Function at 0x41d590
Capabilities:
Delete file
Download url
Move file
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x148], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
push 0x100
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.0042a4e0
mov eax, dword [0x4576bc]
add esp, 0xc
mov edi, dword [0x4574cc]
add eax, 0xb
movzx eax, ax
xorps xmm0, xmm0
mov dword [ebp - 0x144], eax
movzx eax, ax
mov dword [ebp - 0x130], eax
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 8], 0
lea eax, [eax*2 + 0x21c]
movq qword [ebp - 0x24], xmm0
push eax
push 0
push dword [0x45764c]
mov dword [ebp - 0x1c], 0
movups xmmword [ebp - 0x180], xmm0
mov byte [ebp - 0x129], 0
movq qword [ebp - 0x170], xmm0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x134], eax
test eax, eax
jne 0x41d65d
mov dword [0x45771c], 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4576bc]
movups xmm0, xmmword [str.Oscdimg.tmp]
movups xmmword [edi + eax*2], xmm0
movq xmm0, qword [0x44cc34]
movq qword [edi + eax*2 + 0x10], xmm0
lea eax, [ebp - 0x168]
push eax
push 0
push edi
push str.http:__download.microsoft.com_download_5_D_9_5D915042_FCAA_4859_A1C3_29E198690493_adk_Installers_5d984200acbde182fd99cbfbe9bad133.cab
push 0
mov dword [ebp - method.URLDownloadStatus.virtual_0], vtable.URLDownloadStatus.0
mov dword [ebp - 0x164], esi
mov dword [ebp - 0x160], str.Download:_Oscdimg
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x154], 0
mov byte [ebp - 0x150], 1
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x41d9b2
push eax
push 0x2000080
push 3
push eax
push 7
push 0x120089
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x13c], ebx
cmp ebx, 0xffffffff
je 0x41d9b2
lea eax, [ebp - 0x24]
push 0
push eax
lea edx, [ebp - 0x180]
lea ecx, [ebp - 0x13c]
call fcn.00409130
mov eax, dword [ebp - 0x17c]
add esp, 8
xor ecx, ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], ecx
cmp eax, 0x63
ja 0x41d739
lea eax, [ecx + 1]
mov dword [ebp - 0x13c], ecx
jmp 0x41d74a
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0x13c], edx
push ebx
mov dword [esi + 0x68], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x124], eax
lea eax, [ebp - 0x24]
push eax
push 0xffffffffffffffff
push 0x407cd0
push 0x407cb0
push 0x407c20
push 0x407bf0
push 0x407b10
push 0x4076e0
push 0x4076c0
mov byte [ebp - 0x112], 0
mov dword [ebp - 0x1c], 1
mov dword [0x45754c], esi
mov dword [ebp - 0x2c], esi
call dword [sym.imp.Cabinet.dll_FDICreate]
mov esi, eax
add esp, 0x24
mov dword [ebp - 0x13c], esi
test esi, esi
jne 0x41d7c2
mov eax, dword [ebp - 0x20]
mov dword [0x45771c], eax
jmp 0x41d9b2
mov word [0x4575a3], 0x5c
mov ecx, edi
mov bl, 1
mov edx, 0x4575a3
test edi, edi
je 0x41d988
nop dword [eax]
mov eax, ecx
dec edx
and eax, 0xf
shr ecx, 4
inc bl
mov al, byte [eax + 0x44e588]
mov byte [edx], al
test ecx, ecx
jne 0x41d7e0
cmp bl, 0x16
jbe 0x41d803
push 0x6f
jmp 0x41d98a
inc bl
movzx eax, bl
push eax
push edx
lea eax, [ebp - 0x18]
push eax
call fcn.0043c9e0
mov ebx, dword [ebp - 0x130]
add esp, 0xc
lea eax, [ebx*2 + 2]
push eax
push edi
push dword [ebp - 0x124]
call fcn.0043c9e0
mov eax, dword [ebp - 0x124]
mov ecx, 0x5c
add esp, 0xc
mov word [eax + ebx*2 - 8], cx
mov eax, dword [ebp - 0x144]
add eax, 0xfffffffd
mov word [ebp - 0x11a], ax
mov word [ebp - 0x128], ax
movzx ecx, ax
mov eax, dword [ebp - 0x124]
lea eax, [eax + ecx*2]
mov dword [ebp - 0x120], eax
lea eax, [ebp - 0x128]
push eax
push 0
push 0x407cf0
push 0
lea eax, [ebp - 0x18]
push eax
push str.______
push esi
call dword [sym.imp.Cabinet.dll_FDICopy]
add esp, 0x1c
mov esi, eax
push dword [ebp - 0x13c]
call dword [sym.imp.Cabinet.dll_FDIDestroy]
add esp, 4
test esi, esi
jne 0x41d8b1
mov eax, dword [ebp - 0x20]
mov dword [0x45771c], eax
jmp 0x41d9b8
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [str.fil720cc132fbb53f3bed2e525eb77bdbc1]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push dword [ebp - 0x148]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44cc50]
movups xmmword [eax + 0x10], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44cc60]
movups xmmword [eax + 0x20], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44cc70]
movups xmmword [eax + 0x30], xmm0
mov eax, dword [ebp - 0x120]
movq xmm0, qword [0x44cc80]
movq qword [eax + 0x40], xmm0
push dword [ebp - 0x124]
call esi
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [str.fildc9e47de8509317bd346a3f0d9d130ef]
push dword [ebp - 0x14c]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44cc98]
movups xmmword [eax + 0x10], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44cca8]
movups xmmword [eax + 0x20], xmm0
mov eax, dword [ebp - 0x120]
movups xmm0, xmmword [0x44ccb8]
movups xmmword [eax + 0x30], xmm0
mov eax, dword [ebp - 0x120]
movq xmm0, qword [0x44ccc8]
movq qword [eax + 0x40], xmm0
push dword [ebp - 0x124]
call esi
mov byte [ebp - 0x129], 1
jmp 0x41d9b8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 2
mov dword [0x45771c], 2
call dword [sym.imp.Cabinet.dll_FDIDestroy]
add esp, 4
mov ebx, dword [ebp - 0x130]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
push ecx
mov ecx, edi
mov word [edi + ebx*2 - 8], ax
call fcn.004083b0
add esp, 4
xor eax, eax
mov word [edi + ebx*2 - 0x16], ax
push dword [ebp - 0x134]
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x129]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00428cd6
mov esp, ebp
pop ebp
ret