Function at 0x402a70
Capabilities:
Download url
Execute command
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408998
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x40c018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
push str.https:__shiroryu.com_xnn_File3.mentah
mov dword [ebp - 4], ebx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
test eax, eax
js 0x402bfa
cmp dword [ebp + 0x1c], 0x10
mov eax, dword [ebp + 8]
jae 0x402abf
lea eax, [ebp + 8]
push ebx
push ebx
push eax
push str.https:__shiroryu.com_xnn_File3.mentah
push ebx
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
cmp eax, ebx
jl 0x402bc0
lea eax, [ebp + 8]
push eax
call fcn.00402880
add esp, 4
cmp al, 1
jne 0x402b86
sub esp, 0x1c
mov ecx, esp
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], 0xf
lea edx, [ebp + 8]
mov dword [ebp - 0x2c], esp
mov byte [ecx], bl
push edx
or eax, 0xffffffff
xor ebx, ebx
call fcn.00405a70
call fcn.00402a00
add esp, 0x1c
cmp eax, 0x1388
jle 0x402b49
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xb
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp dword [ebp + 0x1c], 0x10
jb 0x402b3f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, 1
jmp 0x402c71
mov ebx, dword [sym.imp.MSVCR100.dll_system]
push 0x40954c
call ebx
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, 0x409550
sub edi, 0x80d1ab9
lea esi, [ebp - 0x28]
call fcn.00406890
mov byte [ebp - 4], 1
jmp 0x402c32
mov ebx, dword [sym.imp.MSVCR100.dll_system]
push 0x40954c
call ebx
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, 0x409564
sub edi, 0x752b9b1b
lea esi, [ebp - 0x28]
call fcn.004068d0
mov byte [ebp - 4], 2
jmp 0x402c32
mov ebx, dword [sym.imp.MSVCR100.dll_system]
push 0x40954c
call ebx
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, str._ulrqqD
sub edi, 0x41e62933
lea esi, [ebp - 0x28]
call fcn.00406910
mov byte [ebp - 4], 3
jmp 0x402c32
mov ebx, dword [sym.imp.MSVCR100.dll_system]
push 0x40954c
call ebx
add esp, 4
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 0xc
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov edi, 0x409588
sub edi, 0x67dfe3d8
lea esi, [ebp - 0x28]
call fcn.00406950
mov byte [ebp - 4], 4
mov ecx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char______cdecl_std::endl_class_std::basic_ostream_char__struct_std::char_traits_char____]
mov edx, dword [sym.imp.MSVCP100.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push ecx
push ecx
push eax
push edx
call fcn.00401090
add esp, 0xc
mov ecx, eax
call dword [sym.imp.MSVCP100.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push str.pause
call ebx
add esp, 4
cmp dword [ebp + 0x1c], 0x10
jb 0x402c6f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004078a0
mov esp, ebp
pop ebp
ret