Function at 0x424431
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x938
mov eax, 0x5094e1
call fcn.004e25f2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x91c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x924], eax
mov eax, dword [ebp + 0x18]
mov esi, ecx
mov dword [ebp - 0x930], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x918]
push str.wininet:_Initializing_block_download:
push eax
call fcn.004040f8
mov byte [ebp - 4], 1
add esp, 8
mov ecx, esp
mov dword [ebp - 0x920], esp
push 0x52440c
push eax
push ecx
call fcn.00404094
add esp, 0xc
mov byte [ebp - 4], 2
push 4
mov byte [ebp - 4], 1
call fcn.00412200
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x918]
call fcn.00401898
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jne 0x424513
push 1
push 0x95
push ecx
mov ecx, esp
mov dword [ebp - 0x91c], esp
push str.CCoreWininet::InitBlockDownload
call fcn.00401769
mov byte [ebp - 4], 3
push ecx
mov ecx, esp
mov dword [ebp - 0x924], esp
push str.url_is_empty_
call fcn.00401769
mov byte [ebp - 4], 4
mov eax, dword [esi]
add eax, 0x10
push 0x57
mov byte [ebp - 4], bl
mov ecx, esi
call dword [eax]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
xor eax, eax
call fcn.004e2675
ret 0x14
cmp dword [ebp + 0xc], ebx
jne 0x42454f
push 1
push 0x9b
push ecx
mov ecx, esp
mov dword [ebp - 0x91c], esp
push str.CCoreWininet::InitBlockDownload
call fcn.00401769
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x924], esp
push str.threadCount_is_0_
call fcn.00401769
mov byte [ebp - 4], 6
jmp 0x4244ef
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x48], ebx
lea ecx, [esi + 0x3c]
mov dword [esi + 0x74], ebx
mov dword [esi + 0x38], 0xc8
call fcn.0040154d
call fcn.0042561a
test eax, eax
je 0x4244fd
push str.https:__
lea ecx, [ebp + 8]
mov dword [ebp - 0x918], ebx
call fcn.00403fee
test eax, eax
jl 0x42459b
mov dword [ebp - 0x918], 1
push ebx
push ebx
push 0x800
lea eax, [ebp - 0x914]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push eax
push ebx
lea ecx, [ebp + 8]
call fcn.00401673
push eax
call fcn.00426bdd
add esp, 0x18
lea eax, [ebp - 0x114]
mov ecx, esp
mov dword [ebp - 0x92c], esp
push eax
call fcn.00401769
mov byte [ebp - 4], 7
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x918]
call fcn.00425780
cmp eax, ebx
je 0x4244fd
lea eax, [ebp - 0x944]
push eax
call fcn.0041276e
mov byte [ebp - 4], 8
push dword [esi + 0x48]
lea ecx, [ebp - 0x920]
push ecx
mov ecx, eax
call fcn.00412b27
mov edi, eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x914]
push eax
lea ecx, [ebp - 0x928]
call fcn.00401769
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x934]
push str.wininet:_sending_GET
push eax
call fcn.004040f8
add esp, 0xc
mov byte [ebp - 4], 0xb
push str.__resume
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.00404094
add esp, 0xc
mov byte [ebp - 4], 0xc
push edi
push eax
lea eax, [ebp - 0x93c]
push eax
call fcn.0040403d
mov byte [ebp - 4], 0xd
add esp, 8
mov ecx, esp
mov dword [ebp - 0x92c], esp
push 0x522b18
push eax
push ecx
call fcn.00404094
add esp, 0xc
mov byte [ebp - 4], 0xe
push 8
mov byte [ebp - 4], 0xd
call fcn.00412200
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x93c]
call fcn.00401898
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x938]
call fcn.00401898
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x934]
call fcn.00401898
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x928]
call fcn.00401898
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x920]
call fcn.00401898
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x944]
call fcn.004128bf
xor edi, edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x30]
push ebx
push ecx
push ecx
mov eax, esp
mov dword [ebp - 0x92c], esp
push 0x51d067
push eax
call fcn.004127b9
mov byte [ebp - 4], 0xf
push dword [ebp - 0x918]
lea eax, [ebp - 0x914]
push ecx
mov ecx, esp
mov dword [ebp - 0x920], esp
push eax
call fcn.00401769
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x928], esp
push 0x524e2c
call fcn.00401769
mov byte [ebp - 4], 0x11
mov byte [ebp - 4], bl
mov ecx, esi
call fcn.004258a8
cmp eax, ebx
jne 0x42477d
inc edi
cmp edi, 2
jl 0x4246fa
call fcn.00423ede
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401898
mov eax, ebx
jmp 0x42450b
call fcn.00426448
push dword [ebp + 0xc]
mov edi, dword [ebp - 0x924]
push dword [esi + 0x68]
mov ebx, dword [ebp - 0x91c]
push esi
mov esi, dword [ebp - 0x930]
call fcn.004247a5
xor ebx, ebx
inc ebx
jmp 0x42476a