Function at 0x40ac50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x504
mov dword [esp + 0x400], ecx
mov dword [esp + 0x404], edx
xor edx, edx
mov dword [esp + 0x4f8], edx
mov dword [esp + 0x4fc], edx
mov dword [esp + 0x1c], 0x706870
mov dword [esp + 0x18], 0x2e687475
mov dword [esp + 0x14], 0x612f6d6f
mov dword [esp + 0x10], 0x632e7374
mov dword [esp + 0xc], 0x72616e65
mov dword [esp + 8], 0x672e7777
mov dword [esp + 4], 0x772f2f3a
mov dword [esp], 0x70747468
cmp dword [ebp + 0x30], 0
movaps xmm0, xmmword [0x53ec60]
movaps xmmword [esp + 0x480], xmm0
movaps xmm1, xmmword [str.Name]
movaps xmmword [esp + 0x490], xmm1
mov edx, 0x53fd0c
movaps xmm2, xmmword [str.Company]
movaps xmmword [esp + 0x4a0], xmm2
movaps xmm3, xmmword [str.PrimaryHost]
movaps xmmword [esp + 0x4b0], xmm3
mov edi, 0x542890
movaps xmm4, xmmword [0x53eca0]
movaps xmmword [esp + 0x4c0], xmm4
movaps xmm5, xmmword [str.RequestCode]
movaps xmmword [esp + 0x4d0], xmm5
cmovne edi, edx
movsd xmm6, qword [0x53ecc0]
movsd qword [esp + 0x4e0], xmm6
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x14]
mov dword [esp + 0x494], eax
mov eax, dword [esp + 0x404]
mov dword [esp + 0x49c], eax
mov eax, dword [esp + 0x400]
mov dword [esp + 0x4a4], eax
mov dword [esp + 0x4ac], edx
mov edx, dword [ebp + 0x24]
mov dword [esp + 0x4b4], ecx
mov ecx, dword [ebp + 0x28]
mov dword [esp + 0x4bc], ebx
mov ebx, dword [ebp + 0x2c]
mov dword [esp + 0x4c4], esi
mov dword [esp + 0x4cc], edx
mov dword [esp + 0x4d4], ecx
mov dword [esp + 0x4dc], ebx
mov dword [esp + 0x4e4], edi
lea edx, [esp + 0x480]
lea eax, [esp + 0x4f8]
lea edi, [esp + 0x4fc]
push dword [ebp + 0x44]
push dword [ebp + 0x40]
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push edi
push eax
push edx
push 0xd
push str.POST
lea ecx, [esp + 0x24]
push ecx
call fcn.0040afb0
add esp, 0x28
mov ebx, eax
test ebx, ebx
jne 0x40aed7
push str.HTTP_
push dword [esp + 0x4fc]
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov edi, eax
mov esi, dword [ebp + 0x34]
test edi, edi
je 0x40af99
lea ecx, [esp + 0x4f0]
lea edx, [esp + 0x4f4]
lea eax, [esp + 0x400]
push eax
add edi, 5
push edx
push ecx
lea eax, [esp + 0x4f8]
push eax
push str._d._d__d____r_n_
push edi
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0x18
cmp eax, 4
jne 0x40af86
mov ecx, dword [esp + 0x4f4]
mov eax, 0x51eb851f
imul ecx
mov edi, ecx
sar edi, 0x1f
sar edx, 5
sub edx, edi
cmp edx, 2
jne 0x40af6b
mov edi, dword [esp + 0x4fc]
push str.AUTH_ERROR:_
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
mov dword [esp + 0x4f0], eax
push str.INSTALL_CODE:_
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 0x10
mov edi, eax
test edi, edi
je 0x40af12
push 0x53fde0
add edi, 0x12
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
je 0x40aee6
mov byte [eax], 0
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x40aeb0
push dword [esp + 0x4f8]
call dword [sym.imp.MSVCR80.dll_free]
push dword [esp + 0x500]
call dword [sym.imp.MSVCR80.dll_free]
add esp, 8
mov eax, ebx
add esp, 0x504
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
push edi
push str.Web_site_error:_bad_install_code_format__s
call fcn.00423ac0
add esp, 8
mov ebx, 0xffffffff
mov byte [esi + 0xa], 0
mov word [esi + 8], 0x524f
mov dword [esi + 4], 0x5252455f
mov dword [esi], 0x48545541
jmp 0x40aeba
cmp dword [esp + 0x4e8], 0
je 0x40af5e
mov eax, dword [esp + 0x4e8]
add eax, 0x10
mov dword [esp + 0x4e8], eax
push 0x53fde0
push eax
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
test eax, eax
je 0x40af43
mov byte [eax], 0
push dword [esp + 0x4e8]
push 0x542894
call fcn.00423ac0
add esp, 8
mov ebx, 0xfffffffe
jmp 0x40aef9
push str.Unknown_web_site_error__missing_code_
call fcn.00423ac0
pop ecx
jmp 0x40aef4
lea eax, [esp + 0x400]
push eax
push ecx
push str.Bad_HTTP_status__d_from_web_site:__s
call fcn.00423ac0
add esp, 0xc
jmp 0x40aef4
push edi
push str.Invalid_HTTP_return_status__cant_parse_header_HTTP__s_
call fcn.00423ac0
add esp, 8
jmp 0x40aef4
push str.Invalid_non_HTTP_header_string_returned_from_web_site
call fcn.00423ac0
pop ecx
jmp 0x40aef4