Function at 0x10003c30
Capabilities:
Prepare http request
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10136506
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1208
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x117c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x11a0], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x116c], edi
mov dword [ebp - 0x1178], ecx
mov dword [ebp - 0x1194], edx
mov byte [ebp - 0x1171], al
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1190], eax
cmp byte [0x1019b0c0], al
jne 0x10003cb9
mov ecx, 0x1019b0c0
call fcn.100340e0
xor ecx, ecx
push ecx
mov eax, 0x1014615c
lea esi, [ebp - 0x11dc]
mov dword [ebp - 0x11c4], 7
mov dword [ebp - 0x11c8], 0
mov word [ebp - 0x11d8], cx
call fcn.10009510
xor esi, esi
push 0xffffffffffffffff
mov byte [ebp - 4], 1
push esi
lea ecx, [edi + 0x230]
lea eax, [ebp - 0x11dc]
mov dword [edi + 0x22c], esi
call fcn.10009210
mov byte [ebp - 4], 0
cmp dword [ebp - 0x11c4], 8
mov dword [edi + 0x228], esi
jb 0x10003d29
mov edx, dword [ebp - 0x11d8]
push edx
call fcn.1010e8a3
add esp, 4
mov ecx, dword [ebp + 0x10]
xor esi, esi
push 0x200
lea edx, [edi + 0x20]
xor eax, eax
push esi
push edx
mov dword [ebp - 0x11c4], 7
mov dword [ebp - 0x11c8], esi
mov word [ebp - 0x11d8], ax
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], 0xfffffffe
mov dword [edi + 0x14], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], esi
call fcn.10116880
add esp, 0xc
push 0x3c
lea eax, [ebp - 0x1218]
push esi
mov dword [edi + 0x220], esi
mov dword [edi + 0x224], esi
mov dword [edi + 4], esi
push eax
mov dword [edi + 8], esi
mov dword [edi + 0x458], esi
mov byte [edi + 0x24c], 0
call fcn.10116880
or eax, 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0xb50]
lea esi, [edi + 0x480]
push str.WinHttpCrackURL__SendRequest_
mov edx, esi
mov dword [ebp - 0x1218], 0x3c
mov dword [ebp - 0x1208], ecx
mov dword [ebp - 0x1204], 0x100
mov dword [ebp - 0x11e8], eax
mov dword [ebp - 0x1210], eax
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10003dfa
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
cmp dword [0x1018f84c], 0
je 0x10003e29
mov edx, dword [ebp - 0x1194]
push edx
push str._PROC___s__
push 0
call fcn.10053700
add esp, 0xc
push ebx
push 0x10146474
push 0
call fcn.10053700
add esp, 0xc
lea eax, [ebp - 0x1218]
push eax
push 0
push 0
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x10004c33
cmp dword [0x1018f84c], 0
je 0x10003e6c
movzx ecx, word [ebp - 0x1200]
push ecx
lea edx, [ebp - 0xb50]
push edx
push 0x10146478
mov edx, esi
call fcn.10002e50
add esp, 0xc
jmp 0x10003e83
movzx eax, word [ebp - 0x1200]
push eax
push str.WinHttpConnect_to_Port:_u
mov edx, esi
call fcn.10002e50
add esp, 8
cmp dword [0x1018fe68], 0
je 0x10003e9c
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ecx, dword [ebp - 0x1200]
mov eax, dword [edi + 0x464]
push 0
push ecx
lea edx, [ebp - 0xb50]
push edx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0x468], eax
test eax, eax
je 0x10004c33
xor ebx, ebx
cmp dword [ebp - 0x120c], 2
mov edx, esi
setne bl
dec ebx
and ebx, 0x800000
jne 0x10003ee5
push str.WinHttpOpenRequest__HTTP_
jmp 0x10003eea
push str.WinHttpOpenRequest__HTTPS_
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10003f0b
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov eax, dword [ebp - 0x117c]
test eax, eax
je 0x10003f61
cmp byte [eax], 0
je 0x10003f61
push str.WinHttpOpenRequest__POST_
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10003f42
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ecx, dword [ebp - 0x11ec]
mov edx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push ecx
push str.POST
push edx
jmp 0x10003ff5
cmp dword [ebp + 0x20], 0
mov edx, esi
jne 0x10003fab
push str.WinHttpOpenRequest__GET_
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10003f8f
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov eax, dword [ebp - 0x11ec]
mov ecx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push eax
push 0x101465bc
push ecx
jmp 0x10003ff5
push str.WinHttpOpenRequest__GET___Only_Response_Header_
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10003fd1
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov edx, dword [ebp - 0x11ec]
mov eax, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push edx
push 0x101465bc
mov dword [edi + 0x458], 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x46c], eax
test eax, eax
je 0x10004c33
push 0x10146628
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004031
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
push esi
lea ecx, [edi + 0x350]
push 0x10146158
push ecx
call fcn.10053700
mov edx, dword [edi + 0x46c]
add esp, 0xc
push 0
push 0x7f4000
push 0x100059a0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
test eax, eax
jne 0x10004c33
push 0x103
push eax
mov byte [ebp - 0x120], al
lea eax, [ebp - 0x11f]
push eax
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x227]
push 0
push ecx
mov byte [ebp - 0x228], 0
call fcn.10116880
add esp, 0xc
push str.Reading_ProxyUserName_and_ProxyPassword_from_HKLMSoftwareMicroWorld...
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x100040c7
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ebx, 0x104
push str.ProxyUserName
lea eax, [ebp - 0x118c]
lea edi, [ebp - 0x120]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x118c], ebx
call fcn.100315c0
push str.ProxyPassword
lea eax, [ebp - 0x118c]
lea edi, [ebp - 0x228]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x118c], ebx
call fcn.100315c0
cmp byte [ebp - 0x120], 0
je 0x10004261
cmp byte [ebp - 0x228], 0
je 0x10004261
xor eax, eax
lea ebx, [ebp - 0x1170]
lea edi, [ebp - 0x120]
mov dword [ebp - 0x1170], eax
mov dword [ebp - 0x1180], eax
call fcn.100572c0
test eax, eax
je 0x10004239
lea ebx, [ebp - 0x1180]
lea edi, [ebp - 0x228]
call fcn.100572c0
test eax, eax
je 0x10004239
push str.WinHttpSetCredentials_2_
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x1000419a
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
cmp dword [0x1019b1c4], 0
jne 0x100041cc
call fcn.100678a0
mov edi, dword [ebp - 0x1170]
test eax, eax
je 0x100041c0
push edi
push str._Proxy_authentication_set_2_:__s:_n
call fcn.1010de46
add esp, 8
mov dword [0x1019b1c4], 1
jmp 0x100041d2
mov edi, dword [ebp - 0x1170]
cmp dword [0x1018fe68], 0
je 0x100041eb
push edi
push str._Proxy_authentication_set_2_:__S:
push 0
call fcn.10053700
add esp, 0xc
mov edx, dword [ebp - 0x1180]
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x46c]
push 0
push edx
push edi
push 1
push 1
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x1000423f
test edi, edi
je 0x1000421d
push edi
call fcn.1010dc10
add esp, 4
mov eax, dword [ebp - 0x1180]
test eax, eax
je 0x10004c2d
push eax
call fcn.1010dc10
add esp, 4
jmp 0x10004c2d
mov edi, dword [ebp - 0x1170]
test edi, edi
je 0x1000424c
push edi
call fcn.1010dc10
add esp, 4
mov eax, dword [ebp - 0x1180]
test eax, eax
je 0x10004289
push eax
call fcn.1010dc10
add esp, 4
jmp 0x10004289
push str.NO_proxy_username_pwd_defined
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004289
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ecx, str.Connection:_Close
lea edx, [ebp - 0x1168]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10004294
mov edi, dword [ebp - 0x116c]
mov eax, dword [edi + 0x46c]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
lea edx, [ebp - 0x1168]
push edx
push eax
call ebx
mov eax, dword [ebp - 0x11a0]
test eax, eax
je 0x100042e9
cmp word [eax], 0
je 0x100042e9
mov ecx, dword [edi + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push eax
push ecx
call ebx
mov esi, dword [ebp + 0x1c]
cmp esi, 2
jne 0x10004328
mov ecx, str.X_Nimbus_APIKey:_2162EB2F_62A6_4141_A24E_AB1B5C7C3EAF
lea edx, [ebp - 0xd58]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10004300
mov eax, dword [edi + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea edx, [ebp - 0xd58]
push edx
push eax
call ebx
cmp esi, 1
jne 0x1000448d
push 0x103
lea ecx, [ebp - 0x53f]
push 0
push ecx
mov byte [ebp - 0x540], 0
call fcn.10116880
add esp, 0xc
mov ecx, str.X_Nimbus_UUID:
lea edx, [ebp - 0x748]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x10004360
lea eax, [ebp - 0x748]
cmp word [eax], 0
je 0x10004382
add eax, 2
jmp 0x10004377
xor edx, edx
mov word [eax], dx
mov edx, 0x1019b0c0
lea esp, [esp]
mov cl, byte [edx]
test cl, cl
je 0x100043a3
movzx cx, cl
mov word [eax], cx
add eax, 2
inc edx
jmp 0x10004390
xor edx, edx
push 0x20000000
mov word [eax], dx
push 0xffffffffffffffff
lea eax, [ebp - 0x748]
mov ecx, edi
mov edx, dword [ecx + 0x46c]
push eax
push edx
call ebx
push str.NCId
lea eax, [ebp - 0x11a4]
lea edi, [ebp - 0x540]
mov ecx, str.SoftwareMicroWorld
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11a4], 0x104
call fcn.100315c0
mov ecx, str.X_Nimbus_ClientID:
lea edx, [ebp - 0x748]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x100043f6
cmp byte [ebp - 0x540], al
jne 0x1000443c
lea edi, [ebp - 0x748]
add edi, 0xfffffffe
jmp 0x10004420
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004420
mov ecx, 0x12
mov esi, str.45403B8E_207A_45CF_AF7F_1050D4AAE746
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x10004470
lea ecx, [ebp - 0x748]
cmp word [ecx], 0
je 0x1000444d
add ecx, 2
jmp 0x10004442
xor eax, eax
mov word [ecx], ax
lea edx, [ebp - 0x540]
mov al, byte [edx]
test al, al
je 0x1000446b
movzx ax, al
mov word [ecx], ax
add ecx, 2
inc edx
jmp 0x10004458
xor edx, edx
mov word [ecx], dx
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea eax, [ebp - 0x748]
push eax
push edx
call ebx
mov eax, 0x1bb
cmp word [ebp - 0x1200], ax
jne 0x1000464c
test byte [0x101a3960], 1
mov dword [ebp - 0x1198], 0
jne 0x100044c3
or dword [0x101a3960], 1
call fcn.1004fd70
mov dword [0x101a395c], eax
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea ecx, [ebp - 0x1198]
push ecx
push 0x1f
push eax
mov dword [ebp - 0x1198], 0x3300
call edi
test eax, eax
jne 0x10004517
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov esi, dword [ebp - 0x116c]
push eax
add esi, 0x480
push str.WINHTTP_OPTION_SECURITY_FLAGS_Set_Error__LastErr:_d_
mov edx, esi
call fcn.10002e50
add esp, 8
jmp 0x10004538
mov esi, dword [ebp - 0x116c]
add esi, 0x480
push str.WINHTTP_OPTION_SECURITY_FLAGS_Successfully_Set
mov edx, esi
call fcn.10002e50
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004551
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
cmp dword [0x101a395c], 0
jne 0x100045be
mov ecx, dword [ebp - 0x1194]
test ecx, ecx
je 0x100045be
cmp byte [ecx], 0
je 0x100045be
push str.abusedb
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x100045be
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x464]
push 4
lea ecx, [ebp - 0x119c]
push ecx
push 0x54
push eax
mov dword [ebp - 0x119c], 0x20
call edi
test eax, eax
jne 0x100045b7
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Set_Error__LastErr:_d_
mov edx, esi
call fcn.10002e50
add esp, 8
jmp 0x10004609
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Successfully_Set__WINHTTP_FLAG_SECURE_PROTOCOL_SSL3_
jmp 0x100045ff
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x464]
push 4
lea ecx, [ebp - 0x1188]
push ecx
push 0x54
push eax
mov dword [ebp - 0x1188], 0xa80
call edi
test eax, eax
jne 0x100045fa
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Set_Error__LastErr:_d_
mov edx, esi
call fcn.10002e50
add esp, 8
jmp 0x10004609
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Successfully_Set__TLS1__TLS1_1__TLS1_2_
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004622
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0
push 0
push 0x2f
push edx
call edi
test eax, eax
jne 0x1000463d
call ebx
push 0x10146c54
mov edx, esi
call fcn.10002e50
add esp, 4
mov ebx, dword [ebp - 0x117c]
test ebx, ebx
je 0x10004b7a
cmp byte [ebx], 0
je 0x10004b7a
mov eax, str.ThisIsDataStream_
mov ecx, ebx
call fcn.10031940
test eax, eax
je 0x1000494a
push 0x103
lea eax, [ebp - 0x437]
push 0
push eax
mov byte [ebp - 0x438], 0
call fcn.10116880
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x32f]
push 0
push ecx
mov byte [ebp - 0x330], 0
call fcn.10116880
mov edi, dword [ebp - 0x116c]
lea esi, [edi + 0x480]
add esp, 0xc
push 0x10146c8c
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x100046eb
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov edx, dword [edi + 0x46c]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_multipart_form_data__boundary____________ThIs_Is_tHe_bouNdaRY__
push edx
call esi
test eax, eax
je 0x10004c89
push 0xa0000000
push 0xffffffffffffffff
mov eax, edi
mov ecx, dword [eax + 0x46c]
push str.User_Agent:_VirusTotal_Uploader_2.0
push ecx
call esi
test eax, eax
je 0x10004c89
push 0xa0000000
push 0xffffffffffffffff
mov edx, edi
mov eax, dword [edx + 0x46c]
push str.Cache_Control:_no_cache
push eax
call esi
test eax, eax
je 0x10004c89
mov esi, dword [ebp - 0x1170]
push str.IsFilePresent__
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x1000477a
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
push 1
push 0
xor edx, edx
mov ecx, ebx
call fcn.10044660
add esp, 8
test eax, eax
jne 0x1000493b
mov eax, dword [ebp - 0x1178]
test eax, eax
je 0x100047b1
cmp byte [eax], 0
je 0x100047b1
push eax
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x100047c2
lea edx, [ebp - 0x438]
push edx
mov ecx, ebx
call fcn.10045a10
add esp, 4
push str.ReadFromFile__
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x100047ea
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
lea ecx, [ebp - 0x1184]
mov edx, ebx
call fcn.1005bf90
mov edi, eax
mov dword [ebp - 0x117c], edi
test edi, edi
jbe 0x10004c2d
cmp dword [ebp - 0x1184], 0
je 0x10004c2d
cmp dword [ebp + 0x18], 0
je 0x10004825
mov eax, dword [ebp - 0x116c]
call fcn.10006970
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x330]
push str.______________ThIs_Is_tHe_bouNdaRY___r_nContent_Disposition:_form_data_name_archivo__filename__s__r_nContent_Type:_application_x_msdownload_r_n_r_n
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea edi, [esi + edi + 0x2a]
mov dword [ebp - 0x1188], edi
inc edi
push edi
call fcn.1010ccc2
mov ecx, dword [ebp - 0x116c]
add esp, 4
mov dword [ecx + 0x884], eax
test eax, eax
je 0x10004c27
push edi
push 0
push eax
call fcn.10116880
mov ebx, dword [ebp - 0x116c]
mov eax, dword [ebx + 0x884]
add esp, 0xc
push esi
lea edx, [ebp - 0x330]
push edx
push eax
call fcn.101162d0
mov ecx, dword [ebp - 0x117c]
mov edx, dword [ebp - 0x1184]
mov eax, dword [ebx + 0x884]
add esp, 0xc
push ecx
push edx
add eax, esi
push eax
call fcn.101162d0
mov edi, dword [ebx + 0x884]
add edi, esi
add edi, dword [ebp - 0x117c]
mov ecx, 0xa
mov esi, str._r_n______________ThIs_Is_tHe_bouNdaRY_____r_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x1170]
add esp, 0xc
push str.WinHttpSendRequest_POST_
mov edx, esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004909
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov eax, dword [ebp - 0x1188]
mov ecx, dword [ebx + 0x884]
mov edx, dword [ebx + 0x46c]
push ebx
push eax
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x10004c27
mov eax, esi
mov ecx, ebx
jmp 0x10004c0b
mov dword [ebp - 0x1190], 1
jmp 0x10004c33
mov esi, dword [ebp - 0x116c]
add esi, 0x480
push str.WinHttpAddRequestHeadersData
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004984
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov edi, dword [ebp - 0x1178]
mov eax, str.analyticdata:
mov ecx, edi
call fcn.10031940
test eax, eax
je 0x10004a42
mov eax, str.fname
mov ecx, edi
call fcn.10031940
test eax, eax
je 0x10004a42
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept:__
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x10004c27
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept_Encoding:_gzip_deflate
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x10004c27
cmp dword [ebp + 0x1c], 2
push 0x20000000
push 0xffffffffffffffff
jne 0x10004a21
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x46c]
push str.Content_Type:_application_json
push ecx
jmp 0x10004a7f
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push str.Content_Type:_application_octet_stream
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x10004a8d
jmp 0x10004c2d
mov eax, str.fname
mov ecx, edi
call fcn.10031940
test eax, eax
jne 0x10004a66
push eax
push 0x1013f817
push str.fname
push edi
call fcn.10047ed0
add esp, 0x10
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_text_plain
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x10004c27
add ebx, 0x11
push ebx
call fcn.1010dc05
mov esi, eax
add esp, 4
test esi, esi
jbe 0x10004c27
test edi, edi
je 0x10004c27
cmp dword [ebp + 0x18], 0
je 0x10004abc
mov eax, dword [ebp - 0x116c]
call fcn.10006970
lea edi, [esi + 1]
push edi
call fcn.1010ccc2
mov ecx, dword [ebp - 0x116c]
add esp, 4
mov dword [ecx + 0x884], eax
test eax, eax
je 0x10004c27
push edi
push 0
push eax
call fcn.10116880
mov edx, dword [ebp - 0x1178]
mov edi, dword [ebp - 0x116c]
mov eax, dword [edi + 0x884]
add esp, 0xc
push esi
push edx
push eax
call fcn.101162d0
mov ebx, dword [ebp - 0x1170]
add esp, 0xc
push str.WinHttpSendRequest_POSTDATA_
mov edx, ebx
call fcn.10002e50
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004b33
push ebx
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov ecx, dword [edi + 0x884]
mov edx, dword [edi + 0x46c]
push edi
push esi
push esi
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x10004c27
mov eax, ebx
push eax
mov ecx, edi
add ecx, 0x350
push 0x10146158
push ecx
call fcn.10053700
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10004c20
cmp dword [ebp + 0x20], 0
mov edi, dword [ebp - 0x116c]
jne 0x10004ba0
lea esi, [edi + 0x480]
push str.WinHttpSendRequest_GET_
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.10002e50
jmp 0x10004bbc
lea edx, [edi + 0x480]
push str.WinHttpSendRequest_HEAD_
mov dword [ebp - 0x1170], edx
call fcn.10002e50
mov esi, dword [ebp - 0x1170]
add esp, 4
cmp dword [0x1018fe68], 0
je 0x10004bd8
push esi
push 0x10146158
push 0
call fcn.10053700
add esp, 0xc
mov edx, dword [edi + 0x46c]
push edi
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x10004c27
push 0x1018fe78
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x1170]
mov ecx, dword [ebp - 0x116c]
push eax
add ecx, 0x350
push 0x10146158
push ecx
call fcn.10053700
add esp, 0xc
mov byte [ebp - 0x1171], 1
mov esi, dword [ebp - 0x1170]
mov edi, dword [ebp - 0x116c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1184]
test eax, eax
je 0x10004c52
push eax
call fcn.1010dc10
add esp, 4
cmp byte [ebp - 0x1171], 0
jne 0x10004d58
mov ecx, dword [ebp - 0x1178]
lea ebx, [ebp - 0xf60]
call fcn.10003260
xor ebx, ebx
cmp dword [ebp - 0x1190], ebx
jne 0x10004c91
lea edx, [ebp - 0xf60]
push edx
push esi
push str._s_failed___s
jmp 0x10004c9e
mov esi, dword [ebp - 0x1170]
jmp 0x10004c33
mov eax, dword [ebp - 0x1178]
push eax
push esi
push str._s_failed__File_Absent___u_
lea edx, [ebp - 0x950]
call fcn.10002e50
add esp, 0xc
xor ecx, ecx
lea eax, [ebp - 0x950]
mov dword [ebp - 0x11a8], 7
mov dword [ebp - 0x11ac], ebx
mov word [ebp - 0x11bc], cx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10004cd0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x950]
lea esi, [ebp - 0x11c0]
call fcn.10009510
push 0xffffffffffffffff
mov byte [ebp - 4], 2
push ebx
lea ecx, [edi + 0x230]
mov eax, esi
mov dword [edi + 0x22c], 1
call fcn.10009210
mov edx, dword [ebp - 0x1178]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x11a8], 8
mov dword [edi + 0x228], edx
jb 0x10004d36
mov eax, dword [ebp - 0x11bc]
push eax
call fcn.1010e8a3
add esp, 4
xor ecx, ecx
mov word [ebp - 0x11bc], cx
push 2
mov ecx, edi
mov dword [ebp - 0x11a8], 7
mov dword [ebp - 0x11ac], ebx
call fcn.100051c0
mov al, byte [ebp - 0x1171]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010d699
mov esp, ebp
pop ebp
ret 0x20