Function at 0x1000ed00
Capabilities:
Check http status code
Check if file exists
Delete file
Download and write a file
Get http content length
Move file
Read data from internet
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Send data
Send http request
Set file attributes
Timestomp file
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x1001a851
mov eax, dword fs:[0]
push eax
sub esp, 0x3cc
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x3c8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10023050]
xor eax, esp
push eax
lea eax, [esp + 0x3e0]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
lea esi, [edi + 0x4c]
mov dword [esp + 0x58], ebx
call fcn.100047f0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.100044b0
xor ebx, ebx
mov dword [esp + 0x3e8], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
cmp eax, ebx
je 0x1000ed7d
push 0x1001e3c0
lea edx, [esp + 0x18]
push edx
lea edx, [ebx + 3]
call fcn.1000c3c0
push edi
mov ecx, str.http:__rsdownload.rising.com.cn_pcver2012_rsd_ravv16rsd.exe
call fcn.10010120
test eax, eax
jne 0x1000edc1
mov dword [esp + 0x3e8], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000edb7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, SysReAllocStringLen
jmp 0x1000fb4c
cmp dword [edi + 0x48], ebx
je 0x1000edcd
mov esi, edi
call fcn.100107a0
cmp dword [edi + 0x44], ebx
je 0x1000ee0e
mov esi, edi
call fcn.100107a0
mov dword [esp + 0x3e8], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ee04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 2
jmp 0x1000fb4c
mov edx, dword [0x10023afc]
mov eax, dword [edx + 0xc]
mov ecx, 0x10023afc
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0x3e8], 1
mov eax, dword [edi + 0x28]
lea ebp, [edi + 0x28]
push 0x2f
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.MSVCR90.dll__mbsrchr]
add esp, 8
cmp eax, ebx
jne 0x1000ee50
or eax, 0xffffffff
jmp 0x1000ee53
sub eax, dword [ebp]
lea ecx, [eax + 1]
lea esi, [esp + 0x30]
mov edx, ebp
call fcn.100107f0
lea ebx, [esp + 0x28]
mov byte [esp + 0x3e8], 2
call fcn.1000c020
mov byte [esp + 0x3e8], 1
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ee9a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], 1
mov eax, dword [ecx - 0xc]
xor ebx, ebx
cmp eax, ebx
je 0x1000eed6
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x1000eed6
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000eed6
mov eax, dword [edi + 0x50]
lea edx, [esp + 0x1c]
push edx
push ebx
push 0xbd8
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, edi
call fcn.1000e9c0
test eax, eax
jne 0x1000ef3b
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ef08
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3e8], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ef33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
or eax, 0xffffffff
jmp 0x1000fb4c
cmp dword [edi + 0x44], ebx
je 0x1000efa7
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ef6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x3e8], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000ee04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 2
jmp 0x1000fb4c
mov eax, dword [ebp]
mov ecx, dword [edi + 8]
push ebx
push 0x4600010
push 0x100239d4
push ebx
push str.HTTP_1.0
push eax
push 0x1001e3d0
push ecx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [edi + 0xc], eax
cmp eax, ebx
jne 0x1000f01a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000f009
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
or eax, 0xffffffff
jmp 0x1000fb4c
push 0x10f
lea ecx, [esp + 0x2d1]
push ebx
push ecx
mov byte [esp + 0x2d8], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x40
lea edx, [esp + 0x1b1]
push ebx
push edx
mov byte [esp + 0x1b8], bl
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov esi, dword [esp + 0x14]
mov eax, dword [esi - 0xc]
cmp eax, ebx
je 0x1000f0fc
push 0x13c
lea ecx, [esp + 0x74]
push ebx
push ecx
mov dword [esp + 0x78], ebx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [esp + 0x6c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x1000f0fc
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x24], eax
cmp eax, ebx
jbe 0x1000f0e1
push eax
lea edx, [esp + 0x1b0]
push str.Range:_bytes_d_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [esp + 0x30], 1
jmp 0x1000f0fc
mov eax, dword [esp + 0x14]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [edi + 0x44], ebx
je 0x1000f142
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000f12f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, 2
jmp 0x1000fb4c
push ebx
push ebx
lea ecx, [esp + 0x1b4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [edi + 0xc]
lea edx, [esp + 0x1b8]
push edx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
jne 0x1000f20a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
mov edi, dword [edi + 0x54]
sub edi, 0x2ee2
je 0x1000f1d0
sub edi, 5
je 0x1000f196
sub edi, 0x16
jne 0x1000f416
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000f1bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_VariantClear
jmp 0x1000fb4c
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000f1f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, VariantClear
jmp 0x1000fb4c
cmp dword [edi + 0x44], ebx
je 0x1000f236
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x1000f123
mov eax, dword [edi + 0xc]
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x48]
push edx
push 0x20000013
push eax
mov dword [esp + 0x54], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000f406
mov eax, dword [esp + 0x40]
xor ebp, ebp
mov dword [esp + 0x2c], ebp
cmp eax, 0x12e
ja 0x1000f48b
cmp eax, 0x12d
jae 0x1000f3c0
sub eax, 0xc8
je 0x1000f36a
sub eax, 3
je 0x1000f29d
sub eax, 3
jne 0x1000f4a8
push 0x40
lea ecx, [esp + 0x241]
push ebx
push ecx
mov byte [esp + 0x248], bl
call sub.MSVCR90.dll_memset
mov ecx, dword [edi + 0xc]
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x244]
push eax
push 0xb
push ecx
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1000f2fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x14]
push edx
mov dword [edi + 0x54], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x24], ebx
jmp 0x1000f40f
lea esi, [esp + 0x48]
lea ecx, [esp + 0x23c]
call fcn.100103c0
mov cx, word [esp + 0x54]
cmp cx, word [esp + 0x68]
jne 0x1000f356
mov dx, word [esp + 0x52]
cmp dx, word [esp + 0x66]
jne 0x1000f356
mov ax, word [esp + 0x50]
cmp ax, word [esp + 0x64]
jne 0x1000f356
mov cx, word [esp + 0x4e]
cmp cx, word [esp + 0x62]
jne 0x1000f356
mov dx, word [esp + 0x4a]
cmp dx, word [esp + 0x5e]
jne 0x1000f356
mov ax, word [esp + 0x48]
cmp ax, word [esp + 0x5c]
je 0x1000f4bb
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [esp + 0x24], ebx
jmp 0x1000f4b2
mov eax, dword [esp + 0x14]
cmp dword [eax - 0xc], ebx
jne 0x1000f3b4
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000f3a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x1000fb4c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000f4bb
push 0x401
call fcn.1001905b
add esp, 4
push 0x401
mov ebp, eax
push ebx
push ebp
call sub.MSVCR90.dll_memset
mov edx, dword [edi + 0xc]
add esp, 0xc
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebp
push 0x21
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1000f436
push ebp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x54], eax
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x1000effd
mov edx, ebp
lea ebx, [edi + 0x4c]
call fcn.10004550
mov esi, edi
call fcn.100107a0
push ebp
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
mov byte [esp + 0x3ec], 0
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000f478
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, 1
jmp 0x1000fb4c
sub eax, 0x193
je 0x1000fb07
sub eax, 1
je 0x1000fac0
sub eax, 0x60
je 0x1000fa7d
cmp dword [esp + 0x30], ebx
je 0x1000fa6f
mov ebp, 1
mov dword [esp + 0x2c], ebp
cmp dword [edi + 0x44], ebx
jne 0x1000f20f
cmp ebp, ebx
je 0x1000f562
mov ecx, dword [edi + 0xc]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [edi + 0x28]
mov edx, dword [edi + 8]
push ebx
push 0x4600010
push 0x100239d4
push ebx
push str.HTTP_1.0
push eax
push 0x1001e3d0
push edx
call dword [sym.imp.WININET.dll_HttpOpenRequestA]
mov dword [edi + 0xc], eax
cmp eax, ebx
je 0x1000f406
cmp dword [edi + 0x44], ebx
jne 0x1000f20f
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x1000f406
cmp dword [edi + 0x44], ebx
jne 0x1000f20f
mov eax, dword [edi + 0xc]
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x48]
push edx
push 0x20000013
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000f406
cmp dword [esp + 0x40], 0xc8
jne 0x1000f406
push 0x40
lea ecx, [esp + 0x1f9]
push ebx
push ecx
mov byte [esp + 0x200], bl
call sub.MSVCR90.dll_memset
mov ecx, dword [edi + 0xc]
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1fc]
push eax
push 0xb
push ecx
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x1000f5b2
lea esi, [esp + 0x48]
lea ecx, [esp + 0x1f4]
call fcn.100103c0
mov ecx, dword [edi + 0xc]
push ebx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x4c]
push eax
push 0x20000005
push ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x2c], 4
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1000f5e8
mov dword [esp + 0x44], 0x32000
mov dword [esp + 0x24], ebx
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
add eax, edx
mov dword [esp + 0x20], eax
mov dword [edi + 0x5c], eax
mov dword [esp + 0x1c], 2
cmp dword [ecx - 0xc], ebx
je 0x1000f631
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x1000f631
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000f631
mov eax, dword [edi + 0x50]
lea edx, [esp + 0x1c]
push edx
push ebx
push 0xbd8
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [edi + 0x44], ebx
jne 0x1000f20f
mov ecx, dword [esp + 0x14]
call fcn.1000ebd0
test eax, eax
jne 0x1000f688
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000f675
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, SysReAllocStringLen
jmp 0x1000fb4c
mov ecx, dword [esp + 0x14]
push ebx
push 0x80
push 4
push ebx
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x1000f6cd
mov esi, edi
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x1000f669
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
cmp dword [esp + 0x2c], ebx
je 0x1000f704
push ebx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1000f70f
push 2
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x1001
call fcn.1001905b
mov esi, eax
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x1c], 3
mov edi, edi
push 0x1001
push ebx
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
cmp dword [edi + 0x44], ebx
jne 0x1000f813
mov edx, dword [edi + 0xc]
lea ecx, [esp + 0x3c]
push ecx
push 0x1000
push esi
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1000f85f
mov eax, dword [esp + 0x3c]
add dword [esp + 0x24], eax
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x1000f794
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000f794
mov edx, dword [edi + 0x50]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0xbd8
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x3c]
cmp eax, ebx
jbe 0x1000f7b9
push ebx
lea ecx, [esp + 0x34]
push ecx
push eax
push esi
push ebp
mov dword [esp + 0x44], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x3c], ebx
ja 0x1000f730
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x20]
jae 0x1000f8f0
mov esi, edi
call fcn.100107a0
mov edx, dword [esp + 0x2c]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f416
mov edx, dword [esp + 0x2c]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
mov esi, edi
call fcn.100107a0
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000f216
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
mov ecx, dword [esp + 0x2c]
push ecx
mov dword [edi + 0x54], eax
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
call esi
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea ecx, [esp + 0x34]
push ecx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000f8dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_VariantCopy
jmp 0x1000fb4c
mov eax, dword [edi + 0x50]
cmp eax, ebx
je 0x1000f917
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1000f917
mov edx, dword [edi + 0x50]
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0xbd8
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x40
lea eax, [esp + 0x289]
push ebx
push eax
mov byte [esp + 0x290], bl
call sub.MSVCR90.dll_memset
mov eax, dword [edi + 0xc]
add esp, 0xc
push ebx
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28c]
push edx
push 0x17
push eax
mov dword [esp + 0x2c], 0x40
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1000f96d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
mov esi, dword [esp + 0x2c]
jmp 0x1000f99e
push str.close
lea ecx, [esp + 0x288]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000f991
mov esi, edi
call fcn.100107a0
mov esi, dword [esp + 0x2c]
jmp 0x1000f99e
mov edx, dword [edi + 0xc]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [edi + 0xc], ebx
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void__
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebp
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [esp + 0x34]
push edx
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x1000f9fc
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x14]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
or edx, 0xffffffff
mov byte [esp + 0x3e8], bl
test eax, eax
mov eax, dword [esp + 0x28]
jne 0x1000fa46
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000fa33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_SysReAllocStringLen
jmp 0x1000fb4c
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000fa5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
xor eax, eax
jmp 0x1000fb4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x54], eax
jmp 0x1000f416
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi + 0x54], eax
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000faad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, SafeArrayLock
jmp 0x1000fb4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000faf7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_VariantInit
jmp 0x1000fb4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, edi
mov dword [edi + 0x54], eax
call fcn.100107a0
mov byte [esp + 0x3e8], bl
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1000fb3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x14]
call fcn.10002a20
mov eax, reloc.OLEAUT32.dll_SafeArrayGetDim
mov ecx, dword [esp + 0x3e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x3c8]
xor ecx, esp
call fcn.100192c6
add esp, 0x3d8
ret