Function at 0x414e60
Capabilities:
Connect to http server
Create http request
Get common file path
Hash data with md5
Send data
Send http request
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47ad48
mov eax, dword fs:[0]
push eax
sub esp, 0xf30
mov eax, dword [0x496684]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0xf2c], eax
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0xea4], 0xf
mov dword [ebp - 0xea8], ebx
mov byte [ebp - 0xeb8], bl
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x414eb6
sub eax, edi
push eax
push esi
lea ecx, [ebp - 0xeb8]
call fcn.004054e0
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0xf2c]
cmp dword [ecx + 0xac], ebx
jne 0x4150f1
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push ebx
push ebx
push 3
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
push 0x206
lea eax, [ebp - 0x272]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x274], dx
call fcn.004316d0
add esp, 0xc
lea ecx, [ebp - 0x274]
push ecx
call fcn.00406d20
push ebx
sub esp, 0x1c
mov ecx, esp
xor edx, edx
lea eax, [ebp - 0x274]
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], ebx
mov dword [ebp - 0xf30], esp
mov word [ecx], dx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x414f47
sub eax, esi
sar eax, 1
push eax
lea eax, [ebp - 0x274]
call fcn.00405630
mov byte [ebp - 4], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xf0c]
call fcn.004012d0
mov byte [ebp - 4], 2
push 0x3ff
lea eax, [ebp - 0x673]
push ebx
push eax
mov byte [ebp - 0x674], bl
call fcn.004316d0
mov eax, dword [ebp - 0xf0c]
add esp, 0x2c
cmp dword [ebp - 0xef8], 0x10
jae 0x414fa8
lea eax, [ebp - 0xf0c]
mov esi, dword [ebp - 0xefc]
push esi
push eax
lea ecx, [ebp - 0x674]
push ecx
call fcn.00431360
add esp, 0xc
mov dword [ebp - 0xec8], ebx
mov dword [ebp - 0xec4], ebx
mov dword [ebp - 0xec0], ebx
mov dword [ebp - 0xebc], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x64], 0x67452301
mov dword [ebp - 0x60], 0xefcdab89
mov dword [ebp - 0x5c], 0x98badcfe
mov dword [ebp - 0x58], 0x10325476
lea eax, [esi*8]
cmp esi, ebx
jle 0x41501a
push ebx
lea edx, [ebp - 0x6c]
push esi
push edx
mov ecx, esi
lea edx, [ebp - 0x674]
call fcn.0040f7c0
add esp, 0xc
lea eax, [ebp - 0xec8]
push eax
lea esi, [ebp - 0x6c]
call fcn.0040f870
mov edi, 0xf
lea eax, [ebp - 0xec8]
add esp, 4
mov dword [ebp - 0xf14], edi
mov dword [ebp - 0xf18], ebx
mov byte [ebp - 0xf28], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x415050
sub eax, edx
push eax
lea ecx, [ebp - 0xec8]
push ecx
lea ecx, [ebp - 0xf28]
call fcn.004054e0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xf2c]
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0xf28]
push edx
add ecx, 0x9c
call fcn.00405160
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 2
mov esi, 0x10
cmp dword [ebp - 0xf14], esi
jb 0x4150b1
mov eax, dword [ebp - 0xf28]
push eax
call fcn.0042ca67
add esp, 4
mov dword [ebp - 0xf14], edi
mov dword [ebp - 0xf18], ebx
mov byte [ebp - 0xf28], bl
mov byte [ebp - 4], bl
cmp dword [ebp - 0xef8], esi
jb 0x4150dd
mov ecx, dword [ebp - 0xf0c]
push ecx
call fcn.0042ca67
add esp, 4
mov dword [ebp - 0xef8], edi
mov dword [ebp - 0xefc], ebx
mov byte [ebp - 0xf0c], bl
jmp 0x4150f6
mov edi, 0xf
mov edx, dword [ebp - 0xf2c]
push 0xffffffffffffffff
push ebx
add edx, 0x9c
push edx
lea ecx, [ebp - 0xef0]
mov dword [ebp - 0xedc], edi
mov dword [ebp - 0xee0], ebx
mov byte [ebp - 0xef0], bl
call fcn.00405160
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf30], esp
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xef0]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push eax
mov byte [ecx], bl
call fcn.00405160
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xf34], esp
push 1
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push 0x48c754
mov byte [ecx], bl
call fcn.004054e0
mov byte [ebp - 4], 6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xeb8]
call fcn.004014a0
add esp, 0x38
push bind
push ebx
push ebx
push 1
push str.GetUrlToBuff
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0xf30], esi
cmp esi, ebx
je 0x415472
push 0x823
lea ecx, [ebp - 0xe9b]
push ebx
push ecx
mov byte [ebp - 0xe9c], bl
call fcn.004316d0
add esp, 0xc
push 0x2000000
lea edx, [ebp - 0xf38]
push edx
lea eax, [ebp - 0xe9c]
push eax
push str.www.google_analytics.com
mov dword [ebp - 0xf38], 0x824
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x50
lea ecx, [ebp - 0xe9c]
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetConnectA]
mov dword [ebp - 0xf2c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [ebp - 0xf2c]
cmp eax, ebx
je 0x415429
cmp dword [ebp - 0xea4], 0x10
mov ecx, dword [ebp - 0xeb8]
jae 0x41522e
lea ecx, [ebp - 0xeb8]
push ebx
push 0x4000000
push ebx
push ebx
push str.HTTP_1.1
push ecx
push str.POST
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov edi, eax
cmp edi, ebx
je 0x4153b2
push ebx
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
push 0x104
call fcn.0042bc4e
add esp, 4
push 0x104
mov esi, eax
push ebx
push esi
mov dword [ebp - 0xf34], esi
call fcn.004316d0
add esp, 0xc
push ebx
lea edx, [ebp - 0xf3c]
push edx
push esi
push 0x13
push edi
mov dword [ebp - 0xf3c], 0x104
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
lea eax, [ebp - 0x174]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x174]
mov dword [ebp - 0xec0], 0xf
mov dword [ebp - 0xec4], ebx
mov byte [ebp - 0xed4], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4152d0
sub eax, edx
push eax
lea ecx, [ebp - 0x174]
push ecx
lea ecx, [ebp - 0xed4]
call fcn.004054e0
mov byte [ebp - 4], 7
push 0x11
mov eax, str.statisticslog.txt
lea ecx, [ebp - 0xed4]
call fcn.00402d60
cmp dword [ebp - 0xec0], 0x10
mov eax, dword [ebp - 0xed4]
jae 0x415317
lea eax, [ebp - 0xed4]
push 0x48c778
push eax
call fcn.0042d99d
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x41536b
push esi
push 2
push 1
push 0x48c77c
call fcn.0042f6d0
mov eax, dword [ebp - 0xeb8]
add esp, 0x10
cmp dword [ebp - 0xea4], 0x10
jae 0x415352
lea eax, [ebp - 0xeb8]
mov edx, dword [ebp - 0xea8]
push esi
push edx
push 1
push eax
call fcn.0042f6d0
push esi
call fcn.0042dc88
add esp, 0x14
mov eax, dword [ebp - 0xf34]
push eax
call fcn.0042d668
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0xec0], 0x10
jb 0x415396
mov ecx, dword [ebp - 0xed4]
push ecx
call fcn.0042ca67
add esp, 4
mov esi, dword [ebp - 0xf30]
mov dword [ebp - 0xec0], 0xf
mov dword [ebp - 0xec4], ebx
mov byte [ebp - 0xed4], bl
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
mov edx, dword [ebp - 0xf2c]
push edx
call esi
cmp edi, ebx
je 0x4153cb
push edi
call esi
mov byte [ebp - 4], bl
mov esi, 0x10
cmp dword [ebp - 0xedc], esi
jb 0x4153ea
mov eax, dword [ebp - 0xef0]
push eax
call fcn.0042ca67
add esp, 4
mov edi, 0xf
mov dword [ebp - 0xedc], edi
mov dword [ebp - 0xee0], ebx
mov byte [ebp - 0xef0], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xea4], esi
jb 0x41541f
mov ecx, dword [ebp - 0xeb8]
push ecx
call fcn.0042ca67
add esp, 4
mov eax, 1
jmp 0x4154c3
mov byte [ebp - 4], bl
mov esi, 0x10
cmp dword [ebp - 0xedc], esi
jb 0x415448
mov edx, dword [ebp - 0xef0]
push edx
call fcn.0042ca67
add esp, 4
mov dword [ebp - 0xedc], edi
mov dword [ebp - 0xee0], ebx
mov byte [ebp - 0xef0], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xea4], esi
jb 0x4154c1
mov eax, dword [ebp - 0xeb8]
push eax
jmp 0x4154b9
mov byte [ebp - 4], bl
mov esi, 0x10
cmp dword [ebp - 0xedc], esi
jb 0x415491
mov ecx, dword [ebp - 0xef0]
push ecx
call fcn.0042ca67
add esp, 4
mov dword [ebp - 0xedc], edi
mov dword [ebp - 0xee0], ebx
mov byte [ebp - 0xef0], bl
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xea4], esi
jb 0x4154c1
mov edx, dword [ebp - 0xeb8]
push edx
call fcn.0042ca67
add esp, 4
xor eax, eax
mov dword [ebp - 0xea4], edi
mov dword [ebp - 0xea8], ebx
mov byte [ebp - 0xeb8], bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042ca72
mov esp, ebp
pop ebp
ret 4