Function at 0x406496
Capabilities:
Check os version
Get geographical location
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440248
mov eax, dword fs:[0]
push eax
mov eax, 0x103c
call fcn.00438600
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, ecx
call ebx
push 0
mov esi, eax
call fcn.0042a13f
mov dword [ebp - 0x101c], esi
fild dword [ebp - 0x101c]
pop ecx
mov dword [ebp - 0x1024], eax
test esi, esi
jge 0x4064f8
fadd qword [0x44a9c8]
call fcn.00438ef0
fild dword [ebp - 0x1024]
mov eax, dword [ebp - 0x1024]
test eax, eax
jge 0x406513
fadd qword [0x44a9c8]
fcompp
fnstsw ax
test ah, 5
jp 0x40653f
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
call fcn.00409b8b
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x406569
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.004046b2
call fcn.00404746
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jle 0x406588
xor edx, edx
inc edx
jmp 0x40658d
mov eax, esi
cdq
idiv esi
mov eax, edx
dec eax
jne 0x40659c
call fcn.0040478d
call fcn.00404813
xor esi, esi
mov dword [ebp - 0x1020], esi
call ebx
dec eax
dec eax
je 0x4065b3
dec eax
dec eax
je 0x4065b3
sub eax, 4
jne 0x4065b9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
or dword [ebp - 4], 0xffffffff
jmp 0x4066b0
lea eax, [ebp - 0x1020]
push eax
push 0xff6
lea eax, [ebp - 0x1018]
push eax
push dword [edi + 0xb0]
call dword [sym.imp.WININET.dll_InternetReadFile]
cmp dword [ebp - 0x1020], esi
ja 0x40676f
cmp dword [edi + 0xb4], esi
je 0x4067e5
call fcn.004062e8
push esi
call fcn.0042a13f
pop ecx
call ebx
dec eax
dec eax
je 0x406618
dec eax
dec eax
je 0x406618
sub eax, 4
je 0x406618
xor eax, eax
jmp 0x406621
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor eax, eax
inc eax
dec eax
jne 0x40662e
call fcn.00404898
call fcn.00404902
lea eax, [edi + 0xbc]
mov ecx, dword [eax]
lea edx, [ecx + 1]
mov dword [eax], edx
cmp ecx, 0xa
ja 0x406741
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0x8c]
lea eax, [edi + 0x1c]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x101c], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1024], esp
push edi
mov dword [ebp - 4], 2
call fcn.00402e94
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004060ee
mov esi, eax
call fcn.00428e21
call fcn.00428e21
or dword [ebp - 4], 0xffffffff
test esi, esi
jl 0x4066ae
and dword [edi + 0xb8], 0
lea eax, [edi + 0x70]
call fcn.00402ec4
xor esi, esi
cmp dword [edi + 0xc0], esi
jne 0x4065c2
call fcn.004062e8
call ebx
mov dword [ebp - 0x101c], eax
fild dword [ebp - 0x101c]
test eax, eax
jge 0x4066d9
fadd qword [0x44a9c8]
call fcn.00438ef0
fstp qword [ebp - 0x1028]
push esi
call fcn.0042a13f
mov dword [ebp - 0x101c], eax
fild dword [ebp - 0x101c]
pop ecx
test eax, eax
jge 0x406701
fadd qword [0x44a9c8]
fcomp qword [ebp - 0x1028]
fnstsw ax
test ah, 5
jp 0x406741
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 4
lea eax, [ebp - 0x101c]
push eax
push 0x20001009
mov esi, 0x400
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x1048]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [edi + 0xc4]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00428582
leave
ret
push dword [ebp - 0x1020]
lea eax, [ebp - 0x1018]
push eax
lea eax, [edi + 0x70]
call fcn.00408041
mov ecx, dword [ebp - 0x1020]
lea eax, [edi + 0xb8]
add dword [eax], ecx
mov ecx, dword [edi + 0xb4]
mov eax, dword [eax]
cmp ecx, esi
je 0x4066b0
cmp eax, ecx
jb 0x4066b0
mov dword [edi + 0xc4], 1
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x4067db
mov eax, esi
cdq
idiv esi
test edx, edx
je 0x406741
call fcn.00404988
jmp 0x406741
mov dword [edi + 0xc4], 1
jmp 0x406741