Function at 0x41a851
Capabilities:
Initialize winhttp library
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, 0x3af4
call fcn.00424e30
sub esp, eax
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 0
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.msvcrt.dll_memset
mov dword [ebp - 0x5c], 0x3c
lea eax, [ebp - 0x7a]
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0xe
lea eax, [ebp - 0x27a]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], 0xff
lea eax, [ebp - 0x2a4a]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0xfff
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.msvcrt.dll_mbstowcs
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
add eax, eax
mov dword [esp], eax
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add eax, 1
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_mbstowcs
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.Eris_Agent_1.0
call sub.WINHTTP.dll_WinHttpOpen
sub esp, 0x14
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41a996
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10000
mov dword [esp + 4], 0x41a1ac
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.WINHTTP.dll_WinHttpSetStatusCallback
sub esp, 0x10
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcrt.dll_wcslen
lea edx, [ebp - 0x5c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.WINHTTP.dll_WinHttpCrackUrl
sub esp, 0x10
movzx eax, word [ebp - 0x44]
movzx eax, ax
mov dword [esp + 8], eax
lea eax, [ebp - 0x27a]
mov dword [esp + 4], eax
mov dword [esp], str.Connecting_to_https:___ls:_d_cert
call fcn.00411655
movzx eax, word [ebp - 0x44]
movzx eax, ax
lea edx, [ebp - 0x2a50]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], str._cert
mov dword [esp + 8], eax
lea eax, [ebp - 0x27a]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.0041a25a
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x41aa15
mov dword [esp], str.Error_getting_certificate
call fcn.00411655
call fcn.00411b5a
mov ebx, 0
jmp 0x41abbd
lea eax, [ebp - 0x1d]
mov ecx, eax
call fcn.00436750
lea eax, [ebp - 0x2a68]
lea edx, [ebp - 0x1d]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.0043d460
sub esp, 8
lea eax, [ebp - 0x1d]
mov ecx, eax
call fcn.00436780
lea eax, [ebp - 0x2a68]
mov dword [esp], str._root.cer
mov ecx, eax
call fcn.0043e1b0
sub esp, 4
lea eax, [ebp - 0x2a68]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], 0x44a9d6
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x41aaaa
lea eax, [ebp - 0x2a68]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], eax
mov dword [esp], str.Error_generating_file__s
call fcn.00411655
mov ebx, 0
jmp 0x41abb0
mov eax, dword [ebp - 0x2a50]
mov edx, dword [ebp - 0x1c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
lea eax, [ebp - 0x2a68]
mov ecx, eax
call fcn.004350a0
mov dword [esp + 4], eax
mov dword [esp], str.CertificateFile
call fcn.0041a159
xor eax, 1
test al, al
je 0x41ab0e
mov dword [esp], str.Error_setting_certificateFile
call fcn.00411655
call fcn.00411b5a
mov dword [esp + 8], 0xfff
lea eax, [ebp - 0x27a]
mov dword [esp + 4], eax
lea eax, [ebp - 0x3a68]
mov dword [esp], eax
call sub.msvcrt.dll_wcstombs
lea eax, [ebp - 0x3a68]
mov dword [esp + 4], eax
mov dword [esp], str.SSOServer
call fcn.0041a159
xor eax, 1
test al, al
je 0x41ab5c
mov dword [esp], str.Error_setting_SSOServer
call fcn.00411655
call fcn.00411b5a
movzx eax, word [ebp - 0x44]
movzx eax, ax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x44aa42
lea eax, [ebp - 0x3acc]
mov dword [esp], eax
call fcn.0041a12c
lea eax, [ebp - 0x3acc]
mov dword [esp + 4], eax
mov dword [esp], str.seycon.https.port
call fcn.0041a159
xor eax, 1
test al, al
je 0x41abab
mov dword [esp], str.Error_setting_seycon.https.port
call fcn.00411655
call fcn.00411b5a
mov ebx, 1
lea eax, [ebp - 0x2a68]
mov ecx, eax
call fcn.0043dfb0
mov eax, ebx
jmp 0x41abf0
mov ebx, dword [ebp - 4]
leave
ret