Function at 0x4e5960
Capabilities:
Encode data using xor
Parse url

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x538e10
mov eax, dword fs:[0]
push eax
sub esp, 0x4d4
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x440], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x444], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004021e0
lea esi, [eax + 0x10]
mov dword [ebp - 0x430], esi
mov byte [ebp - 4], 1
mov edi, dword [esi - 0xc]
test edi, edi
jns 0x4e59cd
push 0x80070057
call fcn.00401b40
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4e59f0
push edi
lea ecx, [ebp - 0x430]
call fcn.00402c70
mov esi, dword [ebp - 0x430]
lea eax, [edi + 1]
push eax
push esi
call fcn.004aff30
add esp, 8
cmp edi, dword [esi - 8]
jg 0x4e59c3
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], eax
push 0x400
lea ecx, [ebp - 0x47c]
mov byte [ebp - 4], 2
call fcn.00425ce0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
push 0x400
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 3
call fcn.00425ce0
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x45c], 0
push 0x1000
lea ecx, [ebp - 0x464]
mov byte [ebp - 4], 4
call fcn.00425ce0
push 0x38
lea eax, [ebp - 0x4d4]
push 0
push eax
call fcn.0049e130
mov ecx, dword [ebp - 0x47c]
add esp, 0xc
mov eax, dword [ebp - 0x478]
sub eax, ecx
mov dword [ebp - 0x4d4], ecx
mov ecx, dword [ebp - 0x470]
sar eax, 1
mov dword [ebp - 0x4d0], eax
mov eax, dword [ebp - 0x46c]
sub eax, ecx
mov dword [ebp - 0x4c8], ecx
mov ecx, dword [ebp - 0x464]
sar eax, 1
mov dword [ebp - 0x4c4], eax
mov eax, dword [ebp - 0x460]
sub eax, ecx
mov dword [ebp - 0x4d8], 0x3c
sar eax, 1
mov dword [ebp - 0x4a8], eax
lea eax, [ebp - 0x4d8]
push eax
push 0x10000000
mov dword [ebp - 0x4ac], ecx
push dword [esi - 0xc]
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
or ebx, 0xffffffff
test eax, eax
je 0x4e5c18
push dword [ebp - 0x4c8]
lea ecx, [ebp - 0x42c]
call fcn.00401ff0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x434]
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x42c]
push 0
push eax
call fcn.00403370
mov byte [ebp - 4], 6
lea edi, [esi - 0x10]
mov edx, dword [eax]
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4e5ba0
cmp dword [edi + 0xc], 0
jl 0x4e5b8b
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4e5b8b
call fcn.004021e0
mov ecx, edi
mov esi, eax
call fcn.00402e90
add esi, 0x10
mov dword [ebp - 0x430], esi
jmp 0x4e5ba0
push dword [edx - 0xc]
lea ecx, [ebp - 0x430]
push edx
call fcn.00402d50
mov esi, dword [ebp - 0x430]
mov byte [ebp - 4], 5
mov eax, ebx
mov ecx, dword [ebp - 0x434]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4e5bdc
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e5bd8
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4e5bdc
mov ecx, edx
call edi
mov byte [ebp - 4], 4
mov eax, ebx
mov ecx, dword [ebp - 0x42c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4e5c18
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e5c14
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4e5c18
mov ecx, edx
call edi
push 0x401
lea eax, [ebp - 0x424]
mov dword [ebp - method.CCrc32.virtual_0], vtable.CCrc32.0
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.004d0220
mov byte [ebp - 4], 7
cmp dword [esi - 4], 1
mov edi, dword [esi - 0xc]
jle 0x4e5c62
push edi
lea ecx, [ebp - 0x430]
call fcn.00402b70
mov esi, dword [ebp - 0x430]
add edi, edi
or ebx, 0xffffffff
xor edx, edx
test edi, edi
jle 0x4e5c88
nop dword [eax]
movsx ecx, byte [edx + esi]
inc edx
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ebp + ecx*4 - 0x424]
cmp edx, edi
jl 0x4e5c70
mov edi, dword [ebp - 0x440]
not ebx
mov dword [ebp - 0x42c], ebx
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x42c]
add edi, 0x28
push eax
lea eax, [ebp - 0x43c]
mov ecx, edi
push eax
call fcn.00415c70
mov eax, dword [ebp - 0x43c]
cmp eax, dword [ebp - 0x438]
je 0x4e5cf5
lea eax, [ebp - 0x42c]
mov ecx, edi
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.00415c70
push dword [ebp - 0x438]
lea eax, [ebp - 0x438]
mov ecx, edi
push dword [ebp - 0x43c]
push eax
call fcn.00425eb0
mov ecx, dword [ebp - 0x444]
mov dword [ebp - 0x42c], 0
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x4e5fd1
call fcn.00401980
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4e601c
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x4e5d3f
lock inc dword [eax + 0x14]
lea edi, [eax + 8]
jmp 0x4e5d45
mov ecx, eax
call edx
mov edi, eax
add edi, 0x10
mov dword [ebp - 0x450], edi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 8
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x484]
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x458], eax
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x454], eax
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x44c], 1
mov edx, dword [eax]
mov eax, dword [eax + 4]
sub eax, edx
sar eax, 2
cmp eax, ecx
jbe 0x4e6012
mov edx, dword [edx + ecx*4]
add edi, 0xfffffff0
lea ecx, [edx - 0x10]
cmp ecx, edi
je 0x4e5e57
cmp dword [edi + 0xc], 0
jl 0x4e5e34
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4e5e34
call fcn.004021e0
mov dword [ebp - 0x438], eax
lea edx, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4e5e23
mov edx, dword [edi]
push edi
mov ecx, dword [edx]
mov eax, dword [ecx + 4]
cmp ecx, vtable.ATL::CAtlStringMgr.0
jne 0x4e5e1f
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [ebp - 0x438]
add edi, 0x10
mov dword [ebp - 0x450], edi
jmp 0x4e5e5d
mov ecx, edx
call eax
mov edi, dword [ebp - 0x438]
add edi, 0x10
mov dword [ebp - 0x450], edi
jmp 0x4e5e5d
push dword [edx - 0xc]
lea ecx, [ebp - 0x450]
push edx
call fcn.00402d50
mov ecx, dword [ebp - 0x454]
mov eax, dword [ebp - 0x458]
mov edi, dword [ebp - 0x450]
jmp 0x4e5e69
mov edi, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x448]
add edi, 0xfffffff0
mov dword [ebp - 0x490], ecx
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x49c], ebx
mov ecx, dword [edi]
mov eax, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
je 0x4e5e8e
call dword [eax + 0x10]
mov ecx, eax
cmp dword [edi + 0xc], 0
lea edx, [edi + 0xc]
jl 0x4e5ea2
cmp ecx, dword [edi]
jne 0x4e5ea2
mov eax, edi
lock inc dword [edx]
jmp 0x4e5eec
mov eax, dword [ecx]
push 2
push dword [edi + 4]
call dword [eax]
mov dword [ebp - 0x434], eax
test eax, eax
je 0x4e600d
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0x434]
add ecx, 0x10
lea eax, [edx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
lea edx, [edx*2 + 2]
call fcn.004c7670
mov eax, dword [ebp - 0x434]
add esp, 8
add eax, 0x10
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x488], eax
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x49c]
push eax
add ecx, 0x28
mov byte [ebp - 4], 9
call fcn.00426560
push eax
add eax, 0x10
push eax
push ecx
mov ecx, dword [ebp - 0x440]
lea eax, [ebp - 0x4e0]
push eax
lea ecx, [ecx + 0x28]
call fcn.00426620
mov byte [ebp - 4], 8
or eax, 0xffffffff
mov edx, dword [ebp - 0x48c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4e5f7c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x438], ecx
mov ecx, dword [edx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e5f76
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4e5f7c
call dword [ebp - 0x438]
mov byte [ebp - 4], 7
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4e5fae
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e5fac
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4e5fae
call edx
mov ecx, dword [ebp - 0x444]
mov edi, dword [ebp - 0x42c]
inc edi
mov dword [ebp - 0x42c], edi
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
cmp edi, eax
jb 0x4e5d15
push ebx
mov ebx, dword [ebp - 0x440]
mov ecx, ebx
call fcn.004e4620
lea eax, [ebx + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x464]
test ecx, ecx
je 0x4e6066
mov eax, dword [ebp - 0x45c]
sub eax, ecx
sar eax, 1
cmp eax, 0x7fffffff
jbe 0x4e6026
call fcn.004a4e3e
call fcn.00402c20
push 0x57962c
call fcn.00498105
push 0x80004005
call fcn.00401b40
add eax, eax
cmp eax, 0x1000
jb 0x4e605d
test cl, 0x1f
je 0x4e6039
call fcn.004a4e3e
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4e6045
call fcn.004a4e3e
sub ecx, eax
cmp ecx, 4
jae 0x4e6051
call fcn.004a4e3e
cmp ecx, 0x23
jbe 0x4e605b
call fcn.004a4e3e
mov ecx, eax
push ecx
call fcn.0049aa1d
add esp, 4
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x470]
test ecx, ecx
je 0x4e60ca
mov eax, dword [ebp - 0x468]
sub eax, ecx
sar eax, 1
cmp eax, 0x7fffffff
jbe 0x4e608a
call fcn.004a4e3e
add eax, eax
cmp eax, 0x1000
jb 0x4e60c1
test cl, 0x1f
je 0x4e609d
call fcn.004a4e3e
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4e60a9
call fcn.004a4e3e
sub ecx, eax
cmp ecx, 4
jae 0x4e60b5
call fcn.004a4e3e
cmp ecx, 0x23
jbe 0x4e60bf
call fcn.004a4e3e
mov ecx, eax
push ecx
call fcn.0049aa1d
add esp, 4
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x47c]
test ecx, ecx
je 0x4e612e
mov eax, dword [ebp - 0x474]
sub eax, ecx
sar eax, 1
cmp eax, 0x7fffffff
jbe 0x4e60ee
call fcn.004a4e3e
add eax, eax
cmp eax, 0x1000
jb 0x4e6125
test cl, 0x1f
je 0x4e6101
call fcn.004a4e3e
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4e610d
call fcn.004a4e3e
sub ecx, eax
cmp ecx, 4
jae 0x4e6119
call fcn.004a4e3e
cmp ecx, 0x23
jbe 0x4e6123
call fcn.004a4e3e
mov ecx, eax
push ecx
call fcn.0049aa1d
add esp, 4
or ebx, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4e6167
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e6165
mov eax, dword [ecx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call edi
jmp 0x4e616d
call edx
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4e61a3
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4e619f
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call edi
jmp 0x4e61a3
mov ecx, edx
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 8