Function at 0x439e60
Capabilities:
Access peb ldr_data
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x4a97e1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
push edi
push 0
push ecx
mov esi, ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.IsAutoRun
call fcn.00404200
mov ecx, 0x4d3364
call fcn.0040f750
push 0
push 0
push eax
push 0x4d2c78
lea eax, [esp + 0x2c]
push 0x4af0b8
push eax
call fcn.00402480
add esp, 8
mov ecx, esp
mov dword [esp + 0x30], esp
push str.___start
push eax
push ecx
mov dword [esp + 0x60], 0
call fcn.004023c0
add esp, 8
mov ecx, esp
mov dword [esp + 0x38], esp
push 0x4af41c
mov byte [esp + 0x5c], 1
call fcn.00404200
mov byte [esp + 0x58], 0
call fcn.00432280
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x14
mov dword [esp + 0x44], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x439f1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.BufPath
call fcn.00404200
lea eax, [esp + 0x18]
push eax
mov ecx, 0x4d3364
call fcn.00472ff0
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push ecx
mov dword [esp + 0x4c], 2
call ebp
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
jne 0x43a020
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x43a020
push str.Temp
lea edx, [esp + 0x20]
push 0x4d2c7c
push edx
call fcn.004023c0
add esp, 0xc
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x48], 3
call fcn.00402060
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x44], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x439fbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
push 0
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.004015e0
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.BufPath
mov byte [esp + 0x54], 4
call fcn.00404200
mov ecx, 0x4d3364
mov byte [esp + 0x50], 2
call fcn.00473e00
mov ecx, 0x4d3364
call fcn.00472cd0
mov eax, dword [esp + 0x10]
push 0
push eax
call ebp
push 0x40040
push 0x4b36bc
push 0x4b3638
push 0
call ebx
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DownPath
call fcn.00404200
lea ecx, [esp + 0x20]
push ecx
mov ecx, 0x4d3364
call fcn.00472ff0
mov edx, dword [esp + 0x18]
push 0
push edx
mov byte [esp + 0x4c], 5
call ebp
test eax, eax
jne 0x43a115
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x43a115
push 0x4b3b14
lea eax, [esp + 0x20]
push 0x4d2c7c
push eax
call fcn.004023c0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x48], 6
call fcn.00402060
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x44], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a0b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
push 0
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.004015e0
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.DownPath
mov byte [esp + 0x54], 7
call fcn.00404200
mov ecx, 0x4d3364
mov byte [esp + 0x50], 5
call fcn.00473e00
mov ecx, 0x4d3364
call fcn.00472cd0
mov eax, dword [esp + 0x18]
push 0
push eax
call ebp
push 0x40040
push 0x4b3b04
push 0x4b3a78
push 0
call ebx
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4b2ad0
call fcn.00404200
lea ecx, [esp + 0x1c]
push ecx
mov ecx, 0x4d3364
call fcn.00472ff0
mov edx, dword [esp + 0x14]
push 0
push edx
mov byte [esp + 0x4c], 8
call ebp
test eax, eax
jne 0x43a20a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x43a20a
push 0x4b3a64
lea eax, [esp + 0x20]
push 0x4d2c7c
push eax
call fcn.004023c0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 9
call fcn.00402060
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x44], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a1a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push 0
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x2c], esp
mov edi, esp
push eax
call fcn.004015e0
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4b2ad0
mov byte [esp + 0x54], 0xa
call fcn.00404200
mov ecx, 0x4d3364
mov byte [esp + 0x50], 8
call fcn.00473e00
mov ecx, 0x4d3364
call fcn.00472cd0
mov eax, dword [esp + 0x14]
push 0
push eax
call ebp
push 0x40040
push 0x4b3a54
push 0x4b39c8
push 0
call ebx
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Maxlinks
call fcn.00404200
mov ecx, 0x4d3364
call fcn.00431c90
xor edx, edx
mov ecx, 0x15
div ecx
push 1
mov edi, edx
call fcn.00417a30
add esp, 4
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [eax + 8], edi
push str.LinkType
call fcn.00404200
mov ecx, 0x4d3364
call fcn.00431c90
xor edx, edx
mov ecx, 6
div ecx
push 1
mov edi, edx
call fcn.00417a30
add esp, 4
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.LimitSize
mov dword [eax + 4], edi
call fcn.00404200
mov ecx, 0x4d3364
call fcn.00431c90
mov dword [esi + 0x148], eax
mov eax, dword [esp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [esp + 0x28], esp
mov edi, esp
push eax
call fcn.004015e0
add eax, 0x10
mov dword [edi], eax
lea edi, [esi + 0x6c]
add esp, 4
mov ecx, edi
call fcn.00432a50
lea eax, [esi + 0x50]
lea ecx, [esp + 0x28]
mov dword [esi + 0x9c], eax
call fcn.004944d7
lea edx, [esp + 0x28]
mov bl, 0xb
push edx
mov ecx, edi
mov byte [esp + 0x48], bl
call fcn.00436cf0
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.260435645
call fcn.00404200
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Settings
mov byte [esp + 0x54], 0xc
call fcn.00404200
mov ecx, 0x4d2c80
mov byte [esp + 0x50], bl
call fcn.00435e90
cmp eax, 0xb271
jne 0x43a35d
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.260435645
call fcn.00404200
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Settings
mov byte [esp + 0x54], 0xd
call fcn.00404200
mov ecx, 0x4d2c80
mov byte [esp + 0x50], bl
call fcn.00435ff0
mov ecx, edi
call fcn.004378a0
push str.cachestatic
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
call fcn.004023c0
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
call ebp
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a399
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.cachetemp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004023c0
mov eax, dword [eax]
add esp, 0xc
push 0
push eax
call ebp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x43a3d5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.cachestatic
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.004023c0
lea ebp, [esi + 0xa0]
add esp, 0xc
mov ecx, ebp
call fcn.00432a50
lea edx, [esp + 0x28]
push edx
mov ecx, ebp
call fcn.00436cf0
push ecx
mov eax, esp
mov dword [esp + 0x28], esp
push str.cachetemp
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.004023c0
lea ebp, [esi + 0xd4]
add esp, 0xc
mov ecx, ebp
call fcn.00432a50
lea edx, [esp + 0x28]
push edx
mov ecx, ebp
call fcn.00436cf0
push 0x116c
call fcn.00495591
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x44], 0xe
je 0x43a45e
mov ecx, eax
call fcn.0040c130
jmp 0x43a460
xor eax, eax
push 0
lea ecx, [esi + 0x30]
push ecx
mov ecx, eax
mov byte [esp + 0x4c], bl
mov dword [esi + 0x58], eax
call fcn.0040b5d0
push 0x116c
call fcn.00495591
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x44], 0xf
je 0x43a497
mov ecx, eax
call fcn.0040c130
jmp 0x43a499
xor eax, eax
push 0x3a4
mov byte [esp + 0x48], bl
mov dword [esi + 0x60], eax
call fcn.00495591
add esp, 4
mov dword [esp + 0x24], eax
test eax, eax
mov byte [esp + 0x44], 0x10
je 0x43a4c3
mov ecx, eax
call fcn.00439730
jmp 0x43a4c5
xor eax, eax
push 0
push 0x4d2c98
push 0x4d2c80
push edi
push 0x1bb5
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
push 0x4b36ec
mov byte [esp + 0x64], bl
mov dword [esi + 0x108], eax
call fcn.00404200
mov ecx, 0x4d3364
call fcn.00431c90
mov edx, dword [esi + 0x60]
mov ecx, dword [esi + 0x108]
push eax
push edx
call fcn.00437a10
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4b41fc
call fcn.00404200
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Status
mov byte [esp + 0x54], 0x11
call fcn.00404200
mov ecx, 0x4d2c98
mov byte [esp + 0x50], bl
call fcn.00435e90
push 0
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x4b41f4
mov dword [esi + 0x140], eax
call fcn.00404200
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Status
mov byte [esp + 0x54], 0x12
call fcn.00404200
mov ecx, 0x4d2c98
mov byte [esp + 0x50], bl
call fcn.00435e90
push str.http:__220.181.23.202_
mov dword [esi + 0x144], eax
lea edi, [esi + 0x154]
call fcn.0047e9ef
add esp, 4
push eax
push str.http:__220.181.23.202_
mov ecx, edi
call fcn.00401b00
push 0x4b4194
lea edi, [esi + 0x158]
call fcn.0047e9ef
add esp, 4
push eax
push 0x4b4194
mov ecx, edi
call fcn.00401b00
mov ecx, dword [esi + 0x58]
mov eax, dword [ecx]
push 1
push 0
push 0x1bb4
push 0
push 0
call dword [eax + 8]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x64], eax
mov edx, dword [ecx]
push eax
call dword [edx + 0x28]
push 0
push 0x2932e00
push 0
push 1
mov ecx, esi
mov word [esi + 0x164], ax
mov word [esi + 0x166], ax
call fcn.0040d980
push 0
push 0x927c0
push 0
push 3
mov ecx, esi
call fcn.0040d980
push 0
push 0xea60
push 0
push 4
mov ecx, esi
call fcn.0040d980
lea ecx, [esp + 0x28]
mov byte [esp + 0x44], 8
call fcn.00494529
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x44], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a65e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x44], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a681
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x44], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43a6a7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret