Function at 0x403460
Capabilities:
Check http status code
Create directory
Create process on windows
Download and write a file
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 4
pop eax
mov dword [0x4010ea], eax
push 0
push 0x84000000
push 0
push 0
mov eax, dword [0x4010ce]
push eax
mov eax, dword [0x401096]
push eax
call dword [sym.imp.WININET.DLL_InternetOpenUrlA]
mov dword [0x40109a], eax
push 0
push 0x4010ea
push 0x4010e6
push 0x20000013
mov eax, dword [0x40109a]
push eax
call dword [sym.imp.WININET.DLL_HttpQueryInfoA]
mov eax, dword [0x4010e6]
cmp eax, 0xc8
jne 0x4036e1
push 0
push 0x4010ea
push 0x4010e6
push 0x20000005
mov eax, dword [0x40109a]
push eax
call dword [sym.imp.WININET.DLL_HttpQueryInfoA]
mov eax, dword [0x4010e6]
cmp eax, 0x64
jge 0x4034eb
mov eax, 0x2000
mov dword [0x4010e6], eax
mov eax, dword [0x4010e6]
mov dword [0x4010ea], eax
mov eax, dword [0x4010ea]
cmp eax, 0x2400
jle 0x40350b
mov eax, 0x2400
mov dword [0x4010ea], eax
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x403525
mov eax, dword [0x4010e6]
inc eax
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
mov dword [0x401072], eax
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x4035b2
push 0x5c
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.MSVCRT.DLL_strrchr]
mov dword [0x4010e2], eax
mov eax, dword [0x4010e2]
test eax, eax
jne 0x403559
mov edi, dword [0x4010d6]
xor eax, eax
mov dword [edi], eax
jmp 0x403564
mov edi, dword [0x4010e2]
inc edi
xor eax, eax
mov byte [edi], al
push 0
mov eax, dword [0x4010d6]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
mov eax, dword [0x4010d6]
push eax
mov eax, dword [0x4010f6]
push eax
push str._r__F:__s__s
mov eax, dword [0x401082]
push eax
call dword [sym.imp.MSVCRT.DLL_sprintf]
push 0
push pe_nt_image_headers32
push 2
push 0
push 1
push 0x40000000
mov eax, dword [0x4010f6]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x40106e], eax
mov eax, dword [0x401092]
mov dword [0x40108e], eax
xor eax, eax
mov dword [0x40109e], eax
push 0x4010ea
mov eax, dword [0x4010ea]
push eax
mov eax, dword [0x40108e]
push eax
mov eax, dword [0x40109a]
push eax
call dword [sym.imp.WININET.DLL_InternetReadFile]
mov eax, dword [0x4010ea]
test eax, eax
jle 0x403682
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x403618
mov eax, dword [0x4010ea]
push eax
mov eax, dword [0x40108e]
push eax
mov eax, dword [0x401072]
push eax
mov eax, dword [0x40109e]
push eax
pop edx
pop eax
add eax, edx
push eax
call dword [sym.imp.KERNEL32.DLL_RtlMoveMemory]
mov eax, dword [0x4010ea]
add dword [0x40109e], eax
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x40367d
push 0
push 0x4010ea
mov eax, dword [0x4010ea]
push eax
mov eax, dword [0x40108e]
push eax
mov eax, dword [0x40106e]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [0x40109e]
imul eax, eax, 0x64
push eax
mov eax, dword [0x4010e6]
push eax
pop ecx
pop eax
xor edx, edx
idiv ecx
mov dword [0x4010de], eax
push 0
mov eax, dword [0x4010de]
push eax
push 0x402
mov eax, dword [0x40106a]
push eax
call dword [sym.imp.USER32.DLL_SendMessageA]
jmp 0x4035c3
mov eax, dword [0x40109e]
mov dword [0x4010e6], eax
cmp dword [ebp + 8], 1
jne 0x4036a5
mov edi, dword [0x401072]
mov eax, dword [0x4010e6]
add edi, eax
xor eax, eax
mov byte [edi], al
jmp 0x4036e1
cmp dword [ebp + 8], 2
jne 0x4036dc
mov eax, dword [0x40106e]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
mov dword [0x40106e], eax
push 0
push 0
mov eax, dword [0x401082]
push eax
push str.expand.exe
push str.Open
push 0
call dword [sym.imp.SHELL32.DLL_ShellExecuteA]
jmp 0x4036e1
call fcn.00403717
mov eax, dword [0x40109a]
push eax
call dword [sym.imp.WININET.DLL_InternetCloseHandle]
mov esp, ebp
pop ebp
ret 4