Function at 0x4011b0
Capabilities:
Capture public ip
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402928
mov eax, dword fs:[0]
push eax
mov eax, 0x1050
call fcn.004028d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x1014], eax
mov dword [ebp - 0x1014], eax
push 0
push 0
push 0
push 0
push str.IP_retriever
mov dword [ebp - 4], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x1054], eax
mov eax, 0x7fffffff
sub eax, ecx
mov dword [ebp - 0x1038], ecx
cmp eax, 0x17
jb 0x401568
cmp dword [ebp + 0x1c], 0xf
lea eax, [ebp + 8]
lea edx, [ecx + 0x17]
mov dword [ebp - 0x1024], 0
cmova eax, dword [ebp + 8]
lea edi, [ebp - 0x1034]
mov esi, 0xf
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1020], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1018], edx
movups xmmword [ebp - 0x1034], xmm0
cmp edx, esi
jbe 0x401301
mov esi, edx
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4012bb
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
push ecx
call fcn.00401b98
add esp, 4
test eax, eax
je 0x4014af
mov ecx, dword [ebp - 0x1038]
lea edi, [eax + 0x23]
mov edx, dword [ebp - 0x1018]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x4012fb
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x4012dc
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x40156d
jmp 0x401293
test eax, eax
je 0x4012f9
push eax
call fcn.00401b98
mov ecx, dword [ebp - 0x1038]
add esp, 4
mov edx, dword [ebp - 0x1018]
mov edi, eax
jmp 0x4012fb
xor edi, edi
mov dword [ebp - 0x1034], edi
movups xmm0, xmmword [str.http:__ip_api.com_line_]
mov dword [ebp - 0x1024], edx
mov dword [ebp - 0x1020], esi
movups xmmword [edi], xmm0
mov eax, dword [0x403218]
mov dword [edi + 0x10], eax
mov ax, word [0x40321c]
mov word [edi + 0x14], ax
mov al, byte [0x40321e]
push ecx
push dword [ebp - 0x101c]
mov byte [edi + 0x16], al
lea eax, [edi + 0x17]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1018]
add esp, 0xc
mov byte [edi + eax], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1020]
mov eax, edx
mov ecx, dword [ebp - 0x1024]
sub eax, ecx
push 0xf
cmp eax, 0xf
jb 0x40139e
cmp edx, 0xf
lea esi, [ebp - 0x1034]
lea eax, [ecx + 0xf]
cmova esi, dword [ebp - 0x1034]
add esi, ecx
mov dword [ebp - 0x1024], eax
push str._fields4218627
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov byte [esi + 0xf], 0
lea eax, [ebp - 0x1034]
jmp 0x4013b9
push ecx
mov byte [ebp - 0x101c], 0
lea ecx, [ebp - 0x1034]
push dword [ebp - 0x101c]
push 0xf
call fcn.00401a30
mov edi, dword [ebp - 0x1054]
xorps xmm0, xmm0
movups xmmword [ebp - 0x1050], xmm0
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0
movups xmm0, xmmword [eax]
push 0
push 0x80000000
movups xmmword [ebp - 0x1050], xmm0
push 0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x1040], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0x1050]
cmp dword [ebp - 0x103c], 0xf
push 0
cmova eax, dword [ebp - 0x1050]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ecx, dword [ebp - 0x103c]
mov esi, eax
cmp ecx, 0xf
jbe 0x401464
mov edx, dword [ebp - 0x1050]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40145a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4014af
push ecx
push edx
call fcn.00401bc8
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x1020]
mov dword [ebp - 0x1040], 0
mov dword [ebp - 0x103c], 0xf
mov byte [ebp - 0x1050], 0
cmp ecx, 0xf
jbe 0x4014bf
mov edx, dword [ebp - 0x1034]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4014b5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4014b5
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401bc8
add esp, 8
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1024], 0
push eax
push 0x1000
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1020], 0xf
push eax
push esi
mov byte [ebp - 0x1034], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp - 0x1014]
mov esi, dword [ebp - 0x1058]
lea eax, [ebp - 0x1010]
push eax
mov ecx, esi
call fcn.00401930
mov ecx, dword [ebp + 0x1c]
cmp ecx, 0xf
jbe 0x40154b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401541
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401541
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00401bc8
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401b8a
mov esp, ebp
pop ebp
ret
call fcn.004011a0
call fcn.00401100
int3