Function at 0x409e8b
Capabilities:
Check os version
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Set http header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.00546b80
mov eax, dword [0x5c2fd0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
mov eax, dword [ebx + 0xa2c]
mov dword [ebp - 0x13f0], ebx
mov dword [ebp - 0x13ec], ecx
mov dword [ebp - 0x13fc], ecx
test eax, eax
je 0x409eec
push 0x640000
push ecx
push 0x401
push eax
call esi
xor eax, eax
push eax
push eax
push 0x402
push dword [ebx + 0xa2c]
call esi
xor ecx, ecx
lea eax, [ebp - 0x13e8]
mov dword [ebp - 0x1404], ecx
push eax
mov esi, ecx
mov dword [ebp - 0x13e8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
inc edi
test eax, eax
je 0x409f22
cmp dword [ebp - 0x13e4], 6
cmovb esi, edi
mov dword [ebp - 0x1404], esi
mov eax, dword [ebx + 0xa48]
xor edx, edx
mov dword [ebp - 0x1400], 2
mov ecx, edx
mov dword [ebp - 0x1408], ecx
test eax, eax
je 0x40a09c
mov eax, dword [eax + 0xc]
test eax, eax
je 0x40a09c
mov esi, edx
jle 0x409f98
mov ecx, dword [ebx + 0xa48]
lea eax, [ebp - 0xc8]
push eax
push esi
call fcn.0040ab30
lea ecx, [ebp - 0xc8]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x13ec]
jne 0x409f6f
mov eax, dword [ebp - 0x48]
sub ecx, edx
add eax, 2
sar ecx, 1
add eax, ecx
add edi, eax
mov eax, dword [ebx + 0xa48]
inc esi
cmp esi, dword [eax + 0xc]
jl 0x409f53
xor ecx, ecx
lea eax, [edi + 1]
mul dword [ebp - 0x1400]
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040abe1
mov ebx, eax
pop ecx
test ebx, ebx
je 0x40a07a
lea eax, [edi*2 + 1]
push eax
call fcn.0040abe1
mov dword [ebp - 0x1408], eax
pop ecx
test eax, eax
je 0x40a073
xor ecx, ecx
xor esi, esi
mov edx, ecx
mov edi, ecx
mov ecx, dword [ebp - 0x13f0]
mov dword [ebp - 0x13ec], edx
mov ecx, dword [ecx + 0xa48]
cmp dword [ecx + 0xc], esi
jle 0x40a064
lea eax, [ebp - 0xc8]
push eax
push edx
call fcn.0040ab30
test edi, edi
je 0x40a00f
push 0x26
pop eax
mov word [ebx + edi*2], ax
inc edi
push dword [ebp - 0x44]
lea eax, [ebp - 0xc8]
push eax
lea esi, [ebx + edi*2]
push str._s_s
push esi
call fcn.00409b00
add esp, 0x10
lea ecx, [esi + 2]
xor edx, edx
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x40a02f
mov eax, dword [ebp - 0x13f0]
sub esi, ecx
mov edx, dword [ebp - 0x13ec]
sar esi, 1
add edi, esi
inc edx
mov ecx, dword [eax + 0xa48]
mov dword [ebp - 0x13ec], edx
cmp edx, dword [ecx + 0xc]
jl 0x409ff6
mov eax, dword [ebp - 0x1408]
xor ecx, ecx
mov edx, ebx
mov word [ebx + edi*2], cx
mov ecx, eax
call fcn.00407d83
push ebx
call fcn.0040abdc
pop ecx
mov ebx, dword [ebp - 0x13f0]
lea edi, [ebp - 0x14]
mov ecx, dword [ebp - 0x1408]
mov esi, str.POST
xor edx, edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x1404]
jmp 0x40a0ac
mov eax, dword [0x5a68b8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x5a68bc]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1418], edx
test ecx, ecx
je 0x40a0cc
mov edx, ecx
lea ecx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x40a0bb
sub edx, ecx
mov dword [ebp - 0x1418], edx
xor edx, edx
push 0x50
pop eax
mov edi, eax
mov dword [ebp - 0x13ec], 1
mov ecx, edx
mov dword [ebp - 0x13f8], edi
mov dword [ebp - 0x13f0], edx
mov eax, dword [ebx + 0xa3c]
inc ecx
mov dword [ebp - 0x1430], ecx
mov dword [ebx + 0xa40], edx
test eax, eax
je 0x40a109
push eax
call fcn.0040abdc
pop ecx
xor edx, edx
push edx
push dword [ebx + 0xa34]
mov dword [ebx + 0xa3c], edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40a63b
cmp dword [ebp - 0x13ec], 0
je 0x40a239
push 0x50
pop edi
push 8
mov eax, edi
push str.https:__
push ebx
mov dword [ebp - 0x13f8], eax
call fcn.00551546
add esp, 0xc
test eax, eax
jne 0x40a16b
test esi, esi
mov eax, 0x1bb
push 8
cmovne eax, edi
movzx eax, ax
pop ecx
mov dword [ebp - 0x13f8], eax
jmp 0x40a184
push 7
pop esi
push esi
push str.http:__
push ebx
call fcn.00551546
xor ecx, ecx
add esp, 0xc
test eax, eax
cmove ecx, esi
lea eax, [ecx + ecx]
lea esi, [eax + ebx]
mov dword [ebp - 0x13ec], eax
push 0x2f
push esi
mov dword [ebp - 0x13f0], esi
call fcn.00547d5a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40a1fe
mov esi, edi
lea eax, [ebp - 0x2c8]
sub esi, dword [ebp - 0x13ec]
sub esi, ebx
sar esi, 1
push esi
push dword [ebp - 0x13f0]
push eax
call fcn.0054e73e
add esi, esi
add esp, 0xc
cmp esi, 0x200
jae 0x40a660
mov edx, dword [ebp - 0x1400]
lea ecx, [ebp - 0x12c8]
xor eax, eax
sub ecx, edi
mov word [ebp + esi - 0x2c8], ax
movzx eax, word [edi]
mov word [edi + ecx], ax
add edi, edx
test ax, ax
jne 0x40a1ee
jmp 0x40a223
mov edx, dword [ebp - 0x1400]
lea ecx, [ebp - 0x2c8]
sub ecx, esi
movzx eax, word [esi]
mov word [esi + ecx], ax
add esi, edx
test ax, ax
jne 0x40a20c
xor eax, eax
mov word [ebp - 0x12c8], ax
mov edi, dword [ebp - 0x13f8]
xor eax, eax
mov dword [ebp - 0x13ec], eax
mov dword [ebp - 0x13f0], eax
jmp 0x40a23b
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x13fc]
push str.Eassos_Net_App_1.0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
or esi, 0xffffffff
mov dword [ebp - 0x142c], eax
test eax, eax
je 0x40a4e6
xor ecx, ecx
push ecx
push edi
lea ecx, [ebp - 0x2c8]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
or esi, esi
mov dword [ebp - 0x1428], eax
test eax, eax
je 0x40a4da
mov esi, 0x1bb
mov edx, 0x800100
cmp di, si
mov ecx, 0x100
cmove ecx, edx
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x12c8]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov edi, eax
or esi, 0xffffffff
mov dword [ebp - 0x1410], edi
test edi, edi
je 0x40a4c8
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x141c]
push 4
push eax
push 3
push edi
mov dword [ebp - 0x141c], 0x15f90
mov dword [ebp - 0x1414], 0x3300
call esi
push 4
lea eax, [ebp - 0x1414]
push eax
push 0x1f
push edi
call esi
xor eax, eax
push eax
push eax
push 0x2f
push edi
call esi
cmp dword [ebp - 0x1418], 0
je 0x40a324
mov eax, dword [ebp - 0x1400]
push 4
mov dword [ebp - 0x1414], eax
lea eax, [ebp - 0x1414]
push eax
push 0x3f
push edi
call esi
push 0x22
pop ecx
mov esi, str.Content_type:application_x_www_form_urlencoded_r_nAuthorization:_Basic
lea edi, [ebp - 0xc8]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc8]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x1400]
xor esi, esi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x40a347
mov edi, dword [ebp - 0x1410]
lea eax, [ebp - 0xc8]
sub ecx, edx
push 0xa0000000
sar ecx, 1
push ecx
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov eax, dword [ebp - 0x1418]
xor ecx, ecx
push ecx
push eax
push eax
push dword [ebp - 0x1408]
or esi, 0xffffffff
push ecx
push ecx
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x40a4c1
xor eax, eax
or esi, esi
push eax
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x40a4c1
push 8
pop ecx
xor edx, edx
mov dword [ebp - 0x1420], 0x20
xor eax, eax
mov dword [ebp - 0x140c], edx
push edx
lea edi, [ebp - 0x34]
mov dword [ebp - 0x1424], edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x34]
push eax
push edx
push 5
push dword [ebp - 0x1410]
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
je 0x40a3f9
lea eax, [ebp - 0x34]
push eax
call fcn.0054e258
mov esi, eax
pop ecx
test esi, esi
jne 0x40a3fe
mov esi, 0x4000000
lea edi, [esi + 2]
push edi
call fcn.0040abe1
mov dword [ebx + 0xa3c], eax
pop ecx
test eax, eax
je 0x40a4bb
push edi
xor ecx, ecx
push ecx
push eax
call fcn.00548780
mov edi, dword [ebp - 0x1424]
add esp, 0xc
xor eax, eax
push eax
push dword [ebx + 0xa34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40a4a4
xor eax, eax
mov dword [ebp - 0x140c], eax
lea eax, [ebp - 0x140c]
push eax
mov eax, esi
sub eax, edi
push eax
mov eax, dword [ebx + 0xa3c]
add eax, edi
push eax
push dword [ebp - 0x1410]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x40a4a8
mov eax, dword [ebp - 0x140c]
add edi, eax
mov ecx, dword [ebx + 0xa2c]
test ecx, ecx
je 0x40a49a
xor eax, eax
push eax
imul eax, edi, 0x64
cdq
idiv esi
push eax
push 0x402
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x140c]
test eax, eax
je 0x40a4a8
cmp edi, esi
jl 0x40a429
jmp 0x40a4a8
xor eax, eax
mov edi, eax
mov eax, dword [ebx + 0xa3c]
xor ecx, ecx
mov esi, edi
mov byte [edi + eax], cl
mov dword [ebx + 0xa40], edi
mov edi, dword [ebp - 0x1410]
push edi
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
push dword [ebp - 0x1428]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov edi, dword [ebp - 0x13f8]
push dword [ebp - 0x142c]
call dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov eax, dword [ebx + 0xa3c]
xor ecx, ecx
test eax, eax
je 0x40a5d7
cmp dword [ebx + 0xa40], ecx
je 0x40a5d7
push str._html
push eax
call fcn.00547e30
pop ecx
pop ecx
test eax, eax
je 0x40a63e
push str._title_301_Moved_Permanently__title_
push dword [ebx + 0xa3c]
call fcn.00547e30
pop ecx
pop ecx
test eax, eax
je 0x40a63e
add eax, 0x24
push str.href
push eax
call fcn.00547e30
mov edx, eax
pop ecx
pop ecx
test eax, eax
je 0x40a5bc
add eax, 5
xor ecx, ecx
mov al, byte [eax]
cmp al, 0x22
mov byte [ebp - 0x13f1], al
sete cl
add ecx, 5
add ecx, edx
mov dword [ebp - 0x13ec], ecx
mov al, byte [ecx]
cmp al, 0x20
je 0x40a56e
cmp al, 9
jne 0x40a571
inc ecx
jmp 0x40a564
push 0x22
pop eax
cmp byte [ebp - 0x13f1], al
push 0x3e
pop edx
cmovne eax, edx
mov dword [ebp - 0x13ec], ecx
push eax
push ecx
call fcn.005480a0
pop ecx
pop ecx
test eax, eax
je 0x40a63e
mov edx, dword [ebp - 0x13ec]
xor ecx, ecx
mov byte [eax], cl
mov ecx, ebx
call fcn.00407e05
xor edx, edx
mov dword [ebp - 0x13ec], 1
mov dword [ebp - 0x13fc], edx
jmp 0x40a625
push 0x50
pop eax
cmp di, ax
jne 0x40a63e
cmp dword [ebp - 0x1404], 0
jne 0x40a63e
xor edx, edx
mov dword [ebp - 0x13fc], edx
jmp 0x40a610
cmp dword [ebp - 0x13fc], 0
jne 0x40a5ee
mov dword [ebp - 0x13fc], 1
xor edx, edx
jmp 0x40a625
cmp dword [ebp - 0x13f0], 0
jne 0x40a63e
push 0x50
pop eax
cmp di, ax
jne 0x40a63e
cmp dword [ebp - 0x1404], 0
jne 0x40a63e
mov dword [ebp - 0x13fc], ecx
xor edx, edx
mov edi, 0x1bb
mov dword [ebp - 0x13f0], 1
mov dword [ebp - 0x13f8], edi
mov ecx, dword [ebp - 0x1430]
cmp ecx, 0xa
jge 0x40a63b
mov esi, dword [ebp - 0x1404]
jmp 0x40a0e9
or esi, 0xffffffff
mov eax, dword [ebp - 0x1408]
test eax, eax
je 0x40a64f
push eax
call fcn.0040abdc
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00546259
leave
ret
call fcn.005463ae
int3