Function at 0x401000
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.004019b0
mov esi, 0x415038
push esi
lea ecx, [ebp - 0xc]
call fcn.00401412
push esi
lea ecx, [ebp - 8]
call fcn.00401412
lea eax, [ebp - 0xc]
push eax
call fcn.00401385
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
call fcn.004013a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00402ff0
pop ecx
lea eax, [ebp - 8]
push eax
call fcn.00401385
push eax
call fcn.00402ffd
mov ebx, dword [ebp - 0xc]
push eax
push 0x411e74
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.004013a9
push esi
lea ecx, [ebp - 4]
call fcn.00401412
push str.WebServer
lea ecx, [ebp - 0x10]
call fcn.0040128d
push str.SoftwareSmileboxConfig_
lea ecx, [ebp - 0xc]
call fcn.0040128d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x80000001
call fcn.004021f0
mov ecx, dword [ebp - 0xc]
add esp, 0x10
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004018f4
mov eax, dword [ebp - 4]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x4010eb
push str.http:__www.smilebox.com
lea ecx, [ebp - 4]
call fcn.0040157d
jmp 0x401114
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push str.http:__
push eax
call fcn.00401340
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.00401437
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004018f4
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00403020
push 0x10
lea eax, [ebp - 0x3c]
push esi
push eax
mov dword [ebp - 0x80], edi
call fcn.00403020
add esp, 0x18
push str._downloadInstaller.jsp_partnerbigfishgamescampaignwebsite
lea ecx, [ebp - 0x18]
call fcn.0040128d
push 0x411fe0
lea ecx, [ebp - 0x14]
call fcn.0040128d
push str.campaign__website
lea ecx, [ebp - 0x10]
call fcn.0040128d
push str.__expires__Fri__01_Jan_2010_00:00:00_GMT
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004012fd
mov edi, dword [sym.imp.WININET.dll_InternetSetCookieA]
add esp, 0xc
push dword [eax]
push esi
push dword [ebp - 4]
call edi
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.004018f4
push str.origin__installDownloader__expires__Fri__01_Jan_2010_00:00:00_GMT
push esi
push dword [ebp - 4]
call edi
push str.page__none__expires__Fri__01_Jan_2010_00:00:00_GMT
push esi
push dword [ebp - 4]
call edi
lea eax, [ebp - 8]
push eax
push str.origininstallDownloaderpagenone
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004012c4
add esp, 0xc
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004012fd
add esp, 0xc
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401c80
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004018f4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004012c4
mov edi, dword [ebp - 0xc]
add esp, 0xc
cmp dword [edi - 4], 1
jle 0x401213
push dword [edi - 0xc]
lea ecx, [ebp - 0xc]
call fcn.004014cb
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
lea ecx, [ebp - 0xc]
call fcn.004013a9
lea ecx, [edi - 0x10]
call fcn.004018f4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004018f4
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff0
call fcn.004018f4
lea ecx, [ebx - 0x10]
call fcn.004018f4
lea ecx, [ebp - 0x2c]
call fcn.004019e0
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10