Function at 0x4ff8c0
Capabilities:
Check for time delay via gettickcount
Get common file path
Parse url

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53ae1e
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x438
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3f4], edi
push 0x208
lea eax, [ebp - 0x220]
mov dword [edi + 0x994], 5
push 0
push eax
call fcn.0049e130
add esp, 0xc
lea ecx, [ebp - 0x408]
push str.http:__syzs.qq.com_downloads_xml_game.xml
call fcn.00401ff0
mov dword [ebp - 4], 0
call fcn.00401980
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4ff95c
push 0x80004005
call fcn.00401b40
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4ff971
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x4ff975
mov ecx, edx
call esi
add eax, 0x10
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 1
cmp dword [edi + 0x404], 0
je 0x4ff99d
push 0x29
push 0x56a828
lea ecx, [ebp - 0x408]
call fcn.00402d50
lea eax, [ebp - 0x220]
push eax
push 0
push 0
push dword [edi + 0x434]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea ecx, [ebp - 0x220]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ff9c0
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x404]
call fcn.00402d50
push ecx
mov esi, esp
mov dword [edi + 0x4cc], 2
mov dword [ebp - 0x3e4], esi
mov ecx, dword [edi + 0x478]
sub ecx, 0x10
call fcn.004021e0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004f4ea0
lea eax, [ebp - 0x404]
push eax
lea ecx, [edi + 0x480]
call fcn.00411620
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x84]
mov eax, dword [edi]
mov ecx, edi
push 0
push 0
call dword [eax + 0xb8]
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x400], 5
push ecx
lea eax, [edi + 0x424]
lea ecx, [ebp - 0x3f0]
mov dword [ebp - 0x3f8], eax
push ecx
mov ecx, eax
call fcn.0042be10
mov esi, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x408]
add esi, 0x84
mov dword [ebp - 0x3e8], esi
mov edx, dword [esi]
lea ecx, [eax - 0x10]
sub edx, 0x10
mov dword [ebp - 0x3dc], ecx
mov dword [ebp - 0x3e0], edx
cmp ecx, edx
je 0x4ffad0
cmp dword [edx + 0xc], 0
jl 0x4ffac5
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x4ffac5
mov ecx, dword [ebp - 0x3dc]
call fcn.004021e0
mov ecx, dword [ebp - 0x3e0]
mov esi, eax
call fcn.00402e90
mov ecx, dword [ebp - 0x3e8]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x4ffad0
push dword [eax - 0xc]
mov ecx, esi
push eax
call fcn.00402d50
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x3dc], 5
push eax
lea eax, [ebp - 0x3f0]
push eax
lea ecx, [edi + 0x424]
call fcn.0042be10
mov esi, dword [ebp - 0x3f0]
mov eax, dword [ebp - 0x404]
add esi, 0x60
mov dword [ebp - 0x3e8], esi
mov edx, dword [esi]
lea ecx, [eax - 0x10]
sub edx, 0x10
mov dword [ebp - 0x400], ecx
mov dword [ebp - 0x3e0], edx
cmp ecx, edx
je 0x4ffb5c
cmp dword [edx + 0xc], 0
jl 0x4ffb51
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x4ffb51
mov ecx, dword [ebp - 0x400]
call fcn.004021e0
mov ecx, dword [ebp - 0x3e0]
mov esi, eax
call fcn.00402e90
mov ecx, dword [ebp - 0x3e8]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x4ffb5c
push dword [eax - 0xc]
mov ecx, esi
push eax
call fcn.00402d50
lea ecx, [ebp - 0x300]
call fcn.00428cc0
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3dc], 5
lea esi, [edi + 0x424]
push eax
mov ecx, esi
call fcn.0042be10
mov eax, dword [ebp - 0x3f0]
mov edx, dword [eax + 0x84]
cmp word [edx], 0
jne 0x4ffba6
xor ecx, ecx
jmp 0x4ffbc5
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ffbb0
sub ecx, esi
lea esi, [edi + 0x424]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x300]
call fcn.00405040
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x3dc], 5
push eax
lea eax, [ebp - 0x3f0]
mov ecx, esi
push eax
call fcn.0042be10
mov eax, dword [ebp - 0x3f0]
mov edx, dword [eax + 0x60]
cmp word [edx], 0
jne 0x4ffc04
xor ecx, ecx
jmp 0x4ffc25
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ffc10
sub ecx, esi
lea esi, [edi + 0x424]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2e8]
call fcn.00405040
mov eax, dword [ebp - 0x260]
mov ecx, 1
cmp dword [edi + 0x404], 0
mov dword [ebp - 0x258], 0
cmovne eax, ecx
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x260], eax
mov ecx, esi
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x3dc], 5
push eax
lea eax, [ebp - 0x3f0]
push eax
call fcn.0042be10
mov eax, dword [ebp - 0x3f0]
mov ecx, esi
inc dword [eax + 0x28]
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3dc], 5
push eax
call fcn.0042be10
mov eax, dword [ebp - 0x3f0]
mov ecx, esi
mov dword [eax + 0x1c], 0
lea eax, [ebp - 0x3dc]
push eax
lea eax, [ebp - 0x3f0]
mov dword [ebp - 0x3dc], 5
push eax
call fcn.0042be10
mov esi, dword [ebp - 0x3f0]
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [esi + 0x34], eax
mov esi, dword [ebp - 0x3f4]
mov dword [esi + 0x400], 0x6b
call edi
xor edx, edx
mov dword [ebp - 0x3e0], 5
mov ecx, 0xa
div ecx
mov ecx, dword [ebp - 0x3f8]
lea eax, [ebp - 0x3e0]
push eax
lea eax, [ebp - 0x3f0]
push eax
lea esi, [edx + 1]
mov dword [ebp - 0x3dc], esi
call fcn.0042be10
mov eax, dword [ebp - 0x3f0]
mov dword [eax + 0x24], esi
lea eax, [ebp - 0x300]
cmp dword [ebp - 0x2ec], 8
cmovae eax, dword [ebp - 0x300]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryW]
mov edi, dword [ebp - 0x3f4]
lea ecx, [ebp - 0x2e8]
cmp dword [ebp - 0x2d4], 8
lea eax, [ebp - 0x300]
cmovae ecx, dword [ebp - 0x2e8]
cmp dword [ebp - 0x2ec], 8
lea edx, [edi + 0x3cc]
push edx
cmovae eax, dword [ebp - 0x300]
push ecx
push ecx
push eax
mov ecx, esi
call fcn.004d0ea0
mov edx, eax
lea ecx, [ebp - 0x2e8]
add esp, 0x10
lea eax, [ebp - 0x300]
test edx, edx
jne 0x4ffdfb
cmp dword [ebp - 0x2d4], 8
cmovae ecx, dword [ebp - 0x2e8]
cmp dword [ebp - 0x2ec], 8
push ecx
cmovae eax, dword [ebp - 0x300]
push eax
push esi
push 0x56a8a8
push str.___s__URLDownloadToFile_Succ._TaskId__d__Url__s__FileName__s_
call fcn.004e78a0
push eax
call fcn.004e76a0
add esp, 0x18
mov ecx, edi
push 0
push esi
call fcn.0050a6c0
lea ecx, [ebp - 0x3d8]
call fcn.00429b90
mov byte [ebp - 4], 3
mov ecx, edi
jmp 0x500891
cmp dword [ebp - 0x2d4], 8
cmovae ecx, dword [ebp - 0x2e8]
cmp dword [ebp - 0x2ec], 8
push ecx
cmovae eax, dword [ebp - 0x300]
push eax
push esi
push edx
push 0x56ab20
push str.___s__URLDownloadToFile_Fail_Err_0x_08x_._TaskId__d__Url__s__FileName__s_
call fcn.004e78a0
push eax
call fcn.004e76a0
add esp, 0x1c
mov dword [ebp - 0x224], 0xf
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x238], 0
push fcn.00403110
push 0x4051c0
push 6
push 0x18
lea eax, [ebp - 0x398]
mov byte [ebp - 4], 4
push eax
call fcn.0049b297
push 0x3c
lea eax, [ebp - 0x444]
mov byte [ebp - 4], 5
push 0
push eax
call fcn.0049e130
add esp, 0xc
mov dword [ebp - 0x3e0], 6
lea esi, [ebp - 0x388]
mov ecx, dword [esi]
cmp ecx, 0x400
jb 0x4ffec5
mov dword [esi], 0x400
cmp dword [esi + 4], 8
jb 0x4ffeb7
mov eax, dword [esi - 0x10]
xor ecx, ecx
mov word [eax + 0x800], cx
jmp 0x4ffed7
lea eax, [esi - 0x10]
xor ecx, ecx
mov word [eax + 0x800], cx
jmp 0x4ffed7
mov eax, 0x400
sub eax, ecx
lea ecx, [esi - 0x10]
push 0
push eax
call fcn.00404330
add esi, 0x18
sub dword [ebp - 0x3e0], 1
jne 0x4ffe93
cmp dword [ebp - 0x384], 8
lea eax, [ebp - 0x398]
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x444], 0x3c
cmovae eax, dword [ebp - 0x398]
cmp dword [ebp - 0x36c], 8
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x388]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x380]
cmovae eax, dword [ebp - 0x380]
cmp dword [ebp - 0x354], 8
mov dword [ebp - 0x434], eax
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x368]
cmovae eax, dword [ebp - 0x368]
cmp dword [ebp - 0x33c], 8
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x358]
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x350]
cmovae eax, dword [ebp - 0x350]
cmp dword [ebp - 0x324], 8
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x338]
cmovae eax, dword [ebp - 0x338]
cmp dword [ebp - 0x30c], 8
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x328]
mov dword [ebp - 0x414], eax
lea eax, [ebp - 0x320]
cmovae eax, dword [ebp - 0x320]
cmp dword [ebp - 0x2ec], 8
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x310]
push ecx
mov dword [ebp - 0x40c], eax
lea eax, [ebp - 0x300]
cmovae eax, dword [ebp - 0x300]
push 0x10000000
push dword [ebp - 0x2f0]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
jne 0x50017b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword fs:[0x2c]
lea esi, [ebp - 0x300]
cmp dword [ebp - 0x2ec], 8
mov dword [ebp - 0x3f8], eax
cmovae esi, dword [ebp - 0x300]
mov edx, dword [ecx]
mov ecx, dword [0x59fee8]
cmp ecx, dword [edx + 4]
jle 0x5000d6
push 0x59fee8
call fcn.0049af28
add esp, 4
cmp dword [0x59fee8], 0xffffffff
jne 0x5000d6
mov byte [ebp - 4], 6
xorps xmm0, xmm0
push 0
push 0x59fef0
mov dword [0x59feec], 0x57d120
movups xmmword [0x59fef0], xmm0
movq qword [0x59ff00], xmm0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x5000a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x50009c
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x5000a4
push eax
call fcn.00401b40
push 0x53eaa0
mov dword [0x59ff08], 0
mov dword [0x59ff0c], 0
call fcn.0049b282
add esp, 4
mov byte [ebp - 4], 5
push 0x59fee8
call fcn.0049aee9
add esp, 4
push dword [ebp - 0x3f8]
push esi
push 0x56aa20
push 0x56acc8
push 0x59feec
call fcn.004e76a0
add esp, 0x14
mov byte [ebp - 4], 4
lea eax, [ebp - 0x398]
push fcn.00403110
push 6
push 0x18
push eax
call fcn.0049acff
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x224]
cmp eax, 0x10
jb 0x500622
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x238]
cmp ecx, 0xffffffff
jbe 0x500133
call fcn.004a4e3e
cmp ecx, 0x1000
jb 0x50016d
test byte [ebp - 0x238], 0x1f
je 0x500149
call fcn.004a4e3e
mov ecx, dword [eax - 4]
cmp ecx, eax
jb 0x500155
call fcn.004a4e3e
sub eax, ecx
cmp eax, 4
jae 0x500161
call fcn.004a4e3e
cmp eax, 0x23
jbe 0x50016b
call fcn.004a4e3e
mov eax, ecx
push eax
call fcn.0049aa1d
add esp, 4
jmp 0x500622
push dword [ebp - 0x418]
lea ecx, [ebp - 0x3e8]
call fcn.00401ff0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x40c], 0
jbe 0x5001cc
mov edx, dword [ebp - 0x410]
test edx, edx
jne 0x5001a7
xor ecx, ecx
jmp 0x5001bf
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5001b0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x3e8]
call fcn.00402320
lea eax, [edi + 0x9d4]
push eax
lea eax, [edi + 0x9bc]
push eax
push ecx
mov dword [ebp - 0x3e4], esp
mov esi, dword [ebp - 0x3e8]
add esi, 0xfffffff0
mov dword [ebp - 0x3ec], esp
mov dword [ebp - 0x3fc], esi
mov ecx, dword [esi]
mov dword [ebp - 0x3e0], ecx
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
je 0x500214
call edx
mov ecx, eax
mov dword [ebp - 0x3e0], eax
cmp dword [esi + 0xc], 0
lea eax, [esi + 0xc]
jl 0x500229
cmp ecx, dword [esi]
jne 0x500229
lock inc dword [eax]
jmp 0x500303
mov eax, dword [ecx]
mov edx, dword [esi + 4]
mov esi, dword [eax]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x5002c6
xor eax, eax
test edx, edx
setns al
test eax, eax
jne 0x50024d
xor esi, esi
jmp 0x5002cd
mov eax, bind
sub eax, edx
cmp eax, 1
jl 0x500246
inc edx
xor eax, eax
lea esi, [edx + 7]
and esi, 0xfffffff8
cmp edx, esi
mov dword [ebp - 0x3f8], esi
setle al
test eax, eax
jne 0x500275
xor esi, esi
jmp 0x5002cd
mov eax, 2
mul esi
test edx, edx
ja 0x500246
jb 0x500287
cmp eax, 0xffffffff
ja 0x500246
cmp eax, 0xffffffef
ja 0x500246
mov ecx, dword [ecx + 4]
add eax, 0x10
push eax
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x5002cd
mov eax, dword [ebp - 0x3e0]
mov dword [esi], eax
mov eax, dword [ebp - 0x3f8]
dec eax
mov dword [esi + 0xc], 1
mov dword [esi + 8], eax
mov dword [esi + 4], 0
jmp 0x5002cd
push 2
push edx
call esi
mov esi, eax
test esi, esi
jne 0x5002d6
call fcn.00402c20
mov ecx, dword [ebp - 0x3fc]
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
mov edx, dword [ecx + 4]
lea eax, [edx*2 + 2]
push eax
lea eax, [ecx + 0x10]
push eax
lea edx, [edx*2 + 2]
lea ecx, [esi + 0x10]
call fcn.004c7670
add esp, 8
mov ecx, dword [ebp - 0x3e4]
lea eax, [esi + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 8
mov ecx, esp
push dword [ebp - 0x434]
call fcn.00401ff0
xor edx, edx
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
call fcn.004ddbd0
add esp, 0x10
test eax, eax
jne 0x500558
mov esi, dword [ebp - 0x3e8]
lea eax, [edi + 0x9d4]
push eax
lea eax, [edi + 0x9bc]
add esi, 0xfffffff0
push eax
push ecx
mov dword [ebp - 0x3ec], esp
mov ecx, dword [esi]
mov dword [ebp - 0x3fc], esp
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
je 0x500372
call edx
mov ecx, eax
cmp dword [esi + 0xc], 0
lea eax, [esi + 0xc]
jl 0x500384
cmp ecx, dword [esi]
jne 0x500384
lock inc dword [eax]
jmp 0x5003cd
mov eax, dword [ecx]
push 2
push dword [esi + 4]
mov eax, dword [eax]
call eax
mov ecx, eax
mov dword [ebp - 0x3e4], ecx
test ecx, ecx
jne 0x5003a0
call fcn.00402c20
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
add ecx, 0x10
mov edx, dword [esi + 4]
lea eax, [edx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea edx, [edx*2 + 2]
call fcn.004c7670
mov esi, dword [ebp - 0x3e4]
add esp, 8
mov ecx, dword [ebp - 0x3fc]
lea eax, [esi + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
push dword [ebp - 0x434]
call fcn.00401ff0
mov edx, 4
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
call fcn.004ddbd0
add esp, 0x10
test eax, eax
jne 0x500558
mov esi, dword [ebp - 0x3e8]
lea eax, [edi + 0x9d4]
push eax
lea eax, [edi + 0x9bc]
add esi, 0xfffffff0
push eax
push ecx
mov dword [ebp - 0x3ec], esp
mov ecx, dword [esi]
mov dword [ebp - 0x3fc], esp
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
cmp eax, vtable.ATL::CAtlStringMgr.0
je 0x50043f
call edx
mov ecx, eax
cmp dword [esi + 0xc], 0
lea eax, [esi + 0xc]
jl 0x500451
cmp ecx, dword [esi]
jne 0x500451
lock inc dword [eax]
jmp 0x50049a
mov eax, dword [ecx]
push 2
push dword [esi + 4]
mov eax, dword [eax]
call eax
mov ecx, eax
mov dword [ebp - 0x3e4], ecx
test ecx, ecx
jne 0x50046d
call fcn.00402c20
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
add ecx, 0x10
mov edx, dword [esi + 4]
lea eax, [edx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea edx, [edx*2 + 2]
call fcn.004c7670
mov esi, dword [ebp - 0x3e4]
add esp, 8
mov ecx, dword [ebp - 0x3fc]
lea eax, [esi + 0x10]
mov dword [ecx], eax
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
push dword [ebp - 0x434]
call fcn.00401ff0
mov edx, 1
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
call fcn.004ddbd0
add esp, 0x10
test eax, eax
jne 0x500558
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov ecx, dword [ebp - 0x3e8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x500514
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x500510
mov eax, dword [edx + 4]
push 0x55
push ebp
dec ebp
adc byte [ebx + 0x3e183d9], cl
je 0x50057e
or al, 0xff
je 0x500582
or al, 0xff
push esp
and al, 0xc
clc
mov eax, dword [esp - 4]
cld
add eax, 2
mov dword [esp - 4], eax
mov eax, dword [esp - 8]
sub esp, 4
ret
enter 0xffffffffffffc985, 0x75
add ebx, eax
inc ebp
ret 0x88ec