Function at 0x8549c0
Capabilities:
Prepare http request
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9a286
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1210
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1180], eax
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x116c], edi
mov dword [ebp - 0x117c], ecx
mov dword [ebp - 0x1194], edx
mov dword [ebp - 0x11a4], eax
mov byte [ebp - 0x1171], al
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1190], eax
cmp byte [0xbe5020], al
jne 0x854a4f
mov ecx, 0xbe5020
call fcn.0094ee70
xor ecx, ecx
push ecx
mov eax, 0xaa8704
lea esi, [ebp - 0x11e0]
mov dword [ebp - 0x11c8], 7
mov dword [ebp - 0x11cc], 0
mov word [ebp - 0x11dc], cx
call fcn.0085d720
xor esi, esi
push 0xffffffffffffffff
mov byte [ebp - 4], 1
push esi
lea ecx, [edi + 0x230]
lea eax, [ebp - 0x11e0]
mov dword [edi + 0x22c], esi
call fcn.0085d4c0
mov byte [ebp - 4], 0
cmp dword [ebp - 0x11c8], 8
mov dword [edi + 0x228], esi
jb 0x854abf
mov edx, dword [ebp - 0x11dc]
push edx
call fcn.00a7a9b9
add esp, 4
mov ecx, dword [ebp + 0x10]
push 0x200
lea edx, [edi + 0x20]
xor eax, eax
push esi
push edx
mov dword [ebp - 0x11c8], 7
mov dword [ebp - 0x11cc], esi
mov word [ebp - 0x11dc], ax
mov dword [edi + 0xc], ecx
mov dword [edi + 0x10], 0xfffffffe
mov dword [edi + 0x14], esi
mov dword [edi + 0x1c], esi
mov dword [edi + 0x18], esi
call fcn.00a7ffb0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
add esp, 0xc
mov dword [edi + 0x220], eax
mov dword [edi + 0x224], ecx
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0x458], esi
cmp ebx, esi
je 0x854b37
cmp byte [ebx], 0
je 0x854b37
push ebx
lea edx, [edi + 0x24c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x854b3e
mov byte [edi + 0x24c], 0
push 0x3c
lea eax, [ebp - 0x121c]
push 0
push eax
call fcn.00a7ffb0
or eax, 0xffffffff
add esp, 0xc
lea ecx, [ebp - 0xb50]
lea esi, [edi + 0x47c]
push str.WinHttpCrackURL__SendRequest_
mov edx, esi
mov dword [ebp - 0x121c], 0x3c
mov dword [ebp - 0x120c], ecx
mov dword [ebp - 0x1208], 0x100
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x1214], eax
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854bae
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
cmp dword [0xb53f48], 0
je 0x854be3
mov edx, dword [ebp - 0x1180]
push edx
push str._PROC___s__
push 0
call fcn.0096a780
mov eax, dword [ebp - 0x1198]
add esp, 0xc
push eax
push 0xaa8a0c
push 0
call fcn.0096a780
add esp, 0xc
mov edx, dword [ebp - 0x1198]
lea ecx, [ebp - 0x121c]
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x855a16
cmp dword [0xb53f48], 0
je 0x854c2c
movzx eax, word [ebp - 0x1204]
push eax
lea ecx, [ebp - 0xb50]
push ecx
push 0xaa8a10
mov edx, esi
call fcn.00853e40
add esp, 0xc
jmp 0x854c43
movzx edx, word [ebp - 0x1204]
push edx
push str.WinHttpConnect_to_Port:_u
mov edx, esi
call fcn.00853e40
add esp, 8
cmp dword [0xb53f4c], 0
je 0x854c5c
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [ebp - 0x1204]
mov edx, dword [edi + 0x464]
push 0
push eax
lea ecx, [ebp - 0xb50]
push ecx
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [edi + 0x468], eax
test eax, eax
je 0x855a16
xor ebx, ebx
cmp dword [ebp - 0x1210], 2
mov edx, esi
setne bl
dec ebx
and ebx, 0x800000
jne 0x854ca5
push str.WinHttpOpenRequest__HTTP_
jmp 0x854caa
push str.WinHttpOpenRequest__HTTPS_
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854ccb
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [ebp - 0x117c]
test eax, eax
je 0x854d21
cmp byte [eax], 0
je 0x854d21
push str.WinHttpOpenRequest__POST_
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854d02
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [ebp - 0x11f0]
mov ecx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push eax
push str.POST
push ecx
jmp 0x854db5
cmp dword [ebp + 0x2c], 0
mov edx, esi
jne 0x854d6b
push str.WinHttpOpenRequest__GET_
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854d4f
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov edx, dword [ebp - 0x11f0]
mov eax, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push edx
push 0xaa8b54
push eax
jmp 0x854db5
push str.WinHttpOpenRequest__GET___Only_Response_Header_
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854d91
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov ecx, dword [ebp - 0x11f0]
mov edx, dword [edi + 0x468]
push ebx
push 0
push 0
push 0
push ecx
push 0xaa8b54
mov dword [edi + 0x458], 1
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [edi + 0x46c], eax
test eax, eax
je 0x855a16
push 0xaa8bc0
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854df1
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
push esi
lea eax, [edi + 0x350]
push 0xaa8700
push eax
call fcn.0096a780
mov ecx, dword [edi + 0x46c]
add esp, 0xc
push 0
push 0x7f4000
push 0x8566b0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetStatusCallback]
test eax, eax
jne 0x855a16
push 0x103
push eax
lea edx, [ebp - 0x437]
push edx
mov byte [ebp - 0x438], al
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x11f]
push 0
push eax
mov byte [ebp - 0x120], 0
call fcn.00a7ffb0
add esp, 0xc
push str.Reading_ProxyUserName_and_ProxyPassword_from_HKLMSoftwareMicroWorld...
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854e87
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov ebx, 0x104
push str.ProxyUserName
lea eax, [ebp - 0x1178]
lea edi, [ebp - 0x438]
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov dword [ebp - 0x1178], ebx
call fcn.0094c020
push str.ProxyPassword
lea eax, [ebp - 0x1178]
lea edi, [ebp - 0x120]
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov dword [ebp - 0x1178], ebx
call fcn.0094c020
cmp byte [ebp - 0x438], 0
je 0x855021
cmp byte [ebp - 0x120], 0
je 0x855021
xor eax, eax
lea ebx, [ebp - 0x1170]
lea edi, [ebp - 0x438]
mov dword [ebp - 0x1170], eax
mov dword [ebp - 0x1188], eax
call fcn.009704b0
test eax, eax
je 0x854ff9
lea ebx, [ebp - 0x1188]
lea edi, [ebp - 0x120]
call fcn.009704b0
test eax, eax
je 0x854ff9
push str.WinHttpSetCredentials_2_
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x854f5a
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
cmp dword [0xbe5124], 0
jne 0x854f8c
call fcn.00986120
mov edi, dword [ebp - 0x1170]
test eax, eax
je 0x854f80
push edi
push str._Proxy_authentication_set_2_:__s:_n
call fcn.00a7a37e
add esp, 8
mov dword [0xbe5124], 1
jmp 0x854f92
mov edi, dword [ebp - 0x1170]
cmp dword [0xb53f4c], 0
je 0x854fab
push edi
push str._Proxy_authentication_set_2_:__S:
push 0
call fcn.0096a780
add esp, 0xc
mov ecx, dword [ebp - 0x1188]
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push 0
push ecx
push edi
push 1
push 1
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x854fff
test edi, edi
je 0x854fdd
push edi
call fcn.00a78fec
add esp, 4
mov eax, dword [ebp - 0x1188]
test eax, eax
je 0x855a10
push eax
call fcn.00a78fec
add esp, 4
jmp 0x855a10
mov edi, dword [ebp - 0x1170]
test edi, edi
je 0x85500c
push edi
call fcn.00a78fec
add esp, 4
mov eax, dword [ebp - 0x1188]
test eax, eax
je 0x855049
push eax
call fcn.00a78fec
add esp, 4
jmp 0x855049
push str.NO_proxy_username_pwd_defined
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x855049
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov ebx, dword [ebp - 0x116c]
mov ecx, str.Connection:_Close
lea edx, [ebp - 0xd58]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x855060
mov edx, dword [ebx + 0x46c]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push 0x20000000
push 0xffffffffffffffff
lea ecx, [ebp - 0xd58]
push ecx
push edx
call edi
mov eax, dword [ebp - 0x11a4]
test eax, eax
je 0x8550ae
cmp word [eax], ax
je 0x8550ae
push 0x20000000
push 0xffffffffffffffff
push eax
mov eax, dword [ebx + 0x46c]
push eax
call edi
mov esi, dword [ebp + 0x24]
cmp esi, 2
jne 0x8550e9
mov ecx, str.X_Nimbus_APIKey:_2162EB2F_62A6_4141_A24E_AB1B5C7C3EAF
lea edx, [ebp - 0xf60]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x8550c1
mov edx, dword [ebx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea ecx, [ebp - 0xf60]
push ecx
push edx
call edi
cmp esi, 1
jne 0x855259
push 0x103
lea eax, [ebp - 0x32f]
push 0
push eax
mov byte [ebp - 0x330], 0
call fcn.00a7ffb0
add esp, 0xc
mov ecx, str.X_Nimbus_UUID:
lea edx, [ebp - 0x748]
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x855120
lea eax, [ebp - 0x748]
cmp word [eax], 0
je 0x855142
add eax, 2
jmp 0x855137
xor ecx, ecx
mov word [eax], cx
mov edx, 0xbe5020
lea esp, [esp]
mov cl, byte [edx]
test cl, cl
je 0x855163
movzx cx, cl
mov word [eax], cx
add eax, 2
inc edx
jmp 0x855150
mov ecx, dword [ebx + 0x46c]
push 0x20000000
xor edx, edx
mov word [eax], dx
push 0xffffffffffffffff
lea eax, [ebp - 0x748]
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
push str.NCId
lea eax, [ebp - 0x11a8]
lea edi, [ebp - 0x330]
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov dword [ebp - 0x11a8], 0x104
call fcn.0094c020
mov ecx, str.X_Nimbus_ClientID:
lea edx, [ebp - 0x748]
jmp 0x8551c0
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x8551c0
cmp byte [ebp - 0x330], al
jne 0x8551fe
lea edi, [ebp - 0x748]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x8551e2
mov ecx, 0x12
mov esi, str.45403B8E_207A_45CF_AF7F_1050D4AAE746
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x855238
lea ecx, [ebp - 0x748]
cmp word [ecx], 0
je 0x85520f
add ecx, 2
jmp 0x855204
xor edx, edx
mov word [ecx], dx
lea edx, [ebp - 0x330]
lea ebx, [ebx]
mov al, byte [edx]
test al, al
je 0x855233
movzx ax, al
mov word [ecx], ax
add ecx, 2
inc edx
jmp 0x855220
xor edx, edx
mov word [ecx], dx
mov ecx, dword [ebx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
lea eax, [ebp - 0x748]
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
mov edx, 0x1bb
cmp word [ebp - 0x1204], dx
jne 0x855421
test byte [0xc0ed58], 1
mov dword [ebp - 0x119c], 0
jne 0x85528f
or dword [0xc0ed58], 1
call fcn.00968b30
mov dword [0xc0ed54], eax
mov ecx, dword [ebx + 0x46c]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
push 4
lea eax, [ebp - 0x119c]
push eax
push 0x1f
push ecx
mov dword [ebp - 0x119c], 0x3300
call esi
test eax, eax
jne 0x8552dd
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov edi, dword [ebp - 0x116c]
push eax
add edi, 0x47c
push str.WINHTTP_OPTION_SECURITY_FLAGS_Set_Error__LastErr:_d_
mov edx, edi
call fcn.00853e40
add esp, 8
jmp 0x8552fe
mov edi, dword [ebp - 0x116c]
add edi, 0x47c
push str.WINHTTP_OPTION_SECURITY_FLAGS_Successfully_Set
mov edx, edi
call fcn.00853e40
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
cmp dword [0xb53f4c], 0
je 0x855317
push edi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
cmp dword [0xc0ed54], 0
jne 0x855387
mov eax, dword [ebp - 0x1180]
test eax, eax
je 0x855387
cmp byte [eax], 0
je 0x855387
push 0
push str.abusedb
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x855387
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x464]
push 4
lea edx, [ebp - 0x11a0]
push edx
push 0x54
push ecx
mov dword [ebp - 0x11a0], 0x20
call esi
test eax, eax
jne 0x855380
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Set_Error__LastErr:_d_
mov edx, edi
call fcn.00853e40
add esp, 8
jmp 0x8553d2
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_A__Successfully_Set__WINHTTP_FLAG_SECURE_PROTOCOL_SSL3_
jmp 0x8553c8
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x464]
push 4
lea edx, [ebp - 0x118c]
push edx
push 0x54
push ecx
mov dword [ebp - 0x118c], 0xa80
call esi
test eax, eax
jne 0x8553c3
call ebx
push eax
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Set_Error__LastErr:_d_
mov edx, edi
call fcn.00853e40
add esp, 8
jmp 0x8553d2
push str.WINHTTP_OPTION_SECURE_PROTOCOLS_B__Successfully_Set__TLS1__TLS1_1__TLS1_2_
mov edx, edi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x8553eb
push edi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push 0
push 0
push 0x2f
push eax
call esi
test eax, eax
jne 0x855406
call ebx
push 0xaa91cc
mov edx, edi
call fcn.00853e40
mov ebx, dword [ebp - 0x116c]
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
add esp, 4
mov eax, dword [ebp - 0x117c]
test eax, eax
je 0x855964
cmp byte [eax], 0
je 0x855964
mov ecx, dword [ebp - 0x117c]
mov eax, str.ThisIsDataStream_
call fcn.0094c3e0
test eax, eax
je 0x855738
push 0x103
lea ecx, [ebp - 0x227]
push 0
push ecx
mov byte [ebp - 0x228], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x53f]
push 0
push edx
mov byte [ebp - 0x540], 0
call fcn.00a7ffb0
lea esi, [ebx + 0x47c]
add esp, 0xc
push 0xaa9204
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x8554be
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [ebx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_multipart_form_data__boundary____________ThIs_Is_tHe_bouNdaRY__
push eax
call edi
test eax, eax
je 0x855a0a
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0xa0000000
push 0xffffffffffffffff
push str.User_Agent:_VirusTotal_Uploader_2.0
push edx
call edi
test eax, eax
je 0x855a0a
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x46c]
push 0xa0000000
push 0xffffffffffffffff
push str.Cache_Control:_no_cache
push ecx
call edi
test eax, eax
je 0x855a0a
mov esi, dword [ebp - 0x1170]
push str.IsFilePresent__
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x85554f
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov edi, dword [ebp - 0x117c]
push 1
push 0
xor edx, edx
mov ecx, edi
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x855729
mov eax, dword [ebp - 0x1194]
test eax, eax
je 0x85558c
cmp byte [eax], 0
je 0x85558c
push eax
lea edx, [ebp - 0x228]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x85559d
lea eax, [ebp - 0x228]
push eax
mov ecx, edi
call fcn.0095af90
add esp, 4
push str.ReadFromFile__
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x8555c5
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
lea ecx, [ebp - 0x1184]
mov edx, edi
call fcn.00978190
mov edi, eax
mov dword [ebp - 0x1180], edi
test edi, edi
jbe 0x855a0a
cmp dword [ebp - 0x1184], 0
je 0x855a0a
cmp dword [ebp + 0x18], 0
je 0x855600
mov eax, dword [ebp - 0x116c]
call fcn.00857600
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x540]
push str.______________ThIs_Is_tHe_bouNdaRY___r_nContent_Disposition:_form_data_name_archivo__filename__s__r_nContent_Type:_application_x_msdownload_r_n_r_n
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x540]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
lea eax, [esi + edi + 0x2a]
lea edi, [eax + 1]
push edi
mov dword [ebp - 0x118c], eax
call fcn.00a77370
mov ecx, dword [ebp - 0x116c]
add esp, 4
mov dword [ecx + 0x880], eax
test eax, eax
je 0x855a0a
push edi
push 0
push eax
call fcn.00a7ffb0
mov ebx, dword [ebp - 0x116c]
mov eax, dword [ebx + 0x880]
add esp, 0xc
push esi
lea edx, [ebp - 0x540]
push edx
push eax
call fcn.00a828e0
mov ecx, dword [ebp - 0x1180]
mov edx, dword [ebp - 0x1184]
mov eax, dword [ebx + 0x880]
add esp, 0xc
push ecx
push edx
add eax, esi
push eax
call fcn.00a828e0
mov edi, dword [ebx + 0x880]
add edi, esi
add edi, dword [ebp - 0x1180]
mov ecx, 0xa
mov esi, str._r_n______________ThIs_Is_tHe_bouNdaRY_____r_n
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0x1170]
add esp, 0xc
push str.WinHttpSendRequest_POST_
mov edx, esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x8556e6
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [ebp - 0x118c]
mov ecx, dword [ebx + 0x880]
mov edx, dword [ebx + 0x46c]
push ebx
push eax
push eax
push ecx
push 0
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x855a0a
mov eax, dword [ebp - 0x1170]
push eax
mov ecx, ebx
push 0xaa8700
add ecx, 0x350
push ecx
jmp 0x8559fb
mov dword [ebp - 0x1190], 1
jmp 0x855a0a
lea esi, [ebx + 0x47c]
push str.WinHttpAddRequestHeadersData
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x85576c
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov ebx, dword [ebp - 0x1194]
mov eax, str.analyticdata:
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x85582a
mov eax, str.fname
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
je 0x85582a
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept:__
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x855a0a
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Accept_Encoding:_gzip_deflate
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x855a0a
cmp dword [ebp + 0x24], 2
push 0x20000000
push 0xffffffffffffffff
jne 0x855809
mov eax, dword [ebp - 0x116c]
mov ecx, dword [eax + 0x46c]
push str.Content_Type:_application_json
push ecx
jmp 0x855866
mov edx, dword [ebp - 0x116c]
mov eax, dword [edx + 0x46c]
push str.Content_Type:_application_octet_stream
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x855874
jmp 0x855a0a
mov eax, str.fname
mov ecx, ebx
call fcn.0094c3e0
test eax, eax
jne 0x85584d
push 0xaa1543
push str.fname
push ebx
call fcn.0095e130
add esp, 0xc
mov ecx, dword [ebp - 0x116c]
mov edx, dword [ecx + 0x46c]
push 0x20000000
push 0xffffffffffffffff
push str.Content_Type:_text_plain
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
je 0x855a0a
mov eax, dword [ebp - 0x117c]
add eax, 0x11
push eax
call fcn.00a79090
mov edi, eax
add esp, 4
test edi, edi
jbe 0x855a0a
test ebx, ebx
je 0x855a0a
cmp dword [ebp + 0x18], 0
je 0x8558a9
mov eax, dword [ebp - 0x116c]
call fcn.00857600
lea esi, [edi + 1]
push esi
call fcn.00a77370
mov ecx, dword [ebp - 0x116c]
add esp, 4
mov dword [ecx + 0x880], eax
test eax, eax
je 0x855a0a
push esi
push 0
push eax
call fcn.00a7ffb0
mov esi, dword [ebp - 0x116c]
mov edx, dword [esi + 0x880]
add esp, 0xc
push edi
push ebx
push edx
call fcn.00a828e0
mov ebx, dword [ebp - 0x1170]
add esp, 0xc
push str.WinHttpSendRequest_POSTDATA_
mov edx, ebx
call fcn.00853e40
add esp, 4
cmp dword [0xb53f4c], 0
je 0x85591a
push ebx
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov eax, dword [esi + 0x880]
mov ecx, dword [esi + 0x46c]
push esi
push edi
push edi
push eax
push 0
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x855a0a
mov edx, dword [ebp - 0x1170]
push edx
mov eax, esi
add eax, 0x350
push 0xaa8700
push eax
call fcn.0096a780
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x855a03
cmp dword [ebp + 0x2c], 0
jne 0x855984
lea esi, [ebx + 0x47c]
push str.WinHttpSendRequest_GET_
mov edx, esi
mov dword [ebp - 0x1170], esi
call fcn.00853e40
jmp 0x8559a0
lea edx, [ebx + 0x47c]
push str.WinHttpSendRequest_HEAD_
mov dword [ebp - 0x1170], edx
call fcn.00853e40
mov esi, dword [ebp - 0x1170]
add esp, 4
cmp dword [0xb53f4c], 0
je 0x8559bc
push esi
push 0xaa8700
push 0
call fcn.0096a780
add esp, 0xc
mov ecx, dword [ebx + 0x46c]
push ebx
push 0
push 0
push 0
push 0
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x855a0a
push 0xb53f5c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov edx, dword [ebp - 0x1170]
mov eax, dword [ebp - 0x116c]
push edx
push 0xaa8700
add eax, 0x350
push eax
call fcn.0096a780
add esp, 0xc
mov byte [ebp - 0x1171], 1
mov esi, dword [ebp - 0x1170]
mov edi, dword [ebp - 0x116c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1178], eax
mov eax, dword [ebp - 0x1184]
test eax, eax
je 0x855a35
push eax
call fcn.00a78fec
add esp, 4
cmp byte [ebp - 0x1171], 0
jne 0x855b38
mov ecx, dword [ebp - 0x1178]
lea ebx, [ebp - 0x1168]
call fcn.00853fe0
xor ebx, ebx
cmp dword [ebp - 0x1190], ebx
jne 0x855a6c
lea ecx, [ebp - 0x1168]
push ecx
push esi
push str._s_failed___s
jmp 0x855a79
mov edx, dword [ebp - 0x1178]
push edx
push esi
push str._s_failed__File_Absent___u_
lea edx, [ebp - 0x950]
call fcn.00853e40
add esp, 0xc
xor eax, eax
mov word [ebp - 0x11c0], ax
lea eax, [ebp - 0x950]
mov dword [ebp - 0x11ac], 7
mov dword [ebp - 0x11b0], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x855ab0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x950]
lea esi, [ebp - 0x11c4]
call fcn.0085d720
push 0xffffffffffffffff
mov byte [ebp - 4], 2
push ebx
lea ecx, [edi + 0x230]
mov eax, esi
mov dword [edi + 0x22c], 1
call fcn.0085d4c0
mov ecx, dword [ebp - 0x1178]
mov byte [ebp - 4], bl
cmp dword [ebp - 0x11ac], 8
mov dword [edi + 0x228], ecx
jb 0x855b16
mov edx, dword [ebp - 0x11c0]
push edx
call fcn.00a7a9b9
add esp, 4
xor eax, eax
push 2
mov ecx, edi
mov dword [ebp - 0x11ac], 7
mov dword [ebp - 0x11b0], ebx
mov word [ebp - 0x11c0], ax
call fcn.00855fa0
mov al, byte [ebp - 0x1171]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret 0x28