Function at 0x4028c0
Capabilities:
Create process on windows
Read data from internet
Receive data
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x470
push ebx
push ebp
push esi
push edi
xor eax, eax
xor esi, esi
mov ebx, 0x363225
mov ebp, 0x423225
mov edi, 0x443325
mov cl, byte [esi + 0x40a991]
movsx edx, cl
add edx, 0xffffffe0
cmp edx, 0x1d
ja case.0x4028fb.33
movzx edx, byte [edx + 0x402fd4]
jmp dword [edx*4 + 0x402fbc]
mov byte [esp + eax + 0x4c], 0x2b
jmp 0x402935
mov dword [esp + eax + 0x4c], 0x353225
add eax, 3
jmp 0x402936
mov dword [esp + eax + 0x4c], ebx
add eax, 3
jmp 0x402936
mov dword [esp + eax + 0x4c], ebp
add eax, 3
jmp 0x402936
mov dword [esp + eax + 0x4c], edi
add eax, 3
jmp 0x402936
mov byte [esp + eax + 0x4c], cl
inc eax
inc esi
cmp esi, 0x10
jae 0x402945
cmp byte [esi + 0x40a991], 0
jne 0x4028e3
mov byte [esp + eax + 0x4c], 0
lea eax, [esp + 0x4c]
push eax
push 0x40a96c
lea ecx, [esp + 0x88]
push str.Xeed_check_codetrueXPL_checkcode1111longLogin1TPL_username_sTPL_password_sactionAuthenticatorevent_submit_do_loginanything
push ecx
mov dword [esp + 0x20], esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x40a9a4]
mov ebx, dword [sym.imp.WININET.dll_HttpOpenRequestA]
add esp, 0x10
push 0
push 0x84800000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push edx
mov ebp, eax
call ebx
mov edi, dword [sym.imp.WININET.dll_HttpSendRequestA]
push ebp
mov esi, eax
lea eax, [esp + 0x84]
push eax
push 0x46
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call edi
test eax, eax
jne 0x4029fb
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [0x40a9a4]
push 0
push 0x84800000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push ecx
call ebx
push ebp
lea edx, [esp + 0x84]
push edx
push 0x46
mov esi, eax
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call edi
test eax, eax
je 0x4029b8
xor edi, edi
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
mov ecx, 0xf9f
sub ecx, edi
push ecx
lea edx, [edi + 0x40aba0]
push edx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
xor ecx, ecx
test eax, eax
je 0x402a33
mov eax, dword [esp + 0x10]
add edi, eax
cmp eax, ecx
je 0x402a33
cmp edi, 0xfa0
jb 0x402a00
push 0x38
push str.1.2.3
lea eax, [esp + 0x1c]
push 0x2f
push eax
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
call fcn.004031b0
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x2c], 0x40aba0
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], 0x40dba8
mov dword [esp + 0x3c], 0xffff
call fcn.00403370
add esp, 0x18
test eax, eax
js 0x402aa1
lea edx, [esp + 0x14]
mov edi, 0xffff
sub edi, dword [esp + 0x24]
push edx
call fcn.00404890
add esp, 4
jmp 0x402ae5
push edi
push 0x40aba0
push 0x40dba8
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov ecx, 0x2710
sub ecx, edi
push ecx
lea edx, [edi + 0x40dba8]
push edx
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402ae5
mov eax, dword [esp + 0x10]
add edi, eax
test eax, eax
je 0x402ae5
cmp edi, 0x2710
jb 0x402ab4
push esi
mov byte [edi + 0x40dba8], 0
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push str.window.location___http:__mai.taobao.com_seller_admin.htm_
push 0x40dba8
call esi
add esp, 8
test eax, eax
je 0x402c68
mov eax, dword [0x40a9ac]
push 0
push 0x84000000
push 0
push 0
push str.HTTP_1.0
push str._trade_itemlist_list_sold_items.htm
push 0x408ff4
push eax
call ebx
push 0
push 0
push 0x15
mov edi, eax
push str.Accept_Encoding:_gzip
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
xor esi, esi
jmp 0x402b50
lea ecx, [esp + 0x10]
push ecx
mov edx, 0x2ee0
sub edx, esi
push edx
lea eax, [esi + 0x40aba0]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402b81
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402b81
cmp esi, 0x2ee0
jb 0x402b50
push 0x40dba8
push esi
push 0x40aba0
mov eax, 0xffff
call fcn.004030d0
add esp, 0xc
test eax, eax
jns 0x402be8
push esi
push 0x40aba0
push 0x40dba8
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
mov edx, 0xbb80
sub edx, esi
push edx
lea eax, [esi + 0x40dba8]
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x402be1
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402be1
cmp esi, 0xbb80
jb 0x402bb0
mov byte [esi + 0x40dba8], 0
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str._tb_token_
push 0x40dba8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402c62
push str.value
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
movq xmm0, qword [eax + 7]
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
movq qword [0x40aabc], xmm0
movq xmm0, qword [eax + 0xf]
push 0x27
movq qword [0x40aac4], xmm0
push 0x40aabc
mov byte [0x40aacb], 0
call esi
add esp, 0x10
test eax, eax
jne 0x402c55
push 0x26
push 0x40aabc
call esi
add esp, 8
mov byte [eax], 0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push str.hidden__id_l_f_code
push 0x40dba8
call esi
add esp, 8
test eax, eax
jne 0x402f0c
push str.sessionID
push 0x40dba8
call esi
add esp, 8
test eax, eax
je 0x402f0c
movq xmm0, qword [eax + 0xa]
push 5
push 0
push 0
movq qword [0x40a93b], xmm0
movq xmm0, qword [eax + 0x12]
push str.http:__regcheckcode.taobao.com_auction_checkcode_sessionID11111111111111111111111111111111
movq qword [0x40a943], xmm0
movq xmm0, qword [eax + 0x1a]
push str.open
movq qword [0x40a94b], xmm0
movq xmm0, qword [eax + 0x22]
push 0
movq qword [0x40a953], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x40a960]
push 0
push 0x403000
push ecx
push 0x68
push 0x400000
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x40a9a4]
mov edx, dword [0x40aba0]
push 0
push 0x84800000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push eax
mov dword [esp + 0xc3], edx
mov byte [esp + 0xa0], 0x6e
mov byte [esp + 0xb5], 0x54
call ebx
push ebp
lea ecx, [esp + 0x84]
push ecx
push 0x46
mov edi, eax
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
xor esi, esi
jmp 0x402d60
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea edx, [esp + 0x10]
push edx
mov eax, 0xfa0
sub eax, esi
push eax
lea ecx, [esi + 0x40aba0]
push ecx
push edi
call ebp
test eax, eax
je 0x402d93
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402d93
cmp esi, 0xfa0
jb 0x402d60
push 0x40dba8
push esi
push 0x40aba0
mov eax, 0xffff
call fcn.004030d0
add esp, 0xc
test eax, eax
jns 0x402df6
push esi
push 0x40aba0
push 0x40dba8
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov eax, 0x2710
sub eax, esi
push eax
lea ecx, [esi + 0x40dba8]
push ecx
push edi
call ebp
test eax, eax
je 0x402def
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402def
cmp esi, 0x2710
jb 0x402dc2
mov byte [esi + 0x40dba8], 0
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str.window.location___http:__mai.taobao.com_seller_admin.htm_
push 0x40dba8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x402f06
mov edx, dword [0x40a9ac]
push 0
push 0x84000000
push 0
push 0
push str.HTTP_1.0
push str._trade_itemlist_list_sold_items.htm
push 0x408ff4
push edx
call ebx
push 0
push 0
push 0x15
mov edi, eax
push str.Accept_Encoding:_gzip
push edi
call dword [sym.imp.WININET.dll_HttpSendRequestA]
xor esi, esi
lea eax, [esp + 0x10]
push eax
mov ecx, 0x2ee0
sub ecx, esi
push ecx
lea edx, [esi + 0x40aba0]
push edx
push edi
call ebp
test eax, eax
je 0x402e7e
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402e7e
cmp esi, 0x2ee0
jb 0x402e51
push 0x40dba8
push esi
push 0x40aba0
mov eax, 0xffff
call fcn.004030d0
add esp, 0xc
test eax, eax
jns 0x402ee4
push esi
push 0x40aba0
push 0x40dba8
call sub.MSVCRT.dll_memcpy
add esp, 0xc
lea ecx, [ecx]
lea eax, [esp + 0x10]
push eax
mov ecx, 0xbb80
sub ecx, esi
push ecx
lea edx, [esi + 0x40dba8]
push edx
push edi
call ebp
test eax, eax
je 0x402edd
mov eax, dword [esp + 0x10]
add esi, eax
test eax, eax
je 0x402edd
cmp esi, 0xbb80
jb 0x402eb0
mov byte [esi + 0x40dba8], 0
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push str._tb_token_
push 0x40dba8
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x402c06
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push 0x4093d8
push 0x40dba8
call esi
add esp, 8
test eax, eax
je 0x402f3f
push 0
push 0x1000
push 0
push 0x4093e8
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x4093f8
push 0x40dba8
call esi
add esp, 8
test eax, eax
je 0x402f72
push 0
push 0x1000
push 0
push 0x409408
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x40941c
push 0x40dba8
call esi
add esp, 8
push 0
push 0x1000
push 0
test eax, eax
je 0x402fa5
push 0x409428
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
push 0x40947c
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
pop edi
xor al, al
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret