Function at 0x432800
Capabilities:
Delete file
Download url
Read .ini file
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x463909
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
mov eax, dword [0x46f42c]
push ebx
push esi
push edi
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x10]
xor ebx, ebx
push ecx
mov dword [esp + 0x234], ebx
call fcn.00431b90
add esp, 4
test eax, eax
jne 0x432bcf
lea edx, [esp + 0x10]
push edx
call fcn.00432400
add esp, 4
test eax, eax
jne 0x432bcf
lea eax, [esp + 0xc]
push eax
call fcn.00408910
mov eax, dword [eax]
add esp, 4
push eax
push ebx
push str.AntiAV
push str.protect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
lea ecx, [esp + 0xc]
mov esi, eax
call fcn.00408010
cmp esi, ebx
je 0x4328ae
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432bc5
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x432bb1
lea eax, [esp + 0x10]
push eax
call fcn.004325c0
add esp, 4
test eax, eax
je 0x432aab
mov edi, 2
push ebx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x474310
call fcn.00407200
push ecx
mov byte [esp + 0x23c], 4
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x47430c
call fcn.00407200
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x244], 5
call fcn.00407110
push ecx
mov byte [esp + 0x244], 6
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x4733f0
call fcn.00407200
push ebx
mov byte [esp + 0x248], bl
call fcn.0043b010
add esp, 0x18
cmp eax, 2
jne 0x432b07
push str.360SafeBoxExit
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x46f42c]
mov dword [esp + 0xc], eax
push ebx
lea ecx, [esp + 0x10]
push 0x46f644
push ecx
mov byte [esp + 0x23c], 7
call fcn.004076f0
lea edx, [esp + 0x24]
push edx
call fcn.00408910
mov eax, dword [eax]
add esp, 0x10
push eax
mov eax, dword [esp + 0x10]
push eax
push str.AntiAV
push str.protect
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [esp + 0x18]
call fcn.00408010
lea ecx, [esp + 0xc]
mov byte [esp + 0x230], bl
call fcn.00408010
mov ecx, dword [0x46f42c]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0xc]
mov byte [esp + 0x230], 8
push edx
call fcn.004063d0
add esp, 4
mov esi, eax
mov byte [esp + 0x230], 9
call fcn.004062c0
push eax
mov eax, dword [esi]
push eax
push edi
lea ecx, [esp + 0x20]
push str.http:__boxupdate.360safe.com_safebox_safebox.html_AV_dPid_sMid_s
push ecx
call fcn.004076f0
mov eax, dword [esp + 0x20]
mov ecx, dword [0x46f430]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0x14
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x432a32
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432a32
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov edx, dword [esp + 0x14]
push ebx
push ebx
lea ecx, [esp + 0x28]
push 0x104
push ecx
push edx
push ebx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
jne 0x432a58
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432a83
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432a83
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432d1d
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432d1d
jmp 0x432d0d
lea ecx, [esp + 0x10]
push ecx
call fcn.00432750
add esp, 4
test eax, eax
je 0x432ac6
mov edi, 3
jmp 0x4328c8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x46f430]
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x432bc5
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x432bc5
mov eax, dword [esp + 0x10]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x432d1f
push edi
mov ecx, 0x47b738
call fcn.00448540
mov eax, dword [0x46f42c]
mov dword [esp + 0xc], eax
push 1
lea ecx, [esp + 0x10]
push 0x46f644
push ecx
mov byte [esp + 0x23c], 0xa
call fcn.004076f0
lea edx, [esp + 0x20]
push edx
call fcn.00408910
mov eax, dword [eax]
add esp, 0x10
push eax
mov eax, dword [esp + 0x10]
push eax
push str.AntiAV
push str.protect
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432b8a
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432b8a
mov edx, dword [esp + 0x14]
lea eax, [edx - 0xc]
push eax
call fcn.004535f0
add esp, 4
lea ecx, [esp + 0xc]
mov byte [esp + 0x230], bl
call fcn.00408010
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432bc5
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432bc5
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, 1
jmp 0x432d1f
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x4733f0
call fcn.00407200
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
mov byte [esp + 0x240], 1
call fcn.00407110
push ebx
mov byte [esp + 0x240], bl
call fcn.0043b520
add esp, 0x10
push str.360SafeBoxExit
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x46f42c]
mov dword [esp + 0x14], ecx
lea edx, [esp + 0xc]
mov byte [esp + 0x230], 2
push edx
call fcn.004063d0
add esp, 4
mov esi, eax
mov byte [esp + 0x230], 3
call fcn.004062c0
push eax
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x20]
push str.http:__boxupdate.360safe.com_safebox_safebox.html_AV_dPid_sMid_s
push ecx
call fcn.004076f0
mov eax, dword [esp + 0x20]
mov ecx, dword [0x46f430]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
add esp, 0x14
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x432ca1
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432ca1
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.004535f0
add esp, 4
mov edx, dword [esp + 0x14]
push ebx
push ebx
lea ecx, [esp + 0x28]
push 0x104
push ecx
push edx
push ebx
call sub.urlmon.dll_URLDownloadToCacheFileW
test eax, eax
jne 0x432cc7
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x14]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432cf2
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432cf2
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x46f430]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x432d1d
add eax, 0xfffffff4
push eax
call esi
test eax, eax
jg 0x432d1d
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.004535f0
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x228]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x228
ret