Function at 0x427740
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Encode data using xor
Get disk size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d73a8
mov eax, dword fs:[0]
push eax
sub esp, 0x9b4
mov eax, dword [0x540c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x9a4], esi
mov ebx, ecx
mov dword [ebp - 0x958], ebx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, edi
mov dword [ebp - 0x9c0], ebx
mov dword [ebp - 0x918], eax
mov dword [ebp - 0x96c], edi
mov dword [ebp - 0x93c], 0
call fcn.004259a0
test al, al
je 0x427853
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x958], eax
mov dword [ebp - 4], 1
mov eax, str.this_module_doesnt_support_file_request
test eax, 0xffff0000
jne 0x4277f5
movzx esi, ax
mov ecx, esi
call fcn.00401b90
test eax, eax
je 0x427805
push esi
push eax
lea ecx, [ebp - 0x958]
call fcn.00402a00
jmp 0x427805
push str.this_module_doesnt_support_file_request
lea ecx, [ebp - 0x958]
call fcn.00403700
mov dword [ebp - 4], 2
lea edx, [ebp - 0x958]
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x958]
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42896b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x42896b
test esi, esi
jne 0x4278ad
push str.InternetOpen_Failed
lea ecx, [ebp - 0x918]
call fcn.00403560
mov dword [ebp - 4], 4
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x918]
add edx, 0xfffffff0
or ecx, 0xffffffff
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42896b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42896b
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x928], eax
mov dword [ebp - 4], 7
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x938], eax
mov byte [ebp - 4], 9
push 0x5228fc
mov ecx, edi
mov dword [ebp - 0x914], 0
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x910], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0xa
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x92c]
call fcn.0041ce20
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x938]
push eax
lea edx, [ebp - 0x928]
lea ecx, [ebp - 0x92c]
call fcn.004255b0
movzx eax, al
add esp, 0x20
test eax, eax
jne 0x427a10
push str.InternetCrackUrl_Failed
lea ecx, [ebp - 0x918]
call fcn.00403560
mov byte [ebp - 4], 0xc
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x918]
add edx, 0xfffffff0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x42799d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x92c]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4279c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x938]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4279e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x928]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x42896b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42896b
push 0x522910
mov ecx, edi
mov byte [ebp - 0x931], 0
call fcn.00430670
test al, al
je 0x427a52
push 0x522900
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 5
jne 0x427a52
push str.redirectCheck
mov ecx, edi
call fcn.00430500
mov ecx, eax
call fcn.0042ff10
mov byte [ebp - 0x931], al
push ecx
mov ecx, dword [ebp - 0x92c]
mov esi, esp
lea ecx, [ecx - 0x10]
mov byte [ebp - 0x909], 0
mov dword [ebp - 0x920], 0x50
mov dword [ebp - 0x910], esp
mov dword [ebp - 0x974], esi
call fcn.004028c0
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 0x12
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x920]
lea ecx, [ebp - 0x909]
call fcn.004256f0
add esp, 4
mov ecx, edi
push 0x522920
call fcn.00430500
cmp byte [eax + 8], 1
jne 0x427aca
push str.port
mov ecx, edi
call fcn.00430500
mov ecx, eax
call fcn.0042fb30
mov esi, eax
jmp 0x427ad9
mov esi, dword [ebp - 0x914]
test esi, esi
cmove esi, dword [ebp - 0x920]
mov ecx, dword [ebp - 0x918]
push esi
lea edx, [ebp - 0x928]
mov byte [ebp - 0x90a], 0
call fcn.004257e0
add esp, 4
mov dword [ebp - 0x91c], eax
test eax, eax
jne 0x427b97
mov eax, dword [0x547018]
test eax, eax
jne 0x427b37
push 0x522938
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x427b2e
push str.InternetConnectW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x547018], eax
jmp 0x427b33
mov eax, dword [0x547018]
test eax, eax
je 0x427b5a
push 0
push 0
push 3
push 0
push 0
push esi
push dword [ebp - 0x928]
push dword [ebp - 0x9a4]
call eax
mov dword [ebp - 0x91c], eax
test eax, eax
jne 0x427b90
push str.InternetConnect_Failed
lea ecx, [ebp - 0x918]
call fcn.00403560
mov byte [ebp - 4], 0x13
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x918]
jmp 0x428939
mov byte [ebp - 0x90a], 1
cmp byte [ebp - 0x931], 0
mov esi, 0x80400200
mov eax, 0x80600200
cmovne esi, eax
or esi, 0xc000
cmp byte [ebp - 0x909], 0
je 0x427bc0
or esi, 0x803080
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x944], eax
mov byte [ebp - 4], 0x18
push 0x52298c
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x427c3f
push 0x522984
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x910], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x918]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x944]
call fcn.004026b0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x918]
call fcn.00402650
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x940], eax
mov byte [ebp - 4], 0x1c
push str.version
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x427cbe
push 0x522994
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x910], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x918]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x1e
push eax
lea ecx, [ebp - 0x940]
call fcn.004026b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x918]
call fcn.00402650
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x950], eax
mov byte [ebp - 4], 0x20
push str.referer
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x427d3d
push 0x5229a4
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x910], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x21
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x918]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x22
push eax
lea ecx, [ebp - 0x950]
call fcn.004026b0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x918]
call fcn.00402650
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x948], eax
mov byte [ebp - 4], 0x24
push 0x5229c0
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x427dbc
push 0x5229b4
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x910], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x25
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x918]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x26
push eax
lea ecx, [ebp - 0x948]
call fcn.004026b0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x918]
call fcn.00402650
mov eax, dword [ebp - 0x948]
mov edx, dword [ebp - 0x950]
xor ecx, ecx
cmp dword [eax - 0xc], ecx
mov dword [ebp - 0x9b8], ecx
cmove eax, ecx
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x9bc], eax
xor eax, eax
cmp dword [edx - 0xc], eax
push 1
push esi
cmove edx, eax
cmp dword [ecx - 0xc], eax
lea esi, [ebp - 0x9bc]
push esi
cmove ecx, eax
mov eax, dword [ebp - 0x944]
push edx
cmp dword [eax - 0xc], 0
push ecx
push dword [ebp - 0x938]
mov dword [ebp - 0x918], 0
cmove eax, dword [ebp - 0x918]
push eax
push dword [ebp - 0x91c]
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov esi, eax
mov dword [ebp - 0x920], esi
test esi, esi
jne 0x427e6c
push str.HttpOpenRequest_Failed
lea ecx, [ebp - 0x918]
call fcn.00403560
mov byte [ebp - 4], 0x27
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x918]
jmp 0x4288fd
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x930], eax
mov byte [ebp - 4], 0x29
push 0x5229cc
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x427f8b
push 0x5229fc
lea ecx, [ebp - 0x914]
call fcn.004025a0
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x914]
push eax
push str.contentType
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x2b
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x910]
call fcn.0041ce20
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 0x2c
push str.Content_Type:
lea ecx, [ebp - 0x974]
call fcn.00403560
mov byte [ebp - 4], 0x2d
push esi
mov edx, eax
lea ecx, [ebp - 0x9a4]
call fcn.0041d1b0
add esp, 4
mov byte [ebp - 4], 0x2e
mov edx, eax
lea ecx, [ebp - 0x918]
call fcn.0041d1b0
add esp, 4
mov byte [ebp - 4], 0x2f
push eax
lea ecx, [ebp - 0x930]
call fcn.004026b0
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x918]
call fcn.00402650
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x9a4]
call fcn.00402650
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x974]
call fcn.00402650
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x910]
call fcn.00402650
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x914]
call fcn.00402650
mov esi, dword [ebp - 0x920]
push 0x522a04
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x428029
push 0x522a3c
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x30
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x910]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x31
mov eax, dword [eax]
lea ecx, [ebp - 0x930]
push dword [eax - 0xc]
push eax
call fcn.0040fe40
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x910]
call fcn.00402650
lea eax, [ebp - 0x930]
push eax
lea ecx, [ebp - 0x914]
call fcn.00403500
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x914]
call fcn.004299c0
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x914]
call fcn.00402650
mov eax, dword [0x5406d8]
mov ecx, 0x5406d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x954], eax
mov byte [ebp - 4], 0x34
push 0x522a30
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x4280a8
push str.postData
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x35
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x910]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x36
push eax
lea ecx, [ebp - 0x954]
call fcn.004026b0
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x910]
call fcn.00402650
mov ecx, dword [ebp - 0x954]
lea ecx, [ecx - 0x10]
call fcn.004028c0
add eax, 0x10
mov dword [ebp - 0x94c], eax
mov byte [ebp - 4], 0x38
mov eax, dword [ebp - 0x954]
mov eax, dword [eax - 0xc]
add eax, eax
cmp byte [ebp - 0x931], 0
mov dword [ebp - 0x910], eax
je 0x42810e
push 4
lea eax, [ebp - 0x914]
push eax
push 6
push esi
mov esi, dword [sym.imp.WININET.dll_InternetSetOptionW]
mov dword [ebp - 0x914], 0x2710
call esi
push 4
lea eax, [ebp - 0x914]
push eax
push 5
push dword [ebp - 0x920]
call esi
mov eax, dword [ebp - 0x930]
xor edx, edx
cmp dword [eax - 0xc], edx
mov ecx, eax
cmove ecx, edx
mov dword [ebp - 0x974], ecx
mov ecx, dword [ebp - 0x94c]
mov esi, 1
sub esi, dword [ecx - 4]
mov edx, dword [ecx - 8]
or edx, esi
jge 0x428152
push 0
lea ecx, [ebp - 0x94c]
call fcn.00402850
mov eax, dword [ebp - 0x930]
mov ecx, dword [ebp - 0x94c]
push dword [ebp - 0x910]
push ecx
push dword [eax - 0xc]
push dword [ebp - 0x974]
call fcn.00423a30
mov esi, dword [ebp - 0x920]
mov edx, esi
mov ecx, eax
call fcn.004367f0
test eax, eax
jne 0x42824d
lea ecx, [ebp - 0x958]
call fcn.00421cc0
mov byte [ebp - 4], 0x39
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov eax, dword [0x545d90]
imul eax, eax
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 8
jne 0x4281cd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x545d90]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x545d90], ecx
cmp byte [ebp - 0x90a], 0
je 0x4281de
push dword [ebp - 0x91c]
call esi
push str.HttpSendRequest_Failed_with:
lea ecx, [ebp - 0x974]
call fcn.00403560
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x958]
push ecx
mov edx, eax
lea ecx, [ebp - 0x910]
call fcn.0041d1b0
add esp, 4
mov byte [ebp - 4], 0x3b
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x910]
call fcn.00402650
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x974]
call fcn.00402650
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x958]
jmp 0x4288d0
mov ecx, edi
call fcn.004258e0
test al, al
jne 0x428365
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x428276
push dword [ebp - 0x91c]
call esi
mov eax, dword [ebp - 0x960]
and eax, 0xffffff00
mov dword [ebp - 0x960], eax
and eax, 0xfffffeff
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], 0
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x980]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], 0
mov byte [ebp - 0x988], 1
mov byte [ebp - 4], 0x42
lea eax, [ebp - 0x988]
push eax
push ecx
push 0x522a8c
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x988]
call fcn.0042f800
push str.no_response_needed
lea ecx, [ebp - 0x9a0]
call fcn.0042f530
mov byte [ebp - 4], 0x43
lea eax, [ebp - 0x9a0]
push eax
push ecx
push 0x522a84
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
lea eax, [ebp - 0x968]
push eax
mov ecx, ebx
call fcn.0042f6a0
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x968]
call fcn.0042f800
jmp 0x4288d5
push 0x400
lea eax, [ebp - 0x417]
push 0
push eax
mov byte [ebp - 0x418], 0
call fcn.004b4a90
add esp, 0xc
mov dword [ebp - 0x9b4], 0x400
push 0x522a94
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
jne 0x428414
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov ecx, dword [0x545d90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x11
idiv ecx
cmp edx, 0xa
jne 0x4283cd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
cmp byte [ebp - 0x90a], 0
je 0x4283de
push dword [ebp - 0x91c]
call esi
push 0x522ad0
lea ecx, [ebp - 0x910]
call fcn.00403560
mov byte [ebp - 4], 0x44
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x910]
jmp 0x4288d0
push 0x522ac0
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x428474
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x42843e
push dword [ebp - 0x91c]
call esi
push str.HttpQueryInfo_Failed
lea ecx, [ebp - 0x910]
call fcn.00403560
mov byte [ebp - 4], 0x45
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x910]
jmp 0x4288d0
push 0
lea ecx, [ebp - 0x9b4]
push ecx
lea ecx, [ebp - 0x418]
push ecx
push 0x13
push esi
call eax
test eax, eax
jne 0x42856c
mov edi, dword [0x545d90]
mov ecx, 0x16
lea eax, [edi + 1]
imul eax, edi
cdq
idiv ecx
cmp edx, 3
jne 0x4284e5
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub edi, ecx
xor ecx, ecx
lea eax, [edi + 0x63]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aed89
add esp, 4
push eax
call fcn.004afe1b
add esp, 4
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov eax, dword [0x545d90]
imul eax, eax
cdq
mov ecx, 0x18
idiv ecx
cmp edx, 8
jne 0x428525
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x545d90]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x545d90], ecx
cmp byte [ebp - 0x90a], 0
je 0x428536
push dword [ebp - 0x91c]
call esi
push 0x522ae8
lea ecx, [ebp - 0x910]
call fcn.00403560
mov byte [ebp - 4], 0x46
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x910]
jmp 0x4288d0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x924]
call fcn.004247e0
mov byte [ebp - 4], 0x47
push 0x522b1c
mov ecx, edi
call fcn.00430500
mov edi, eax
mov al, byte [edi + 8]
test al, al
je 0x428740
cmp al, 6
je 0x428740
cmp al, 7
jne 0x428723
xor esi, esi
mov ecx, edi
mov dword [ebp - 0x918], esi
call fcn.0042ff80
test eax, eax
jle 0x428846
lea ecx, [ebp - 0x914]
call fcn.00402540
mov byte [ebp - 4], 0x4d
push esi
lea eax, [ebp - 0x914]
push 0x522b18
push eax
call fcn.00429bc0
add esp, 0xc
mov ecx, edi
push dword [ebp - 0x914]
call fcn.00430500
cmp byte [eax + 8], 4
push dword [ebp - 0x914]
mov ecx, edi
jne 0x428659
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x4e
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x910]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x4f
mov edx, eax
lea ecx, [ebp - 0x924]
call fcn.00418820
mov byte [ebp - 0x909], al
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x910]
call fcn.00402650
jmp 0x4286d9
call fcn.00430500
cmp byte [eax + 8], 1
jne 0x4286e2
lea ecx, [ebp - 0x974]
call fcn.00402540
mov esi, eax
mov byte [ebp - 4], 0x50
push dword [ebp - 0x914]
mov ecx, edi
call fcn.00430500
mov ecx, eax
call fcn.0042fb30
push eax
mov edx, esi
lea ecx, [ebp - 0x9a4]
call fcn.0041d120
add esp, 4
mov byte [ebp - 4], 0x52
lea ecx, [ebp - 0x974]
call fcn.00402650
lea edx, [ebp - 0x9a4]
lea ecx, [ebp - 0x924]
call fcn.00418820
mov byte [ebp - 0x909], al
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x9a4]
call fcn.00402650
mov esi, dword [ebp - 0x918]
cmp byte [ebp - 0x909], 0
jne 0x42870c
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x914]
call fcn.00402650
inc esi
mov ecx, edi
mov dword [ebp - 0x918], esi
call fcn.0042ff80
cmp esi, eax
jl 0x4285c2
jmp 0x428846
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x914]
call fcn.00402650
mov al, byte [ebp - 0x909]
jmp 0x428733
mov edx, 0x522b48
lea ecx, [ebp - 0x924]
call fcn.00418870
test al, al
jne 0x42898f
jmp 0x428846
mov ecx, edi
xor ebx, ebx
call fcn.0042ff80
test eax, eax
jle 0x428840
push ebx
mov ecx, edi
call fcn.00430230
cmp byte [eax + 8], 4
push ebx
mov ecx, edi
jne 0x4287b2
call fcn.00430230
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x48
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x910]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x49
mov edx, eax
lea ecx, [ebp - 0x924]
call fcn.00418820
mov byte [ebp - 0x909], al
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x910]
jmp 0x42881e
call fcn.00430230
cmp byte [eax + 8], 1
jne 0x428830
lea ecx, [ebp - 0x974]
call fcn.00402540
mov esi, eax
mov byte [ebp - 4], 0x4a
push ebx
mov ecx, edi
call fcn.00430230
mov ecx, eax
call fcn.0042fb30
push eax
mov edx, esi
lea ecx, [ebp - 0x918]
call fcn.0041d120
add esp, 4
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x974]
call fcn.00402650
lea edx, [ebp - 0x918]
lea ecx, [ebp - 0x924]
call fcn.00418820
mov byte [ebp - 0x909], al
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x918]
call fcn.00402650
cmp byte [ebp - 0x909], 0
jne 0x428989
mov ecx, edi
inc ebx
call fcn.0042ff80
cmp ebx, eax
jl 0x428751
mov ebx, dword [ebp - 0x958]
push dword [ebp - 0x920]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x428865
push dword [ebp - 0x91c]
call esi
push 3
push dword [ebp - 0x924]
lea eax, [ebp - 0x904]
lea ecx, [ebp - 0x908]
mov dword [ebp - 0x908], eax
call fcn.00418ca0
mov byte [ebp - 4], 0x53
push dword [ebp - 0x908]
call fcn.004b085d
add esp, 4
mov edx, eax
mov ecx, ebx
call fcn.00425300
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x908]
lea ecx, [ebp - 0x904]
cmp eax, ecx
je 0x4288c6
push eax
call fcn.004b0093
add esp, 4
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x924]
call fcn.00402650
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x94c]
call fcn.00402650
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x954]
call fcn.00402650
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x930]
call fcn.00402650
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x948]
call fcn.00402650
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x950]
call fcn.00402650
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x940]
call fcn.00402650
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x944]
call fcn.00402650
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x92c]
call fcn.00402650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x938]
call fcn.00402650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x928]
call fcn.00402650
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004af5ba
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0x958]
mov esi, dword [ebp - 0x920]
push ecx
lea eax, [ebp - 0x9ac]
push eax
push ecx
mov ecx, esi
mov dword [ebp - 0x9ac], 0
call fcn.004276b0
add esp, 0xc
lea ecx, [ebp - 0x970]
call fcn.00402540
mov byte [ebp - 4], 0x54
mov eax, dword [ebp - 0x9ac]
test eax, eax
je 0x428a3c
push eax
call fcn.004aed89
mov edi, eax
add esp, 4
test edi, edi
je 0x428a3c
push 0x522b30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x428a08
push 0x522b58
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428a08
push 0
lea ecx, [ebp - 0x9ac]
push ecx
push edi
push 0x16
push esi
call eax
push edi
lea ecx, [ebp - 0x910]
call fcn.004247e0
mov byte [ebp - 4], 0x55
push eax
lea ecx, [ebp - 0x970]
call fcn.004026b0
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x910]
call fcn.00402650
push edi
call fcn.004afe1b
add esp, 4
cmp byte [ebp - 0x931], 0
je 0x428e32
mov eax, dword [ebp - 0x960]
and eax, 0xffffff00
mov dword [ebp - 0x960], eax
and eax, 0xfffffeff
mov dword [ebp - 0x960], eax
mov dword [ebp - 0x95c], 0
mov byte [ebp - 4], 0x5b
mov edx, 0x522b50
lea ecx, [ebp - 0x924]
call fcn.004188c0
test al, al
je 0x428afe
mov edx, 0x522b70
lea ecx, [ebp - 0x924]
call fcn.004188c0
test al, al
je 0x428afe
mov edx, 0x522b68
lea ecx, [ebp - 0x924]
call fcn.004188c0
test al, al
je 0x428afe
mov edx, 0x522b8c
lea ecx, [ebp - 0x924]
call fcn.004188c0
test al, al
je 0x428afe
lea eax, [ebp - 0x968]
push eax
mov ecx, ebx
call fcn.0042f6a0
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x968]
call fcn.0042f800
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x970]
call fcn.00402650
jmp 0x4288c6
lea ecx, [ebp - 0x91c]
call fcn.00402540
mov byte [ebp - 4], 0x5c
lea eax, [ebp - 0x970]
push eax
lea ecx, [ebp - 0x920]
call fcn.00403500
mov byte [ebp - 4], 0x5d
mov ecx, dword [0x545d90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 3
jne 0x428b58
mov esi, 1
mov eax, esi
mov edx, 0x30
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x428b48
mov dword [0x545d90], ecx
lea ecx, [ebp - 0x920]
call fcn.004214b0
mov eax, dword [ebp - 0x920]
cmp dword [eax - 0xc], 0
jl 0x428df7
push str.location:
push eax
call fcn.004b0345
mov esi, eax
add esp, 8
test esi, esi
je 0x428df7
sub esi, dword [ebp - 0x920]
sar esi, 1
cmp esi, 0xffffffff
je 0x428df7
push esi
push 0x522b94
lea ecx, [ebp - 0x920]
call fcn.0040f000
sub eax, esi
push eax
push esi
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x920]
call fcn.0040f040
mov byte [ebp - 4], 0x5e
push eax
lea ecx, [ebp - 0x91c]
call fcn.004026b0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x910]
call fcn.00402650
mov eax, dword [ebp - 0x91c]
cmp dword [eax - 0xc], 0
jl 0x428df7
push str.http
push eax
call fcn.004b0345
mov edx, eax
add esp, 8
test edx, edx
je 0x428df7
mov ecx, dword [ebp - 0x91c]
sub edx, ecx
sar edx, 1
cmp edx, 0xffffffff
je 0x428df7
mov eax, dword [ecx - 0xc]
sub eax, edx
push eax
lea eax, [ebp - 0x910]
push eax
lea ecx, [ebp - 0x91c]
call fcn.004184d0
mov byte [ebp - 4], 0x5f
push eax
lea ecx, [ebp - 0x91c]
call fcn.004026b0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x910]
call fcn.00402650
mov eax, dword [ebp - 0x980]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], 0
mov byte [ebp - 0x988], 1
mov byte [ebp - 4], 0x60
lea eax, [ebp - 0x988]
push eax
push ecx
push str.urlRedirected
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x988]
call fcn.0042f800
lea edx, [ebp - 0x92c]
lea ecx, [ebp - 0x838]
call fcn.0041cf00
mov byte [ebp - 4], 0x61
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x62
lea eax, [ebp - 0x9a0]
push eax
push ecx
push str.requestUrl
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x838]
call fcn.004014d0
lea edx, [ebp - 0x91c]
lea ecx, [ebp - 0x850]
call fcn.0041cf00
mov byte [ebp - 4], 0x63
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x64
lea eax, [ebp - 0x9a0]
push eax
push ecx
push str.redirectUrl
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x63
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x850]
call fcn.004014d0
mov eax, dword [ebp - 0x924]
mov edx, 1
sub edx, dword [eax - 4]
mov ecx, dword [eax - 8]
or ecx, edx
jge 0x428d97
push 0
lea ecx, [ebp - 0x924]
call fcn.00402850
mov eax, dword [ebp - 0x924]
push eax
call fcn.004b07b8
mov ecx, dword [ebp - 0x980]
and ecx, 0xffffff01
or ecx, 1
add esp, 4
mov dword [ebp - 0x980], ecx
mov dword [ebp - 0x97c], 0
mov dword [ebp - 0x988], eax
mov byte [ebp - 4], 0x65
lea eax, [ebp - 0x988]
push eax
push ecx
push str.statusCode
lea ecx, [ebp - 0x968]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x988]
call fcn.0042f800
lea eax, [ebp - 0x968]
push eax
mov ecx, ebx
call fcn.0042f6a0
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x5c
lea ecx, [ebp - 0x920]
call fcn.00402650
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x91c]
call fcn.00402650
jmp 0x428adb
xor eax, eax
mov dword [ebp - 0x964], eax
xor edi, edi
mov dword [ebp - 0x960], edi
mov dword [ebp - 0x95c], eax
mov byte [ebp - 4], 0x66
mov esi, dword [0x545d90]
mov dword [ebp - 0x9a8], edi
sub edi, eax
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0xd
jne 0x428ef6
xor edx, edx
mov ecx, edx
and ecx, 1
dec ecx
not ecx
and ecx, esi
mov eax, edx
sar eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
sar eax, 1
not ecx
and ecx, esi
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor eax, ecx
inc edx
add esi, eax
cmp edx, 0x100
jl 0x428e73
mov dword [0x545d90], esi
lea eax, [edi + 0x400]
push eax
lea ecx, [ebp - 0x964]
call fcn.00424880
mov ecx, dword [0x545d90]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0xe
jne 0x428f70
mov al, byte [0x522be4]
movq xmm0, qword [str.4fOd4nwO]
mov byte [ebp - 0x97c], al
lea eax, [ebp - 0x984]
movq qword [ebp - 0x984], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428f45
sub eax, edx
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004aed89
add esp, 4
push eax
call fcn.004afe1b
add esp, 4
mov eax, dword [ebp - 0x964]
lea ecx, [ebp - 0x9a8]
push ecx
add eax, edi
push ecx
push eax
mov dword [ebp - 0x9a8], 0
call fcn.00423a30
mov esi, dword [ebp - 0x920]
mov edx, esi
mov ecx, eax
call fcn.004363c0
test eax, eax
je 0x429962
mov eax, dword [ebp - 0x9a8]
add eax, edi
push eax
lea ecx, [ebp - 0x964]
call fcn.00424880
mov esi, dword [0x545d90]
mov eax, esi
imul eax, esi
cdq
mov ecx, 9
idiv ecx
cmp edx, 5
jne 0x428fef
mov eax, esi
sub eax, 0
je 0x428fe4
dec eax
je 0x428fe0
inc esi
jmp 0x428fe9
xor esi, esi
jmp 0x428fe9
mov esi, 2
mov dword [0x545d90], esi
cmp dword [ebp - 0x9a8], 0
je 0x429009
mov edi, dword [ebp - 0x960]
mov eax, dword [ebp - 0x964]
jmp 0x428e58
push 0x400
lea eax, [ebp - 0x81f]
push 0
push eax
mov byte [ebp - 0x820], 0
call fcn.004b4a90
add esp, 0xc
mov dword [ebp - 0x9b0], 0x400
push str.Wininet.dll
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x42904f
push str.HttpQueryInfoA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov esi, dword [ebp - 0x920]
push 0
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x820]
push eax
push 0x1d
push esi
call edi
test eax, eax
je 0x429218
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x914]
call fcn.004247e0
mov byte [ebp - 4], 0x68
mov edx, str.gzip
lea ecx, [ebp - 0x914]
call fcn.00418870
test al, al
je 0x429209
mov edx, dword [0x545d90]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0xd
jne 0x4290e3
mov ebx, dword [0x545d90]
xor esi, esi
mov edi, ebx
lea esp, [esp]
inc esi
dec edi
cmp esi, 0x12
jb 0x4290d0
mov ebx, dword [ebp - 0x958]
mov esi, dword [ebp - 0x920]
mov dword [ebp - 0x984], 0
mov dword [ebp - 0x980], 0
mov dword [ebp - 0x97c], 0
mov byte [ebp - 4], 0x69
mov ecx, dword [ebp - 0x964]
mov edx, dword [ebp - 0x960]
lea eax, [ebp - 0x984]
sub edx, ecx
push eax
call fcn.00424b80
add esp, 4
test eax, eax
jne 0x4291bb
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x429144
push dword [ebp - 0x91c]
call esi
push str.gzip_decompressing_error
lea ecx, [ebp - 0x910]
call fcn.00403560
mov byte [ebp - 4], 0x6a
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x69
lea ecx, [ebp - 0x910]
call fcn.00402650
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x984]
call fcn.00424850
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x914]
call fcn.00402650
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x964]
call fcn.00424850
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x970]
call fcn.00402650
jmp 0x4288c6
lea eax, [ebp - 0x984]
push eax
lea ecx, [ebp - 0x964]
call fcn.00429a40
mov eax, dword [0x545d90]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 0x8000000f
jns 0x4291e5
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 0xb
jne 0x4291fa
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov byte [ebp - 4], 0x68
lea ecx, [ebp - 0x984]
call fcn.00424850
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x914]
call fcn.00402650
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x429232
push dword [ebp - 0x91c]
call esi
mov edi, dword [ebp - 0x96c]
xor bl, bl
push 0x522c40
mov ecx, edi
mov byte [ebp - 0x909], 0
mov dword [ebp - 0x918], ebx
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x4292e4
push str.responseType
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x6b
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x914]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x6c
mov edx, str.base64
lea ecx, [ebp - 0x914]
call fcn.00418870
test al, al
je 0x4292b2
mov byte [ebp - 0x909], 1
jmp 0x4292d5
mov edx, str.binary
lea ecx, [ebp - 0x914]
call fcn.00418870
movzx ebx, bl
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x918], ebx
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x914]
call fcn.00402650
lea ecx, [ebp - 0x98c]
call fcn.00402540
mov byte [ebp - 4], 0x6d
cmp byte [ebp - 0x909], 0
mov esi, dword [ebp - 0x964]
je 0x42948a
mov eax, dword [ebp - 0x960]
sub eax, esi
push eax
mov edx, esi
lea ecx, [ebp - 0x96c]
call fcn.0041ccb0
add esp, 4
mov byte [ebp - 4], 0x6e
push eax
lea ecx, [ebp - 0x98c]
call fcn.004026b0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x96c]
call fcn.00402650
lea ecx, [ebp - 0x910]
call fcn.00423090
mov byte [ebp - 4], 0x6f
mov edx, eax
lea ecx, [ebp - 0x98c]
call fcn.00418820
mov bl, al
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x910]
call fcn.00402650
test bl, bl
je 0x42952a
push str.Base64_encdng_error
lea ecx, [ebp - 0x96c]
call fcn.00403560
mov byte [ebp - 4], 0x70
mov ecx, dword [ebp - 0x958]
mov edx, eax
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x96c]
call fcn.00402650
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x98c]
call fcn.00402650
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x964]
call fcn.00424850
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x970]
call fcn.00402650
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x924]
call fcn.00402650
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x94c]
call fcn.00402650
mov byte [ebp - 4], 0x29
lea ecx, [ebp - 0x954]
call fcn.00402650
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x930]
call fcn.00402650
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x948]
call fcn.00402650
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x950]
call fcn.00402650
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x940]
call fcn.00402650
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x944]
call fcn.00402650
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x92c]
call fcn.00402650
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x938]
call fcn.00402650
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x928]
call fcn.00402650
mov eax, dword [ebp - 0x958]
jmp 0x42896d
test bl, bl
jne 0x429530
mov eax, dword [ebp - 0x960]
sub eax, esi
mov dword [ebp - 0x96c], eax
cmp byte [eax + esi - 1], bl
je 0x4294c2
inc eax
push eax
lea ecx, [ebp - 0x964]
call fcn.00424880
mov esi, dword [ebp - 0x964]
mov eax, dword [ebp - 0x96c]
mov byte [eax + esi], bl
mov eax, dword [ebp - 0x960]
sub eax, esi
cmp eax, 3
jbe 0x4294fd
cmp byte [esi], 0xef
jne 0x4294fd
cmp byte [esi + 1], 0xbb
jne 0x4294fd
cmp byte [esi + 2], 0xbf
jne 0x4294fd
lea eax, [esi + 3]
push eax
push esi
lea eax, [ebp - 0x990]
push eax
lea ecx, [ebp - 0x964]
call fcn.00424960
mov esi, dword [ebp - 0x964]
push esi
lea ecx, [ebp - 0x96c]
call fcn.00403560
mov byte [ebp - 4], 0x71
push eax
lea ecx, [ebp - 0x98c]
call fcn.004026b0
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x96c]
call fcn.00402650
jmp 0x429530
mov ebx, dword [ebp - 0x918]
push 0x522cbc
mov ecx, edi
mov byte [ebp - 0x914], 0
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x429642
push 0x522cb0
mov ecx, edi
call fcn.00430500
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x990], esp
push dword [eax]
call fcn.00401470
mov byte [ebp - 4], 0x72
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x91c]
call fcn.0041ce20
add esp, 0x18
mov byte [ebp - 4], 0x73
mov eax, dword [ebp - 0x91c]
cmp dword [eax - 0xc], 0
je 0x429633
test bl, bl
je 0x4295ef
push 0x522cd0
push eax
lea eax, [ebp - 0x920]
push eax
mov dword [ebp - 0x920], 0
call fcn.004b22b5
add esp, 0xc
test eax, eax
jne 0x429633
mov eax, dword [ebp - 0x920]
test eax, eax
je 0x429633
push eax
mov eax, dword [ebp - 0x960]
sub eax, esi
push eax
push 1
push esi
call fcn.004b2673
push dword [ebp - 0x920]
call fcn.004b1650
add esp, 0x14
mov byte [ebp - 0x914], 1
jmp 0x429633
push ecx
lea eax, [ebp - 0x98c]
mov ecx, esp
mov dword [ebp - 0x990], esp
push eax
call fcn.00403500
mov byte [ebp - 4], 0x74
mov byte [ebp - 4], 0x73
lea ecx, [ebp - 0x91c]
call fcn.00423f90
mov ebx, dword [ebp - 0x914]
add esp, 4
movzx ebx, bl
test al, al
mov eax, 1
cmovne ebx, eax
mov dword [ebp - 0x914], ebx
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x91c]
call fcn.00402650
mov eax, dword [ebp - 0x980]
and eax, 0xffffff00
mov dword [ebp - 0x980], eax
and eax, 0xfffffeff
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x97c], 0
mov byte [ebp - 4], 0x7a
mov eax, dword [ebp - 0x998]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x994], 0
mov byte [ebp - 0x9a0], 1
mov byte [ebp - 4], 0x7b
lea eax, [ebp - 0x9a0]
push eax
push ecx
push str.result
lea ecx, [ebp - 0x988]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
lea edx, [ebp - 0x98c]
mov ecx, edx
call fcn.00422640
lea edx, [ebp - 0x98c]
lea ecx, [ebp - 0x850]
call fcn.0041cf00
mov byte [ebp - 4], 0x7c
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x7d
lea eax, [ebp - 0x9a0]
push eax
push ecx
push str.content
lea ecx, [ebp - 0x988]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x7c
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x850]
call fcn.004014d0
lea edx, [ebp - 0x970]
lea ecx, [ebp - 0x838]
call fcn.0041cf00
mov byte [ebp - 4], 0x7e
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x7f
push ecx
push 0x522cd8
lea ecx, [ebp - 0x988]
call fcn.004302d0
lea ecx, [ebp - 0x9a0]
push ecx
push ecx
push str.headers
mov ecx, eax
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x7e
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x838]
call fcn.004014d0
lea edx, [ebp - 0x924]
lea ecx, [ebp - 0x880]
call fcn.0041cf00
mov byte [ebp - 4], 0x80
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x81
push ecx
push str.additionalInfo
lea ecx, [ebp - 0x988]
call fcn.004302d0
lea ecx, [ebp - 0x9a0]
push ecx
push ecx
push str.httpCode
mov ecx, eax
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x80
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x880]
call fcn.004014d0
push str.empty
lea ecx, [ebp - 0x868]
call fcn.00401470
mov byte [ebp - 4], 0x82
push eax
lea ecx, [ebp - 0x9a0]
call fcn.0042f5e0
mov byte [ebp - 4], 0x83
lea eax, [ebp - 0x9a0]
push eax
push ecx
push str.noData
lea ecx, [ebp - 0x988]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x82
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x868]
call fcn.004014d0
push str.outputFile
mov ecx, edi
call fcn.00430500
cmp byte [eax + 8], 4
jne 0x429932
mov eax, dword [ebp - 0x998]
and eax, 0xffffff05
or eax, 5
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x994], 0
mov byte [ebp - 0x9a0], al
mov byte [ebp - 4], 0x84
push str.outputFi
lea ecx, [ebp - 0x880]
call fcn.00401470
mov byte [ebp - 4], 0x85
push str.leResult
mov edx, eax
lea ecx, [ebp - 0x868]
call fcn.00429be0
add esp, 4
mov byte [ebp - 4], 0x86
cmp dword [eax + 0x14], 0x10
jb 0x4298ea
mov eax, dword [eax]
lea ecx, [ebp - 0x9a0]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x988]
call fcn.004302d0
mov ecx, eax
call fcn.0042f8d0
mov byte [ebp - 4], 0x85
lea ecx, [ebp - 0x868]
call fcn.004014d0
mov byte [ebp - 4], 0x84
lea ecx, [ebp - 0x880]
call fcn.004014d0
mov byte [ebp - 4], 0x7a
lea ecx, [ebp - 0x9a0]
call fcn.0042f800
mov ecx, dword [ebp - 0x958]
lea eax, [ebp - 0x988]
push eax
call fcn.0042f6a0
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x6d
lea ecx, [ebp - 0x988]
call fcn.0042f800
jmp 0x4293ad
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
cmp byte [ebp - 0x90a], 0
je 0x42997c
push dword [ebp - 0x91c]
call esi
push str.InternetReadFile_Failed
lea ecx, [ebp - 0x96c]
call fcn.00403560
mov byte [ebp - 4], 0x67
mov edx, eax
mov ecx, ebx
call fcn.00425150
mov dword [ebp - 0x93c], 1
mov byte [ebp - 4], 0x66
lea ecx, [ebp - 0x96c]
jmp 0x429193