Function at 0x1002fc28
Capabilities:
Download url
Get common file path
Receive data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100812a6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1bb4
call fcn.10067670
mov eax, dword [0x100b02c0]
xor eax, esp
mov dword [esp + 0x1bb0], eax
push ebx
push esi
push edi
mov eax, dword [0x100b02c0]
xor eax, esp
push eax
lea eax, [esp + 0x1bc8]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
push esi
mov dword [esp + 0x6c], eax
mov edi, 0x104
push edi
lea eax, [esp + 0x9bc]
push eax
lea eax, [esp + 0xa4]
push eax
mov ebx, ecx
call dword [sym.imp.WININET.dll_InternetGetConnectedStateExW]
test eax, eax
je 0x1003025d
push 0x14
pop eax
mov dword [esp + 0x80], eax
push 5
mov dword [esp + 0x88], eax
pop ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x94], eax
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x88]
push eax
push 0x4b
push esi
mov dword [esp + 0x30], 4
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x48], 1
mov dword [esp + 0x54], 3
mov dword [esp + 0x60], 2
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], ecx
mov dword [esp + 0xa0], esi
call dword [sym.imp.WININET.dll_InternetQueryOptionW]
test eax, eax
je 0x1003025d
test byte [esp + 0x3c], 2
je 0x1002feae
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x78], esi
mov dword [esp + 0x7c], esi
push ecx
mov dword [esp + 0x1bd4], esi
mov eax, esp
mov dword [esp + 0x60], esp
mov ebx, 0x1009fd58
push eax
mov ecx, ebx
call fcn.10002a34
push ecx
mov byte [esp + 0x1bd8], 1
mov eax, esp
mov dword [esp + 0x70], esp
push eax
mov ecx, ebx
call fcn.10002a34
push ecx
mov byte [esp + 0x1bdc], 2
mov eax, esp
mov dword [esp + 0x6c], esp
push eax
mov ecx, 0x100a0b20
call fcn.10002a34
push ecx
mov eax, esp
mov byte [esp + 0x1be0], 3
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x74], esp
push eax
call fcn.10002a34
lea eax, [esp + 0x80]
push eax
mov byte [esp + 0x1be4], 0
call fcn.1000918c
mov eax, dword [0x100b27b4]
add esp, 0x14
mov ecx, 0x100b27b4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x1bd0], 4
mov eax, dword [esp + 0x74]
cmp eax, 1
jne 0x1002fde2
mov eax, dword [esp + 0x70]
lea edi, [esp + 0x14]
call fcn.100023e1
jmp 0x1002fe45
mov dword [esp + 0x18], esi
cmp eax, esi
jbe 0x1002fe45
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x1c], ecx
cmp esi, eax
jae 0x1002fe29
mov eax, dword [esp + 0x1c]
lea edi, [esp + 0x14]
call fcn.100023e1
push 0x100a0b24
mov esi, edi
call fcn.100041e8
cmp eax, 0xffffffff
jne 0x1002fe33
inc dword [esp + 0x18]
mov eax, dword [esp + 0x74]
add dword [esp + 0x1c], 4
cmp dword [esp + 0x18], eax
jb 0x1002fdf6
jmp 0x1002fe43
push 0x80070057
call fcn.10002b60
push ebx
push 0x100a0b24
lea eax, [esp + 0x1c]
push eax
call fcn.1000409d
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x24], esi
je 0x1002fe57
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x48], esi
je 0x1002fe63
push dword [esp + 0x48]
call edi
cmp dword [esp + 0x54], esi
je 0x1002fe6f
push dword [esp + 0x54]
call edi
mov esi, dword [esp + 0x14]
push 0xfde9
push ecx
add esi, 0xfffffff0
mov eax, esi
mov dword [esp + 0x64], esp
mov edi, esp
call fcn.10002aac
add eax, 0x10
mov dword [edi], eax
call fcn.100070c9
pop ecx
mov edi, eax
pop ecx
mov eax, esi
call fcn.10002b29
lea esi, [esp + 0x70]
call fcn.1000258e
mov eax, edi
jmp 0x1003025f
test byte [esp + 0x3c], 0xc
je 0x100301f5
push str.jsproxy.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], eax
cmp eax, esi
je 0x10030233
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetInitializeAutoProxyDll
push eax
call esi
push str.InternetDeInitializeAutoProxyDll
push dword [esp + 0x18]
mov dword [esp + 0x74], eax
call esi
push str.InternetGetProxyInfo
push dword [esp + 0x18]
mov dword [esp + 0x20], eax
call esi
cmp dword [esp + 0x6c], 0
mov dword [esp + 0x64], eax
je 0x10030227
cmp dword [esp + 0x18], 0
je 0x10030227
test eax, eax
je 0x10030227
test byte [esp + 0x3c], 8
jne 0x10030227
lea eax, [ebx + 0x20c]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [ebx], 0
jne 0x1002ffc6
lea eax, [esp + 0x1a4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea esi, [ebx + 2]
push esi
push 0
push 0x100a0ba4
lea eax, [esp + 0x1b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor eax, eax
push eax
push eax
push esi
push dword [esp + 0x30]
push eax
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
je 0x1002ffc3
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
cmp dword [esp + 0x24], esi
je 0x1002ff9c
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x48], esi
je 0x1002ffa8
push dword [esp + 0x48]
call edi
cmp dword [esp + 0x54], esi
je 0x1002ffb4
push dword [esp + 0x54]
call edi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1003025d
mov byte [ebx], 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x9c]
push eax
push edi
add ebx, 2
push ebx
call fcn.10030760
add esp, 0xc
xor esi, esi
push esi
push esi
push esi
lea eax, [esp + 0xa8]
push eax
push esi
call dword [esp + 0x80]
test eax, eax
jne 0x1003000d
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x10030233
and dword [esp + 0x5c], 0
mov esi, 0x400
push esi
lea eax, [esp + 0x5b0]
push 0
push eax
call fcn.10062b80
mov ebx, dword [esp + 0x74]
push 7
push str.http:__
push ebx
mov edi, ebx
call fcn.10060cc7
add esp, 0x18
test eax, eax
jne 0x10030044
lea edi, [ebx + 7]
push 0x100a0bb4
push edi
call fcn.10061990
pop ecx
pop ecx
test eax, eax
je 0x10030068
sub eax, edi
push eax
lea eax, [esp + 0x5b0]
push edi
push eax
call fcn.100657d0
jmp 0x10030088
push 0x100a0bb8
push edi
call fcn.10061990
pop ecx
pop ecx
test eax, eax
jne 0x10030055
push edi
lea eax, [esp + 0x5b0]
push esi
push eax
call fcn.10060151
lea eax, [esp + 0x5b8]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10030095
sub eax, edx
mov edi, eax
mov eax, ebx
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100300a5
sub eax, ecx
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x64]
push ecx
push edi
lea ecx, [esp + 0x5b8]
push ecx
push eax
push ebx
call dword [esp + 0x7c]
test eax, eax
jne 0x100300d8
xor esi, esi
push esi
push esi
call dword [esp + 0x20]
jmp 0x1002fffe
push dword [esp + 0x60]
lea eax, [esp + 0xbc0]
push 0xfff
push eax
call fcn.10060151
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
add esp, 0xc
push dword [esp + 0x60]
call edi
push 5
lea eax, [esp + 0xbc0]
push str.proxy
push eax
call fcn.10061d2b
add esp, 0xc
test eax, eax
je 0x100301e1
lea eax, [esp + 0xbbc]
push 0x100a0bc4
push eax
call fcn.10061990
xor ebx, ebx
pop ecx
pop ecx
cmp eax, ebx
jne 0x10030151
lea eax, [esp + 0xbc1]
push eax
lea eax, [esp + 0x1a8]
push esi
push eax
call fcn.10060151
add esp, 0xc
jmp 0x10030177
lea ecx, [esp + 0xbbc]
sub ecx, eax
sub ecx, 5
push ecx
lea eax, [esp + 0xbc5]
push eax
lea eax, [esp + 0x1ac]
push esi
push eax
call fcn.10068dbd
add esp, 0x10
push ebx
push ebx
call dword [esp + 0x20]
cmp dword [esp + 0x24], ebx
je 0x10030189
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x48], ebx
je 0x10030195
push dword [esp + 0x48]
call edi
cmp dword [esp + 0x54], ebx
je 0x100301a1
push dword [esp + 0x54]
call edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [esp + 0x1a4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100301b5
sub eax, edx
lea edi, [eax + 1]
push edi
call fcn.1005fb39
mov esi, eax
lea eax, [esp + 0x1a8]
push eax
push edi
push esi
mov byte [esi], bl
call fcn.10060151
add esp, 0x10
mov eax, esi
jmp 0x1003025f
push 0
push 0
call dword [esp + 0x20]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
cmp dword [esp + 0x24], esi
je 0x10030205
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x48], esi
je 0x10030215
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x54], esi
je 0x1003025d
push dword [esp + 0x54]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x1003025d
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [esp + 0x24], esi
je 0x10030245
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x48], esi
je 0x10030251
push dword [esp + 0x48]
call edi
cmp dword [esp + 0x54], esi
je 0x1003025d
push dword [esp + 0x54]
call edi
xor eax, eax
mov ecx, dword [esp + 0x1bc8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1bb0]
xor ecx, esp
call fcn.1005fc2b
mov esp, ebp
pop ebp
ret 4