Function at 0x40a170
Capabilities:
Check for time delay via gettickcount
Create http request

Disassembly:
push ebp
lea ebp, [esp - 0x28c]
sub esp, 0x28c
push 0xffffffffffffffff
push 0x45da9a
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x48e0ec]
xor eax, ebp
mov dword [ebp + 0x288], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
push eax
push dword [0x495b6c]
push dword [0x495b68]
call fcn.00403610
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x40a664
lea eax, [ebp - 0x34]
push eax
call fcn.00406e70
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x40a202
lea ebx, [eax + 4]
jmp 0x40a664
push eax
lea ecx, [ebp + 0x30]
call fcn.00405730
cmp dword [ebp + 0x44], 0x10
lea ecx, [ebp + 0x30]
mov eax, dword [ebp + 0x40]
lea edx, [ebp - 0x15]
cmovae ecx, dword [ebp + 0x30]
add eax, ecx
mov byte [ebp - 4], 1
cmp dword [ebp + 0x44], 0x10
lea ecx, [ebp + 0x30]
push edx
cmovae ecx, dword [ebp + 0x30]
push eax
mov dword [ebp - 0x3c], ecx
push ecx
lea ecx, [ebp]
mov dword [ebp - 0x38], eax
call fcn.004051f0
mov esi, eax
cmp esi, 0x495b10
je 0x40a28b
mov eax, dword [0x495b24]
cmp eax, 8
jb 0x40a264
inc eax
mov ecx, 0x495b10
push eax
push dword [0x495b10]
call fcn.0040c2e0
xor eax, eax
mov dword [0x495b24], 7
push esi
mov ecx, 0x495b10
mov dword [0x495b20], 0
mov word [0x495b10], ax
call fcn.0040b090
mov eax, dword [ebp + 0x14]
cmp eax, 8
jb 0x40a2a0
inc eax
lea ecx, [ebp]
push eax
push dword [ebp]
call fcn.0040c2e0
xor eax, eax
mov dword [ebp + 0x14], 7
mov word [ebp], ax
mov byte [ebp - 4], al
mov eax, dword [ebp + 0x44]
mov dword [ebp + 0x10], 0
cmp eax, 0x10
jb 0x40a2cc
inc eax
lea ecx, [ebp + 0x30]
push eax
push dword [ebp + 0x30]
call fcn.0040c280
mov dword [ebp + 0x44], 0xf
mov dword [ebp + 0x40], 0
mov byte [ebp + 0x30], 0
call fcn.00407920
mov ebx, eax
push ebx
push 0x462514
call fcn.00403530
push ebx
call fcn.00403310
xorps xmm0, xmm0
add esp, 0xc
movlpd qword [0x48e040], xmm0
xor edi, edi
nop word [eax + eax]
push edi
lea eax, [ebp + 0x268]
push str.SpWebInst_d.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp + 0x268]
push eax
push ebx
call fcn.004046f0
mov esi, eax
mov dword [ebp - 0x1c], esi
push esi
mov byte [ebp - 4], 4
call fcn.00403e20
add esp, 0x18
test al, al
je 0x40a376
push esi
call fcn.00403d80
push esi
call fcn.00403e20
add esp, 8
test al, al
je 0x40a376
push esi
mov byte [ebp - 4], 0
call fcn.00442387
inc edi
add esp, 4
cmp edi, 0xa
jl 0x40a310
mov ebx, 0xd
jmp 0x40a664
push 0x104
lea eax, [ebp + 0x60]
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
je 0x40a656
push 0
push 0x80
push 2
push 0
push 1
push 0xc0000000
lea eax, [ebp + 0x60]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40a7f2
push edi
push dword [ebp - 0x14]
call fcn.00408070
add esp, 8
mov dword [ebp - 0x10], eax
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp - 0x10]
cmp edi, 0x34
jne 0x40a5c1
mov ebx, dword [ebp - 0x14]
mov dword [ebp + 0x2c], 0xf
mov dword [ebp + 0x28], 0
mov byte [ebp + 0x18], 0
cmp byte [ebx], 0
jne 0x40a3fe
xor ecx, ecx
jmp 0x40a40c
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a403
sub ecx, edx
push ecx
push ebx
lea ecx, [ebp + 0x18]
call fcn.0040bf90
lea eax, [ebp + 0x18]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp + 0x48]
push eax
call fcn.004062a0
add esp, 8
mov ecx, dword [ebp + 0x2c]
mov byte [ebp - 4], 7
cmp ecx, 0x10
jb 0x40a47d
mov eax, dword [ebp + 0x18]
inc ecx
cmp ecx, 0xffffffff
ja 0x40a68e
cmp ecx, 0x1000
jb 0x40a474
test al, 0x1f
jne 0x40a68e
mov ecx, dword [eax - 4]
cmp ecx, eax
jae 0x40a68e
sub eax, ecx
cmp eax, 4
jb 0x40a68e
cmp eax, 0x23
ja 0x40a68e
mov eax, ecx
push eax
call fcn.00423fd2
add esp, 4
cmp byte [ebx], 0
mov dword [ebp + 0x2c], 0xf
mov dword [ebp + 0x28], 0
mov byte [ebp + 0x18], 0
jne 0x40a498
xor edi, edi
jmp 0x40a4a9
mov edi, ebx
lea ecx, [edi + 1]
nop dword [eax]
mov al, byte [edi]
inc edi
test al, al
jne 0x40a4a0
sub edi, ecx
cmp dword [ebp + 0x5c], 0x10
lea ecx, [ebp + 0x48]
mov ebx, dword [ebp + 0x48]
mov eax, edi
cmovae ecx, ebx
cmp dword [ebp + 0x58], edi
cmovb eax, dword [ebp + 0x58]
push eax
push dword [ebp - 0x14]
push ecx
call fcn.0040c160
add esp, 0xc
test eax, eax
jne 0x40a4e5
mov ecx, dword [ebp + 0x58]
cmp ecx, edi
jae 0x40a4dc
or eax, 0xffffffff
jmp 0x40a4e3
xor eax, eax
cmp ecx, edi
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x40a556
push 0
push 0
push 0
push 0
push str.SpotifyInstaller_1.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov edi, eax
test edi, edi
je 0x40a553
push 0
push 0x80000200
push 0
xor bl, bl
lea ecx, [ebp + 0x48]
cmp dword [ebp + 0x5c], 0x10
push 0
cmovae ecx, dword [ebp + 0x48]
push ecx
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
test eax, eax
je 0x40a537
push eax
mov bl, 1
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, dword [ebp - 0x10]
test bl, bl
mov ebx, dword [ebp + 0x48]
mov eax, 0x39
cmovne edi, eax
mov dword [ebp - 0x10], edi
jmp 0x40a559
mov ebx, dword [ebp + 0x48]
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp + 0x5c]
mov byte [ebp - 4], 4
cmp eax, 0x10
jb 0x40a5aa
inc eax
cmp eax, 0xffffffff
ja 0x40a68e
cmp eax, 0x1000
jb 0x40a5a1
test byte [ebp + 0x48], 0x1f
jne 0x40a68e
mov eax, dword [ebx - 4]
cmp eax, ebx
jae 0x40a68e
sub ebx, eax
cmp ebx, 4
jb 0x40a68e
cmp ebx, 0x23
ja 0x40a68e
mov ebx, eax
push ebx
call fcn.00423fd2
add esp, 4
mov dword [ebp + 0x5c], 0xf
mov dword [ebp + 0x58], 0
mov byte [ebp + 0x48], 0
cmp edi, 0x34
je 0x40a5ca
cmp edi, 0x33
jne 0x40a6a6
mov ecx, dword [0x48e040]
mov eax, dword [0x48e044]
add ecx, 1
mov dword [0x48e040], ecx
adc eax, 0
mov dword [0x48e044], eax
test eax, eax
jg 0x40a6a6
jl 0x40a5f9
cmp ecx, 3
jae 0x40a6a6
mov eax, 5
shl eax, cl
mov dword [0x495ae4], eax
mov byte [0x495ae0], 0
cmp dword [0x495ae4], 0
je 0x40a632
cmp byte [0x495ac4], 0
jne 0x40a693
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
add dword [0x495ae4], 0xffffffff
jne 0x40a615
mov esi, dword [ebp - 0x1c]
lea eax, [ebp + 0x60]
push 0x104
push eax
push 0xffffffffffffffff
push esi
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
test eax, eax
jne 0x40a397
mov ebx, 0xa
push esi
call fcn.00442387
add esp, 4
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], 0xa
test eax, eax
je 0x40a81c
dec eax
push eax
cmp byte [eax], 0
jne 0x40a7fc
call fcn.00423c95
add esp, 4
jmp 0x40a81c
call fcn.00442571
mov esi, dword [ebp - 0x1c]
mov ebx, 0x13
push esi
call fcn.00403d80
add esp, 4
jmp 0x40a65b
mov byte [0x495b74], 1
test edi, edi
jne 0x40a7e1
mov eax, dword [0x495ae8]
test eax, eax
je 0x40a6cb
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [0x495ae8], edi
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [0x495ad4]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x268]
push str.__webinstall
push dword [0x495ad0]
mov dword [ebp - 0x20], 0
push eax
push 4
call fcn.00403270
mov edi, eax
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 8
push eax
push 0
push edi
push esi
call fcn.0040a000
add esp, 0x24
test al, al
je 0x40a7a3
push 0
push 0
push 0x47c
push dword [0x495b7c]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebx, dword [ebp - 0x20]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0xffffffff
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [ebp - 0x14]
mov dword [0x48e050], eax
mov eax, dword [ebp - 0x24]
mov dword [0x48e054], 0
mov dword [0x48e060], eax
mov dword [0x48e064], 0
test eax, eax
je 0x40a7c3
push edi
mov ebx, 0x37
mov byte [ebp - 4], 4
call fcn.00442387
add esp, 4
push esi
call fcn.00403d80
add esp, 4
jmp 0x40a65b
push edi
mov ebx, 0x35
mov byte [ebp - 4], 4
call fcn.00442387
add esp, 4
push esi
call fcn.00403d80
add esp, 4
jmp 0x40a65b
mov ebx, dword [ebp - 0x10]
push edi
mov byte [ebp - 4], 4
call fcn.00442387
add esp, 4
push esi
call fcn.00403d80
add esp, 4
jmp 0x40a65b
mov ebx, dword [ebp - 0x10]
push esi
call fcn.00403d80
add esp, 4
jmp 0x40a65b
mov ebx, 0xd
jmp 0x40a65b
call fcn.00401f60
mov esi, eax
add esp, 4
test esi, esi
je 0x40a81c
mov ecx, esi
call fcn.00401f10
push 0xc
push esi
call fcn.00423cde
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x288]
xor ecx, ebp
call fcn.00423c9a
lea esp, [ebp + 0x28c]
pop ebp
ret