Function at 0x434904
Capabilities:
Delete file
Initialize winhttp library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4829f0
mov eax, dword fs:[0]
push eax
mov eax, 0x39b0
call fcn.00456930
mov eax, dword [0x4bf100]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3930], edx
mov dword [ebp - 0x38f8], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x39bc]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x3934], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3918], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x391c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3958], eax
lea eax, [ebp - 0x38fc]
push eax
push str.PerformRemoteHttpOp
mov dword [ebp - 0x38fc], 0x4b1
call fcn.0041e6cc
xor edx, edx
mov dword [ebp - 4], edx
lea edi, [ebp - 0x38f4]
mov eax, dword [0x4c2500]
mov ebx, edx
push 9
mov dword [ebp - 0x3938], eax
pop eax
mov ecx, eax
mov dword [ebp - 0x3948], eax
xor eax, eax
mov dword [ebp - 0x3928], edx
push 0x80
rep stosd dword es:[edi], eax
push edx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x3924], ebx
push eax
mov dword [ebp - 0x392c], edx
mov dword [ebp - 0x3900], edx
mov dword [ebp - 0x3908], edx
mov dword [ebp - 0x3944], 4
mov dword [ebp - 0x3940], edx
call fcn.00457e10
xor ecx, ecx
add esp, 0xc
mov byte [ebp - 0x390c], cl
lea ecx, [ebp - 0x3920]
call fcn.0040aaed
xor eax, eax
inc eax
mov byte [ebp - 4], al
lea ecx, [ebp - 0x3910]
call fcn.0040aaed
mov byte [ebp - 4], 2
xor eax, eax
push 6
pop ecx
lea edi, [ebp - 0x39b0]
mov dword [ebp - 0x3998], 0x3c
rep stosd dword es:[edi], eax
mov cl, byte [0x4c2504]
lea edi, [ebp - 0x3954]
stosd dword es:[edi], eax
xor edx, edx
mov dword [ebp - 0x3904], edx
mov dword [ebp - 0x398c], edx
mov edx, 0x400
mov dword [ebp - 0x393c], ecx
stosd dword es:[edi], eax
mov dword [ebp - 0x3990], 0x20
mov dword [ebp - 0x3978], edx
stosd dword es:[edi], eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0x3994], eax
mov edi, 0x800
lea eax, [ebp - 0x10d0]
mov dword [ebp - 0x3984], edi
mov dword [ebp - 0x3988], eax
xor eax, eax
mov word [ebp - 0x3980], ax
lea eax, [ebp - 0x18d0]
mov dword [ebp - 0x397c], eax
lea eax, [ebp - 0x30d0]
mov dword [ebp - 0x3968], edi
mov edi, dword [ebp - 0x38f8]
mov dword [ebp - 0x3974], eax
lea eax, [ebp - 0x28d0]
mov dword [ebp - 0x396c], eax
lea eax, [ebp - 0x38d0]
mov dword [ebp - 0x3970], edx
mov dword [ebp - 0x3964], eax
mov dword [ebp - 0x3960], edx
cmp edi, 5
je 0x434ae9
cmp edi, 6
jne 0x434b30
mov edx, dword [ebp - 0x3934]
test edx, edx
je 0x434b30
xor eax, eax
cmp word [edx], ax
je 0x434b30
cmp dword [ebp - 0x391c], eax
je 0x434b0a
cmp dword [ebp - 0x3918], eax
je 0x434b30
mov eax, dword [0x4c250c]
test esi, esi
cmove esi, eax
mov dword [ebp - 0x395c], esi
cmp esi, 4
jne 0x434be1
cmp byte [0x4c2510], 0
jne 0x434c17
mov dword [ebp - 0x38fc], 0x57
cmp dword [ebp - 0x3950], 0
mov esi, dword [sym.imp.KERNEL32.dll_GlobalFree]
je 0x434b51
push dword [ebp - 0x3950]
call esi
cmp dword [ebp - 0x394c], 0
je 0x434b62
push dword [ebp - 0x394c]
call esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
test ebx, ebx
je 0x434b6f
push ebx
call esi
mov eax, dword [ebp - 0x392c]
test eax, eax
je 0x434b7c
push eax
call esi
mov eax, dword [ebp - 0x3928]
test eax, eax
je 0x434b89
push eax
call esi
mov esi, dword [ebp - 0x38fc]
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x3910]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
xor eax, eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x3920]
add ecx, 0xfffffff0
call fcn.0040aacb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x39bc]
call fcn.0041e740
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455c9e
leave
ret
cmp esi, 5
jg 0x434b30
cmp esi, 3
jne 0x434c17
cmp eax, esi
je 0x434c17
call fcn.00435708
test eax, eax
je 0x434c0b
mov dword [ebp - 0x38fc], 0x32
jmp 0x434b3a
mov ecx, dword [ebp - 0x393c]
mov edx, dword [ebp - 0x3934]
test cl, cl
je 0x434c2c
xor eax, eax
movzx ecx, cl
cmp esi, 4
cmove ecx, eax
mov dword [ebp - 0x393c], ecx
cmp byte [ebp + 0x1c], 0
jne 0x434c3f
push edx
push str.PerformRemoteHttpOp:_Url:__s
call fcn.0041e1d8
pop ecx
pop ecx
mov eax, dword [ebp - 0x3918]
xor ecx, ecx
test eax, eax
je 0x434c62
cmp dword [ebp - 0x391c], ecx
jne 0x434c62
mov dword [ebp - 0x3904], eax
cmp word [eax], cx
je 0x434b30
cmp dword [0x4c2430], 0
jle 0x434c7a
mov dword [ebp - 0x38fc], 0x2e3
jmp 0x434b3a
cmp esi, 4
je 0x434ccf
cmp esi, 3
je 0x434ca6
push ecx
xor eax, eax
cmp esi, 1
push ecx
push ecx
setne al
push eax
push dword [0x4c2490]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
mov dword [ebp - 0x3928], edi
jmp 0x434d17
lea eax, [ebp - 0x10d0]
cmp edi, 5
jne 0x434cc7
push dword [0x4c2524]
push 0x800
push eax
call fcn.0046ce47
add esp, 0xc
jmp 0x434cf6
push dword [0x4c2528]
jmp 0x434cb7
movzx eax, word [0x4c2518]
push eax
push dword [0x4c2514]
lea eax, [ebp - 0x10d0]
push str._s:_hu
push 0x800
push eax
call fcn.0040a338
add esp, 0x14
xor eax, eax
push eax
push eax
lea eax, [ebp - 0x10d0]
push eax
push 3
push dword [0x4c2490]
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov edi, eax
mov dword [ebp - 0x3928], eax
test edi, edi
je 0x434b3a
cmp dword [0x4c2430], 0
jg 0x434c6b
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
lea eax, [ebp - 0x3938]
push 4
push eax
push 3
push edi
call esi
test eax, eax
je 0x434b3a
push 4
lea eax, [ebp - 0x3938]
push eax
push 7
push edi
call esi
test eax, eax
je 0x434b3a
push 4
lea eax, [ebp - 0x3938]
push eax
push 6
push edi
call esi
test eax, eax
je 0x434b3a
push 4
lea eax, [ebp - 0x3938]
push eax
push 5
push edi
call esi
test eax, eax
je 0x434b3a
mov eax, dword [ebp - 0x3904]
test eax, eax
je 0x434dba
lea ecx, [ebp - 0x38f4]
push ecx
xor ecx, ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x434db4
push 9
pop ecx
lea edi, [ebp - 0x38f4]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x3904]
cmp dword [ebp - 0x3930], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x434e3d
test eax, eax
je 0x434e3d
cmp dword [ebp - 0x38d4], 0
je 0x434dfb
push dword [ebp - 0x38d4]
lea eax, [ebp - 0x90]
push str.Range:_bytes_u__n
push 0x40
push eax
call fcn.0040a338
add esp, 0x10
mov byte [ebp - 0x390c], 1
jmp 0x434e3d
mov ebx, dword [ebp - 0x3904]
push 9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x434e31
cmp eax, 0x20
je 0x434e21
cmp eax, 5
jne 0x434e31
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x434e04
mov ebx, dword [ebp - 0x3924]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x3998]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0x3934]
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x434e67
mov dword [ebp - 0x38fc], 0xb
jmp 0x434b3a
cmp byte [ebp - 0x393c], 0
je 0x434fb9
mov esi, dword [sym.imp.DNSAPI.dll_DnsQuery_W]
lea eax, [ebp - 0x3900]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push 1
push dword [ebp - 0x3988]
call esi
test eax, eax
jne 0x434b3a
mov eax, dword [ebp - 0x3900]
test eax, eax
je 0x434b3a
xor ecx, ecx
inc ecx
cmp word [eax + 8], cx
je 0x434eba
mov eax, dword [eax]
test eax, eax
jne 0x434ea9
jmp 0x434b3a
mov eax, dword [eax + 0x18]
push ecx
push dword [ebp - 0x3900]
mov dword [ebp - 0x3924], eax
call dword [sym.imp.DNSAPI.dll_DnsFree]
mov eax, dword [ebp - 0x3924]
xor ecx, ecx
mov dword [ebp - 0x3900], ecx
cmp al, 0x7f
je 0x434f12
cmp al, 0xa9
jne 0x434eeb
cmp ah, 0xfe
jmp 0x434f0c
cmp al, 0xa
je 0x434f12
cmp al, 0xac
jne 0x434f01
mov al, ah
sub al, 0x10
cmp al, 0xf
ja 0x434fb9
jmp 0x434f12
cmp al, 0xc0
jne 0x434fb9
cmp ah, 0xa8
jne 0x434fb9
push ecx
lea eax, [ebp - 0x3900]
push eax
push ecx
xor eax, eax
push 0x48
inc eax
push eax
lea eax, [ebp - 0x10d0]
push eax
call esi
test eax, eax
jne 0x434fb9
mov esi, dword [ebp - 0x3900]
test esi, esi
je 0x434fb9
inc eax
cmp word [esi + 8], ax
je 0x434f4b
mov esi, dword [esi]
test esi, esi
jne 0x434f3d
jmp 0x434fb9
push str.Host:
lea ecx, [ebp - 0x3910]
call fcn.0040a676
lea eax, [ebp - 0x10d0]
push eax
lea ecx, [ebp - 0x3910]
call fcn.0041cdf8
push 0x4ac914
lea ecx, [ebp - 0x3910]
call fcn.0041cdf8
mov esi, dword [esi + 0x18]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x3900]
call dword [sym.imp.DNSAPI.dll_DnsFree]
xor eax, eax
push esi
mov dword [ebp - 0x3900], eax
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
push 0x4afd98
lea eax, [ebp - 0x10d0]
push 0x800
push eax
call fcn.0040a338
add esp, 0x10
mov eax, dword [ebp - 0x3958]
test eax, eax
je 0x434fcf
push eax
lea ecx, [ebp - 0x3910]
call fcn.0041cdf8
mov eax, dword [ebp - 0x398c]
sub eax, 1
je 0x434fdf
sub eax, 1
jne 0x435005
cmp word [ebp - 0x3980], 0
jne 0x435005
xor eax, eax
inc eax
cmp dword [ebp - 0x398c], eax
jne 0x434ff9
push 0x50
pop eax
jmp 0x434ffe
mov eax, 0x1bb
mov word [ebp - 0x3980], ax
mov esi, dword [ebp - 0x3928]
xor eax, eax
push eax
push dword [ebp - 0x3980]
lea eax, [ebp - 0x10d0]
push eax
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [ebp - 0x392c], eax
test eax, eax
jne 0x43505a
call edi
cmp byte [ebp + 0x1c], 0
jne 0x434b3a
push eax
movzx eax, word [ebp - 0x3980]
push eax
lea eax, [ebp - 0x10d0]
push eax
push str.WinHttpConnect_failed__s:_hu__error:__u
call fcn.0041e1d8
add esp, 0x10
jmp 0x434b3a
lea eax, [ebp - 0x28d0]
push eax
lea ecx, [ebp - 0x3920]
call fcn.0040a676
lea eax, [ebp - 0x38d0]
push eax
lea ecx, [ebp - 0x3920]
call fcn.0041cdf8
cmp dword [ebp - 0x398c], 2
mov dword [ebp - 0x3914], 0x100
jne 0x43509b
mov dword [ebp - 0x3914], 0x800100
lea ecx, [ebp - 0x38f8]
call fcn.0040aaed
mov byte [ebp - 4], 3
cmp dword [ebp - 0x3930], 0
jne 0x4350ba
mov eax, str.POST
jmp 0x4350ce
cmp dword [ebp - 0x3918], 0
mov eax, 0x4afdfc
mov ecx, str.HEAD
cmove eax, ecx
push eax
lea ecx, [ebp - 0x38f8]
call fcn.0040a676
push dword [ebp - 0x3914]
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x3920]
push dword [ebp - 0x38f8]
push dword [ebp - 0x392c]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ebx, eax
mov dword [ebp - 0x3924], ebx
test ebx, ebx
jne 0x435147
call edi
cmp byte [ebp + 0x1c], bl
jne 0x435130
push eax
push dword [ebp - 0x3914]
push dword [ebp - 0x3920]
push dword [ebp - 0x38f8]
push str.WinHttpOpenRequest_verb:_s_path:_s_flags:0x_08X_failed__error:__u
call fcn.0041e1d8
add esp, 0x14
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x38f8]
lea ecx, [ecx - 0x10]
call fcn.0040aacb
jmp 0x434b3a
cmp dword [ebp - 0x395c], 5
jne 0x4351a0
xor eax, eax
mov dword [ebp - 0x39ac], 3
inc eax
mov dword [ebp - 0x39b0], eax
mov dword [ebp - 0x399c], eax
lea eax, [ebp - 0x3954]
push eax
lea eax, [ebp - 0x39b0]
push eax
push dword [ebp - 0x3934]
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
test eax, eax
je 0x4351a0
push 0xc
lea eax, [ebp - 0x3954]
push eax
push 0x26
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x4351a0
jmp 0x435130
cmp word [ebp - 0x18d0], 0
je 0x4351d0
xor ecx, ecx
lea eax, [ebp - 0x30d0]
push ecx
push eax
lea eax, [ebp - 0x18d0]
push eax
xor eax, eax
inc eax
push eax
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
test eax, eax
jne 0x4351d0
jmp 0x435130
cmp byte [0x4c251a], 0
je 0x43521b
mov eax, dword [0x4c251c]
mov esi, dword [ebp - 0x392c]
push dword [eax - 0xc]
push eax
push 0x1002
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x4351fd
jmp 0x435130
mov eax, dword [0x4c2520]
push dword [eax - 0xc]
push eax
push 0x1003
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x43521b
jmp 0x435130
cmp dword [ebp - 0x398c], 2
jne 0x435249
push 4
lea eax, [ebp - 0x3914]
mov dword [ebp - 0x3914], 0x3000
push eax
push 0x1f
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x435249
jmp 0x435130
mov eax, dword [ebp - 0x3910]
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
cmp dword [eax - 0xc], 0
je 0x43526f
push 0x10000000
push 0xffffffffffffffff
push eax
push ebx
call esi
test eax, eax
jne 0x43526f
jmp 0x435130
cmp dword [ebp - 0x3930], 0
jne 0x4352b9
mov esi, dword [ebp - 0x391c]
test esi, esi
je 0x435286
mov eax, dword [esi]
jmp 0x43528c
mov eax, dword [ebp - 0x38d4]
xor ecx, ecx
push ecx
push eax
push ecx
push ecx
push ecx
push ecx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x435318
call edi
cmp byte [ebp + 0x1c], 0
jne 0x4352b4
push eax
push str.Upload_WinHttpSendRequest_failed__error:__u
call fcn.0041e1d8
pop ecx
pop ecx
jmp 0x435130
cmp byte [ebp - 0x390c], 0
je 0x4352dc
push 0x10000000
push 0xffffffffffffffff
lea eax, [ebp - 0x90]
push eax
push ebx
call esi
test eax, eax
jne 0x4352dc
jmp 0x435130
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x435312
call edi
cmp byte [ebp + 0x1c], 0
jne 0x43530d
push eax
movzx eax, byte [ebp - 0x390c]
push eax
push str.Download_WinHttpSendRequest_continue:_u_failed__error:__u
call fcn.0041e1d8
add esp, 0xc
jmp 0x435130
mov esi, dword [ebp - 0x391c]
cmp dword [0x4c2430], 0
jle 0x435330
mov dword [ebp - 0x38fc], 0x2e3
jmp 0x435130
cmp dword [ebp - 0x3930], 0
jne 0x43540f
mov eax, dword [ebp - 0x3918]
test eax, eax
je 0x43537b
push dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
mov edx, eax
mov ecx, ebx
push esi
call fcn.0041d399
mov dword [ebp - 0x38fc], eax
pop ecx
pop ecx
test eax, eax
je 0x43537b
cmp byte [ebp + 0x1c], 0
jne 0x435376
push eax
push str.Upload_CopyFileOrBufferToResource_failed__error:__u
call fcn.0041e1d8
pop ecx
pop ecx
jmp 0x435130
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x43538e
jmp 0x435130
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x3944]
push eax
lea eax, [ebp - 0x3908]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x4353bb
jmp 0x435130
mov eax, dword [ebp - 0x3908]
cmp eax, 0xc8
je 0x4353e5
cmp eax, 0xc9
je 0x4353e5
cmp eax, 0xcc
je 0x435402
mov dword [ebp - 0x38fc], 9
jmp 0x435130
cmp eax, 0xcc
je 0x435402
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, ebx
call fcn.0041d585
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x38fc], eax
jmp 0x435130
xor eax, eax
push eax
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x435422
jmp 0x435130
lea eax, [ebp - 0x3940]
push eax
lea eax, [ebp - 0x3944]
push eax
lea eax, [ebp - 0x3908]
push eax
xor eax, eax
push eax
push 0x20000013
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x435464
call edi
cmp byte [ebp + 0x1c], 0
jne 0x43545f
push eax
push str.HTTP_status_WinHttpQueryHeaders_failed__error:__u
call fcn.0041e1d8
pop ecx
pop ecx
jmp 0x435130
cmp dword [ebp - 0x3908], 0xce
je 0x4354eb
cmp dword [ebp - 0x3908], 0xc8
je 0x435499
cmp byte [ebp + 0x1c], 0
jne 0x435494
push dword [ebp - 0x3908]
push str.Wrong_HTTP_status_code_returned__status:__u
call fcn.0041e1d8
pop ecx
pop ecx
jmp 0x435130
cmp byte [ebp - 0x390c], 0
je 0x4354eb
xor eax, eax
mov byte [ebp - 0x390c], al
cmp dword [ebp - 0x3904], eax
je 0x4354eb
mov ebx, dword [ebp - 0x3904]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call edi
test esi, esi
jne 0x4354e5
cmp eax, 0x20
je 0x4354d1
cmp eax, 5
jne 0x4354e5
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub dword [ebp - 0x3948], 1
jns 0x4354b8
mov ebx, dword [ebp - 0x3924]
mov eax, dword [ebp - 0x3918]
test eax, eax
je 0x435402
push dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov edx, eax
mov ecx, ebx
push dword [ebp - 0x390c]
push dword [ebp - 0x391c]
call fcn.0041d585
add esp, 0xc
mov dword [ebp - 0x38fc], eax
test eax, eax
je 0x435402
cmp byte [ebp + 0x1c], 0
jne 0x435538
push eax
push str.Download_CopyFileOrBufferToResource_failed__error:__u
call fcn.0041e1d8
pop ecx
pop ecx
jmp 0x435130