Function at 0x40a830
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x454717
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
mov eax, dword [0x46da7c]
push ebx
mov dword [esp + 0x254], eax
mov ebx, ecx
xor eax, eax
push esi
push edi
mov byte [esp + 0x48], 0
mov ecx, 0x40
lea edi, [esp + 0x49]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x150], 0
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x151]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0043e731
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
push 0x457828
lea ecx, [esp + 0x34]
mov dword [esp + 0x270], 0
call fcn.00402ca0
push 0x457828
lea ecx, [esp + 0x10]
mov byte [esp + 0x270], 1
call fcn.00402ca0
push 0x24
push 0x4586e8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x274], 2
call fcn.00402820
push 0x27
push 0x4586c0
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0x14]
lea edi, [ebx + 0x344]
push eax
mov ecx, edi
call fcn.00444355
mov ecx, dword [esp + 0xc]
lea esi, [ebx + 0x708]
push ecx
mov ecx, esi
call fcn.00444355
push 0x2c
lea ecx, [ebx + 0x830]
push 0x458690
call fcn.00402820
push 0x2a
push 0x458664
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00444355
push 0x26
push 0x45863c
lea ecx, [esp + 0x1c]
call fcn.00402820
push 0x29
push 0x458610
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.00444355
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00444355
push 0x2e
push 0x4585e0
lea ecx, [ebx + 0x830]
call fcn.00402820
push 0x2c
push 0x4585b0
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00444355
push 0x26
push 0x458588
lea ecx, [esp + 0x1c]
call fcn.00402820
push 0x29
push 0x45855c
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.00444355
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00444355
push 0x2e
push 0x45852c
lea ecx, [ebx + 0x830]
call fcn.00402820
push 0x2c
push 0x4584fc
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00444355
push 0x26
push 0x4584d4
lea ecx, [esp + 0x1c]
call fcn.00402820
push 0x29
push 0x4584a8
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.00444355
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00444355
push 0x2e
push 0x458478
lea ecx, [ebx + 0x830]
call fcn.00402820
push 0x2c
push 0x458448
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00444355
push 0x2b
push 0x45841c
lea ecx, [esp + 0x1c]
call fcn.00402820
push 0x2e
push 0x4583ec
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0x14]
push eax
mov ecx, edi
call fcn.00444355
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00444355
push 0x33
push 0x4583b8
lea ecx, [ebx + 0x830]
call fcn.00402820
push 0x31
push 0x458384
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
mov ecx, esi
call fcn.00444355
mov eax, dword [ebx + 0x81c]
test eax, eax
mov dword [esp + 0x24], 0
jle 0x40b195
mov esi, 0x46efd0
mov eax, dword [esi + 0x38]
test eax, eax
mov eax, dword [esi + 0x3c]
je 0x40b122
test eax, eax
jne 0x40ac5a
mov eax, dword [esi + 8]
lea edx, [esp + 0x150]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40ab23
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x457828
call fcn.00402ca0
mov eax, dword [esi + 0xc]
push ecx
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
mov byte [esp + 0x278], 3
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
add esp, 4
lea eax, [esp + 0x30]
push eax
mov ecx, ebx
mov byte [esp + 0x278], 2
call fcn.00406c00
mov eax, dword [eax]
lea edi, [esp + 0x48]
jmp 0x40ab80
mov cl, byte [eax]
inc eax
mov byte [edi], cl
inc edi
test cl, cl
jne 0x40ab80
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40aba8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push esi
lea ecx, [esp + 0x18]
call fcn.004029c0
push 0x15
push 0x45836c
lea ecx, [esp + 0x1c]
call fcn.00402820
mov eax, dword [esp + 0x14]
push eax
lea ecx, [ebx + 0x344]
call fcn.00444355
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402820
push 0x18
push 0x458350
lea ecx, [esp + 0x14]
call fcn.00402820
mov ecx, dword [esp + 0xc]
push ecx
lea ecx, [ebx + 0x708]
call fcn.00444355
lea ecx, [esp + 0x34]
call fcn.00401480
lea edx, [esp + 0x34]
push edx
push 0
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x15c]
push ecx
push 0
mov dword [esp + 0x4c], ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jl 0x40ac4c
push 1
push 0x45834c
push 0x458348
lea edx, [esp + 0x54]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x34]
call fcn.00401340
jmp 0x40ae91
call fcn.0043e731
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
push 0xa8
mov byte [esp + 0x270], 4
call fcn.0043eb95
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
mov byte [esp + 0x26c], 5
je 0x40ac9d
mov ecx, eax
call fcn.0040c480
mov edi, eax
jmp 0x40ac9f
xor edi, edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x457828
mov byte [esp + 0x274], 4
call fcn.00402ca0
mov ecx, edi
call fcn.0040c2b0
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
lea ecx, [esp + 0x18]
call fcn.004029c0
push 0x15
push 0x45836c
lea ecx, [esp + 0x1c]
call fcn.00402820
mov ecx, dword [esp + 0x14]
push ecx
lea ecx, [ebx + 0x344]
call fcn.00444355
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402820
push 0x18
push 0x458350
lea ecx, [esp + 0x14]
call fcn.00402820
mov edx, dword [esp + 0xc]
push edx
lea ecx, [ebx + 0x708]
call fcn.00444355
mov eax, dword [esi + 8]
push 1
push 0
push ecx
mov dword [esp + 0x1c], esp
sub eax, 0x10
mov dword [esp + 0x1c], esp
push eax
call fcn.00401c00
mov ecx, dword [esp + 0x20]
add eax, 0x10
mov dword [ecx], eax
add esp, 4
mov ecx, edi
call fcn.0040d5b0
lea edx, [esp + 0x2c]
push edx
mov ecx, edi
call fcn.0040d240
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x270], 6
call fcn.004029c0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x26c], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ad9f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
cmp dword [edi + 0x9c], 1
je 0x40add1
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0x14], esp
add eax, 0xfffffff0
mov dword [esp + 0x14], esp
push eax
call fcn.00401c00
mov ecx, dword [esp + 0x18]
add eax, 0x10
mov dword [ecx], eax
add esp, 4
mov ecx, ebx
call fcn.004095c0
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 4]
cmp dword [esi + 0x3c], 5
mov edi, dword [esp + 0x18]
jne 0x40adfb
push 1
push 0x45834c
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esi + 0x3c], 6
jne 0x40ae18
push 1
push 0x45834c
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esi + 0x3c], 8
jne 0x40ae35
push 1
push 0x45834c
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esi + 0x3c], 7
jne 0x40ae52
push 1
push 0x45834c
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [esi + 0x3c], 9
jne 0x40ae6f
push 1
push 0x45834c
push 0
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [edi - 0x10]
mov byte [esp + 0x26c], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ae91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
lea edi, [ebx + 0x830]
push eax
mov ecx, edi
call fcn.00402820
push 0x1d
push 0x458328
mov ecx, edi
call fcn.00402820
mov eax, dword [esi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x14]
call fcn.00402820
push 0x1b
push 0x45830c
lea ecx, [esp + 0x14]
call fcn.00402820
mov eax, dword [esp + 0xc]
push eax
lea ecx, [ebx + 0x708]
call fcn.00444355
mov eax, dword [esi + 0x3c]
cmp eax, 1
jne 0x40af2f
mov eax, dword [esi + 0x2c]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [ebx + 0x7f0]
mov byte [esp + 0x278], 7
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00416a60
jmp 0x40b178
cmp eax, 3
jne 0x40af78
mov eax, dword [esi + 0x2c]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
mov ecx, dword [ebx + 0x7f0]
mov edx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x278], 8
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00417130
jmp 0x40b178
cmp eax, 7
jne 0x40afc1
mov eax, dword [esi + 0x2c]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
mov ecx, dword [ebx + 0x7f0]
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x278], 9
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00416c30
jmp 0x40b178
cmp eax, 9
jne 0x40b012
mov eax, dword [esi + 0x2c]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
mov eax, dword [esi + 0x30]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov edi, esp
push eax
mov byte [esp + 0x278], 0xa
call fcn.00401c00
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x274], 2
call fcn.00417620
jmp 0x40b178
cmp eax, 4
jne 0x40b05b
mov eax, dword [esi + 0x2c]
push ecx
sub eax, 0x10
mov dword [esp + 0x14], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
mov dword [edi], eax
mov ecx, esp
mov dword [esp + 0x20], esp
push ecx
mov ecx, dword [ebx + 0x7f0]
mov byte [esp + 0x278], 0xb
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00416d30
jmp 0x40b178
cmp eax, 5
jne 0x40b09d
push ecx
lea edx, [esi + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00401c60
push ecx
mov ecx, dword [ebx + 0x7f0]
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x278], 0xc
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00416e30
jmp 0x40b178
cmp eax, 6
jne 0x40b0df
push ecx
lea edx, [esi + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00401c60
push ecx
mov ecx, dword [ebx + 0x7f0]
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x278], 0xd
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00416f30
jmp 0x40b178
cmp eax, 8
jne 0x40b17b
push ecx
lea edx, [esi + 0x2c]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00401c60
push ecx
mov ecx, dword [ebx + 0x7f0]
mov eax, esp
mov dword [esp + 0x20], esp
push eax
mov byte [esp + 0x278], 0xe
call fcn.004025d0
mov byte [esp + 0x274], 2
call fcn.00417030
jmp 0x40b178
test eax, eax
jne 0x40b17b
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x1c]
push ecx
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00417a60
mov eax, dword [esp + 0x24]
add esp, 8
inc eax
push eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x40]
push ecx
sub eax, 0x10
mov dword [esp + 0x18], esp
mov edi, esp
push eax
call fcn.00401c00
add eax, 0x10
add esp, 4
mov dword [edi], eax
call fcn.00417940
add esp, 8
mov eax, dword [esp + 0x24]
mov ecx, dword [ebx + 0x81c]
inc eax
add esi, 0x50
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x40ab01
lea edx, [esp + 0x20]
push edx
call fcn.00418b00
mov eax, dword [esp + 0x24]
inc eax
push eax
mov dword [esp + 0x28], eax
call fcn.00418a00
mov eax, dword [ebx + 0x70]
mov eax, dword [eax + 0x1c]
add esp, 8
push 0
push 0x64
push 0x402
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebx + 0x1c]
push 0
push 0x3e8
push 1
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov byte [esp + 0x26c], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40b200
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x26c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b226
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0x26c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b24f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x264]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x25c]
call fcn.0042d9b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret