Function at 0x1000115d
Capabilities:
Accept command line arguments
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a84
call fcn.10006170
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x18], eax
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xa83]
mov byte [ebp - 0xa84], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3ff
xor eax, eax
lea edi, [ebp - 0x1a83]
mov byte [ebp - 0x1a84], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x283]
mov byte [ebp - 0x284], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x284]
mov dword [ebp - 8], ebx
push eax
push esi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x284]
push str.SerList.xml
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x284]
pop ecx
push ebx
push ebx
push eax
push str.http:__patch.dn.sdo.com_sndalist_sndalist_new.xml
push ebx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x100013a0
push 0x40
lea edi, [ebp - 0x17f]
pop ecx
mov byte [ebp - 0x180], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x7b]
mov byte [ebp - 0x7c], bl
push 0x100090b8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x284]
mov dword [ebp - 0x10], ebx
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0x180]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0x14
test eax, eax
je 0x100013a0
lea eax, [ebp - 0xa84]
mov edi, 0x100090b4
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x1a84]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x180]
push str.Local_local_name
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x100012e7
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x180]
push str.Local_local_name_
push eax
call fcn.10004fdf
add esp, 0x10
cmp dword [ebp - 0x14], ebx
je 0x100012d4
push 0x3a8
lea eax, [ebp - 0x7c]
push 0xfde9
push eax
call fcn.1000506e
push eax
mov dword [ebp - 0x10], 1
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
add esp, 0x14
jmp 0x10001384
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 4]
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
jmp 0x10001384
lea eax, [ebp - 0x180]
push str.login_addr
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x10001339
cmp dword [ebp - 0x10], ebx
je 0x10001339
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x180]
push str.login_addr_
push eax
call fcn.10004fdf
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0xc]
call sub.MSVCRT.dll_strcpy
add dword [ebp - 4], 0x40
add esp, 0x18
inc dword [ebp - 8]
add dword [ebp - 0xc], 0x20
mov dword [ebp - 0x10], ebx
jmp 0x10001384
lea eax, [ebp - 0x180]
push str.encoding
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
je 0x10001384
lea eax, [ebp - 0x7c]
push eax
push edi
lea eax, [ebp - 0x180]
push str.encoding_
push eax
call fcn.10004fdf
lea eax, [ebp - 0x7c]
push str.utf_8
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 0x18
test eax, eax
jne 0x10001384
mov dword [ebp - 0x14], 1
push dword [ebp - 0x1c]
lea eax, [ebp - 0x180]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_fgets]
add esp, 0xc
test eax, eax
jne 0x10001273
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x3b]
mov byte [ebp - 0x3c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x3c]
push eax
push 0x1000904c
push 0x10009048
push dword [ebp - 0x18]
call fcn.10004fdf
add esp, 0x10
cmp dword [ebp - 8], ebx
jle 0x1000140f
lea esi, [ebp - 0xa84]
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
test eax, eax
pop ecx
jne 0x100013f0
inc ebx
add esi, 0x20
cmp ebx, dword [ebp - 8]
jl 0x100013d4
jmp 0x1000140f
shl ebx, 6
lea esi, [ebp + ebx - 0x1a84]
push esi
call sub.MSVCRT.dll_strlen
push eax
push esi
push 0x10090ae8
call sub.MSVCRT.dll_memcpy
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
push 0x10090c70
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret