Function at 0x494590
Capabilities:
Delete file
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e007d
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x50b0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x30], edi
mov eax, dword [ebp + 8]
lea esi, [edi + 0x14]
push esi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x18], ebx
push eax
lea ecx, [edi + 0x2c]
call fcn.004090e0
mov eax, dword [ebp - 0x50]
cmp byte [eax + 0xd], bl
jne 0x494af1
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x10]
jb 0x494af1
cmp eax, dword [edi + 0x2c]
je 0x494605
mov ebx, dword [eax + 0x14]
mov dword [ebp - 0x18], ebx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
je 0x494af8
cmp dword [ebx], 5
lea edi, [ebx + 0xc]
jne 0x494628
cmp dword [edi], 0
je 0x494628
mov esi, 1
jmp 0x49462a
xor esi, esi
push 8
mov dword [ebx], 3
call fcn.004a6623
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], edx
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x2c], eax
test esi, esi
je 0x494849
cmp dword [eax - 0xc], 0
mov ecx, dword [edi]
mov esi, dword [ebx + 4]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x4c], esi
je 0x494682
sub esp, 8
push edx
push ecx
mov edx, ecx
mov ecx, esi
push eax
call fcn.0048e090
add esp, 0x14
mov edi, eax
jmp 0x494aa3
add ebx, 0x18
test ecx, ecx
je 0x494822
push 0x4e3e9e
push 0x100
call fcn.004a6a9f
add esp, 8
mov dword [ebp - 0x58], vtable.CxAutoArray_unsigned_char_.0
mov dword [ebp - 0x54], 0
test eax, eax
je 0x4946bb
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 0
mov dword [ebp - 4], 0
test ebx, ebx
je 0x4946cd
mov esi, dword [ebx + 4]
sub esi, dword [ebx]
jmp 0x4946cf
xor esi, esi
mov ecx, dword [ebp - 0x1c]
xor edi, edi
call fcn.00493290
mov ecx, edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], ecx
test ecx, ecx
jne 0x4946e9
test eax, eax
je 0x4946f5
test ebx, ebx
je 0x4946f5
push eax
mov ecx, ebx
call fcn.0047e690
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
mov eax, dword [ebp - 0x1c]
push 0x100
push dword [ebp - 0x54]
mov eax, dword [eax + 0x10]
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x494812
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], edi
test ecx, ecx
je 0x49482c
test ebx, ebx
je 0x4947be
mov edx, dword [ebx + 4]
mov eax, dword [ebx]
mov dword [ebp - 0x28], edx
sub dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x24], ecx
add dword [ebp - 0x24], esi
mov dword [ebp - 0x2c], edx
adc eax, edi
test eax, eax
jb 0x49479e
ja 0x49475f
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jbe 0x49479e
mov eax, dword [ebx]
lea edi, [esi + ecx]
sub edx, eax
cmp edi, edx
jb 0x494799
jbe 0x49479e
mov eax, dword [ebx + 8]
sub eax, dword [ebx]
cmp edi, eax
jbe 0x494783
push ecx
push edi
mov ecx, ebx
call fcn.0047eb30
mov ecx, dword [ebp - 0x14]
jmp 0x49479e
sub edi, edx
push edi
push 0
push dword [ebp - 0x2c]
call fcn.004a8730
mov eax, dword [ebp - 0x2c]
add esp, 0xc
mov ecx, dword [ebp - 0x14]
add eax, edi
mov dword [ebx + 4], eax
mov eax, dword [ebx]
push ecx
push dword [ebp - 0x54]
add eax, esi
push eax
call fcn.004a81b0
mov ecx, dword [ebp - 0x14]
add esp, 0xc
mov esi, ecx
xor edi, edi
add esi, dword [ebp - 0x34]
adc edi, dword [ebp - 0x38]
jmp 0x4947c3
add esi, ecx
adc edi, 0
push ecx
push edi
push esi
push dword [ebp - 0x3c]
push dword [ebp - 0x44]
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x4c]
call fcn.00494e70
add esp, 0x24
test eax, eax
je 0x494812
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
mov eax, dword [ebp - 0x1c]
push 0x100
push dword [ebp - 0x54]
mov eax, dword [eax + 0x10]
push dword [eax]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
jne 0x494720
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x494822
push eax
call fcn.004a6aa8
add esp, 4
mov ebx, dword [ebp - 0x18]
xor edi, edi
jmp 0x494aa3
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x49483c
push eax
call fcn.004a6aa8
add esp, 4
mov ebx, dword [ebp - 0x18]
mov edi, 1
jmp 0x494aa3
cmp dword [eax - 0xc], 0
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x28], ecx
je 0x4949ac
test ecx, ecx
je 0x494aa1
test eax, eax
je 0x494aa1
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea edx, [ebp - 0x40]
mov dword [ebp - 4], 1
call fcn.0048ddc0
test eax, eax
je 0x4949a4
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4949a4
push 0x13
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.00493110
mov esi, dword [ebp - 0x4c]
push esi
call fcn.004bba25
mov edx, eax
add esp, 4
lea eax, [esi - 0x10]
mov dword [ebp - 0x44], edx
or esi, 0xffffffff
mov dword [ebp - 0x4c], eax
mov ecx, esi
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4948d9
mov ecx, dword [eax]
push dword [ebp - 0x4c]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
lea eax, [edx - 0x12c]
cmp eax, 0x64
jb 0x494913
lea eax, [edx - 0x190]
cmp eax, 0x64
jae 0x4948ff
mov edi, dword [ebp - 0x3c]
test edi, edi
je 0x494aa1
jmp 0x494a83
lea eax, [edx - 0x1f4]
cmp eax, 0x64
jb 0x4948ef
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test edi, edi
je 0x494955
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x494922
lock inc dword [ecx + 4]
mov eax, dword [ebp - 0x40]
mov dword [edi], eax
mov eax, dword [edi + 4]
mov dword [edi + 4], ecx
mov edi, eax
mov dword [ebp - 0x4c], eax
test edi, edi
je 0x494955
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x494955
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x494955
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edx, dword [ebp - 0x40]
sub esp, 8
push dword [ebp - 0x20]
push ecx
push dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
call fcn.0048e090
mov ecx, dword [ebp - 0x3c]
add esp, 0x14
mov edi, eax
test ecx, ecx
je 0x494aa3
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x494aa3
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x3c]
lock xadd dword [ecx + 8], esi
dec esi
jne 0x494aa3
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x494aa3
mov edi, dword [ebp - 0x3c]
jmp 0x494a7c
test ecx, ecx
je 0x494aa1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
lea edx, [ebp - 0x48]
mov dword [ebp - 4], 2
call fcn.0048ddc0
test eax, eax
je 0x494a79
mov edx, dword [ebp - 0x48]
test edx, edx
je 0x494a79
or esi, 0xffffffff
test edi, edi
je 0x494a29
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x4949f6
lock inc dword [ecx + 4]
mov eax, dword [edi + 4]
mov dword [edi], edx
mov dword [edi + 4], ecx
mov edi, eax
mov dword [ebp - 0x4c], eax
test edi, edi
je 0x494a29
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x494a29
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x494a26
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
lea eax, [ebx + 0x18]
test eax, eax
je 0x494a3a
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x494a3a
mov dword [eax + 4], ecx
push 0xffffffffffffffff
push ecx
push dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
push fcn.00494e70
push eax
call fcn.0048de90
mov ecx, dword [ebp - 0x44]
add esp, 0x14
mov edi, eax
test ecx, ecx
je 0x494aa3
mov eax, esi
lock xadd dword [ecx + 4], eax
jne 0x494aa3
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [ebp - 0x44]
lock xadd dword [ecx + 8], esi
dec esi
jne 0x494aa3
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x494aa3
mov edi, dword [ebp - 0x44]
test edi, edi
je 0x494aa1
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x494aa1
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x494aa1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
xor edi, edi
push 8
push dword [ebp - 0x20]
call fcn.004a6653
add esp, 8
test edi, edi
jne 0x494ac1
cmp dword [ebx], 4
jne 0x494ac1
mov dword [ebx], 5
jmp 0x494ae1
push dword [ebp + 8]
mov eax, edi
neg eax
push edi
sbb eax, eax
add eax, 8
mov dword [ebx], eax
mov eax, dword [ebp - 0x30]
push 0x547
push dword [eax + 0x10]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebx + 0x2c]
test eax, eax
je 0x494af8
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x494af8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4