Function at 0x401180
Capabilities:
Create bits job
Get common file path
Parse url

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x670
mov eax, dword [0x41605c]
xor eax, esp
mov dword [esp + 0x66c], eax
push ebx
push esi
xor ebx, ebx
push 0x206
lea eax, [esp + 0x5e]
push ebx
push eax
mov word [esp + 0x64], bx
call fcn.00406900
add esp, 0xc
push 0x3c
lea ecx, [esp + 0x10]
push ebx
push ecx
call fcn.00406900
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push ebx
push ebx
lea edx, [esp + 0x64]
mov esi, 0x104
push edi
mov dword [esp + 0x1c], 0x3c
mov dword [esp + 0x48], edx
mov dword [esp + 0x4c], esi
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x401231
cmp byte [0x41851e], bl
jne 0x40121b
push 1
push 1
call fcn.00403d30
add esp, 4
push 0xd
mov esi, eax
call fcn.00403d30
add esp, 4
mov ecx, eax
call fcn.00402640
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.00403dac
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x40124b
cmp eax, 4
je 0x40124b
cmp byte [0x41851e], bl
jne 0x40121b
push 2
jmp 0x4011fb
lea ecx, [esp + 0x260]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x40126a
cmp byte [0x41851e], bl
jne 0x40121b
push 3
jmp 0x4011fb
push 0x417ef0
push ebx
push str.ewpex
lea edx, [esp + 0x26c]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x401296
cmp byte [0x41851e], bl
jne 0x40121b
push 4
jmp 0x4011fb
push 0x417ef0
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x468]
movzx edx, word [eax]
cmp dx, bx
je 0x4012bb
add ecx, 2
add eax, 2
sub esi, 1
jne 0x4012a8
mov eax, dword [0x418528]
cmp eax, ebx
je 0x4012cc
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0x418528
push 0x4122f8
push 4
push ebx
push 0x412318
mov dword [0x418528], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jge 0x401301
cmp byte [0x41851e], bl
jne 0x40121b
push 5
jmp 0x4011fb
mov esi, dword [0x418528]
mov ebx, dword [esi]
call fcn.00402990
mov ecx, dword [ebx + 0xc]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
push edi
push esi
call ecx
test eax, eax
jge 0x40136f
cmp byte [0x41851e], 0
jne 0x40134c
push 6
push 1
call fcn.00403d30
add esp, 4
push 0xd
mov esi, eax
call fcn.00403d30
add esp, 4
mov ecx, eax
call fcn.00402640
add esp, 4
mov eax, dword [0x41852c]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 0x20]
call eax
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.00403dac
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [0x4180f8], eax
mov dword [0x4180fc], eax
mov dword [0x418100], eax
mov dword [0x418104], eax
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x28]
push 0x4180f8
push eax
call edx
test eax, eax
jge 0x4013e9
cmp byte [0x41851e], 0
jne 0x4013c6
push 7
push 1
call fcn.00403d30
add esp, 4
push 0xd
mov esi, eax
call fcn.00403d30
add esp, 4
mov ecx, eax
call fcn.00402640
add esp, 4
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push eax
call edx
xor eax, eax
pop esi
pop ebx
mov ecx, dword [esp + 0x66c]
xor ecx, esp
call fcn.00403dac
mov esp, ebp
pop ebp
ret
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x10]
push 0x417ef0
push edi
push eax
call edx
test eax, eax
jge 0x40140d
cmp byte [0x41851e], 0
jne 0x4013c6
push 8
jmp 0x4013a6
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x54]
push 0
push eax
call edx
test eax, eax
jge 0x401430
cmp byte [0x41851e], 0
jne 0x4013c6
push 9
jmp 0x4013a6
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x5c]
push 8
push eax
call edx
test eax, eax
jge 0x401457
cmp byte [0x41851e], 0
jne 0x4013c6
push 0xa
jmp 0x4013a6
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x64]
push 0x4170d0
push eax
call edx
test eax, eax
jge 0x401481
cmp byte [0x41851e], 0
jne 0x4013c6
push 0xb
jmp 0x4013a6
mov eax, dword [0x41852c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
jge 0x4014a6
cmp byte [0x41851e], 0
jne 0x4013c6
push 0xc
jmp 0x4013a6
mov eax, dword [0x41852c]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push eax
mov eax, dword [ecx + 0x38]
call eax
call fcn.004026f0
mov ecx, dword [esp + 0x674]
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00403dac
mov esp, ebp
pop ebp
ret