Function at 0x1003b5e0
Capabilities:
Delete file
Download url
Query environment variable
Read file on windows
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x1011ef31
mov eax, dword fs:[0]
push eax
mov eax, 0x13b8
call fcn.100f9ee0
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0x13b4], eax
push ebx
push ebp
push esi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0x13c8]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, 0xf
mov dword [esp + 0x10], ebx
mov dword [esp + 0x64], esi
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
push 0xfff
lea eax, [esp + 0x3c9]
push ebx
mov dword [esp + 0x13d8], ebx
push eax
mov byte [esp + 0x3d0], bl
call fcn.100f8db0
push 0x12b
lea ecx, [esp + 0x2a9]
push ebx
push ecx
mov byte [esp + 0x2b0], bl
call fcn.100f8db0
push 0x12b
lea edx, [esp + 0x85]
push ebx
push edx
mov byte [esp + 0x8c], bl
call fcn.100f8db0
add esp, 0x24
push 9
push str.verdana__
lea ecx, [esp + 0x38]
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov byte [esp + 0x3c], bl
call fcn.10004290
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
push 0x103
lea eax, [esp + 0x199]
push ebx
mov byte [esp + 0x13d8], 2
push eax
mov byte [esp + 0x1a0], bl
call fcn.100f8db0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x198]
push ecx
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x194]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b700
sub eax, edx
push eax
lea edx, [esp + 0x198]
push edx
lea ecx, [esp + 0x1c]
call fcn.10004290
push 0xa
push str._netip.ini
lea ecx, [esp + 0x1c]
call fcn.10006400
mov eax, dword [esp + 0x18]
mov ebp, 0x10
cmp dword [esp + 0x2c], ebp
jae 0x1003b73e
lea eax, [esp + 0x18]
push ebx
push ebx
push eax
push str.http:__whereismyip.com_
push ebx
call sub.urlmon.dll_URLDownloadToFileA
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x1003b75a
lea eax, [esp + 0x18]
push 0x1013e254
push eax
call fcn.100f5169
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x1003b824
push ebx
push ebx
push esi
call fcn.100f437b
push esi
push 0x1000
lea eax, [esp + 0x3d8]
push 1
push eax
call fcn.100f5473
push esi
call fcn.100f44fd
mov eax, dword [esp + 0x54]
add esp, 0x20
cmp dword [esp + 0x48], ebp
jae 0x1003b7a6
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x3c8]
push ecx
call fcn.100f5e00
mov esi, dword [esp + 0x4c]
add esp, 8
cmp eax, ebx
je 0x1003b824
push eax
lea edx, [esp + 0x29c]
push 0x10142694
push edx
call fcn.100f468d
lea eax, [esp + 0x2a4]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b7e0
sub eax, edx
mov edx, eax
xor eax, eax
cmp edx, ebx
jle 0x1003b824
lea esi, [esp + esi + 0x298]
mov cl, byte [esi + eax]
cmp cl, 0x3c
je 0x1003b80b
mov byte [esp + eax + 0x68], cl
inc eax
cmp eax, edx
jl 0x1003b7f8
jmp 0x1003b824
mov byte [esp + eax + 0x68], bl
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x1003b81d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x68]
lea edx, [eax + 1]
jmp 0x1003b830
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1003b830
sub eax, edx
push eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x54]
call fcn.10004290
push 0xffffffffffffffff
push ebx
mov esi, 0xf
mov dword [edi + 0x18], esi
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov byte [edi + 4], bl
call fcn.100057a0
cmp dword [esp + 0x2c], ebp
jb 0x1003b874
mov ecx, dword [esp + 0x18]
push ecx
call fcn.100f4085
add esp, 4
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
cmp dword [esp + 0x48], ebp
jb 0x1003b893
mov edx, dword [esp + 0x34]
push edx
call fcn.100f4085
add esp, 4
mov dword [esp + 0x48], esi
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
cmp dword [esp + 0x64], ebp
jb 0x1003b8b2
mov eax, dword [esp + 0x50]
push eax
call fcn.100f4085
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x13c8]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x13b4]
xor ecx, esp
call fcn.100f30a6
add esp, 0x13c4
ret