mov ecx, dword [ebx + 0x28]
call fcn.004018b0
pop ecx
mov dword [ebp - 0x50], eax
test eax, eax
je 0x402675
push eax
push str.bytes
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
test eax, eax
sete cl
mov byte [ebx + 0x58], cl
cmp dword [ebx + 0x30], esi
ja 0x40273c
cmp dword [ebx + 0x20b0], 0
je 0x40273c
and dword [ebp - 0x48], 0
lea eax, [ebp - 0x48]
push eax
push 0x16
pop edx
mov ecx, dword [ebx + 0x28]
call fcn.004018b0
pop ecx
mov edx, eax
mov dword [ebp - 0x40], edx
test edx, edx
je 0x40273c
xor ecx, ecx
mov dword [ebp - 0xa4], ecx
xor eax, eax
lea edi, [ebp - 0xa0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebx + 0x2c]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebx + 0x50]
mov dword [ebp - 0x94], eax
mov eax, dword [ebx + 0x54]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov eax, dword [ebx + 4]
mov dword [ebp - 0x68], eax
mov byte [ebp - 0x64], cl
lea eax, [ebp - 0xa4]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x2d], cl
mov dword [ebp - 4], esi
lea eax, [ebp - 0x68]
push eax
push dword [ebx + 0x20b4]
call dword [ebx + 0x20b0]
and dword [ebp - 4], 0
mov al, byte [ebp - 0x2d]
jmp 0x402738
test al, al
jne 0x40277b
cmp dword [ebp - 0x38], 0
jne 0x40276c
push 0
push str.Got_invalid_header
push 0
push str.WINTHTTP_API_QUERY_HEADERS
mov ecx, ebx
call fcn.00402059
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push section..data
call fcn.0042a8c0
add esp, 0xc
jmp 0x4027d1
mov eax, dword [ebx + 0x2c]
cdq
push 0x64
pop ecx
idiv ecx
dec eax
cmp eax, 2
ja 0x402794
mov dword [ebp - 4], 0xfffffffe
call fcn.004027a0
push 0
push dword [ebx + 0x28]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
jmp 0x4027d1
push 0
push str.Resource_unavailable
jmp 0x402749
mov dword [ebx + 0x1c], 0xb
jmp 0x4027d1
mov dword [ebx + 0x1c], 0xa
call fcn.00469da8
ret 0x10