Function at 0xc27860
Capabilities:
Copy file
Download url
Persist via lnk shortcut
Read .ini file
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xc4967d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa94
mov eax, dword [0xc57104]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xa80], ecx
lea eax, [ebp - 0x9c5]
mov dword [ebp - 0x9c4], eax
push 0
push 0
lea ecx, [ebp - 0x778]
call fcn.00c01f20
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xa80]
call fcn.00c22700
test eax, eax
je 0xc278e2
mov ecx, dword [0xc4b560]
push ecx
push 0
mov edx, dword [ebp - 0xa80]
add edx, 0x2bc
push edx
lea ecx, [ebp - 0x778]
call fcn.00c01b30
jmp 0xc27902
mov eax, dword [0xc4b560]
push eax
push 0
mov ecx, dword [ebp - 0xa80]
add ecx, 0x2d8
push ecx
lea ecx, [ebp - 0x778]
call fcn.00c01b30
xor edx, edx
cmp dword [ebp - 0x764], 0
sete dl
movzx eax, dl
test eax, eax
je 0xc27940
mov dword [ebp - 0x99c], 0
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x778]
call fcn.00c01f20
mov eax, dword [ebp - 0x99c]
jmp 0xc27eff
cmp dword [ebp - 0x760], 0x10
jb 0xc27957
mov ecx, dword [ebp - 0x774]
mov dword [ebp - 0xa84], ecx
jmp 0xc27963
lea edx, [ebp - 0x774]
mov dword [ebp - 0xa84], edx
mov eax, dword [ebp - 0xa84]
push eax
lea ecx, [ebp - 0x990]
call fcn.00c289a0
mov byte [ebp - 4], 1
mov edx, dword [0xc5b06c]
mov ecx, 0xc5b06c
call dword [edx + 0xc]
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0x9d4]
add eax, 0x10
mov dword [ebp - 0x228], eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x650], 0
lea ecx, [ebp - 0x650]
push ecx
push 0xc4ca24
lea edx, [ebp - 0x9a0]
push edx
lea ecx, [ebp - 0x990]
call fcn.00c28a70
mov dword [ebp - 0xa88], eax
mov eax, dword [ebp - 0xa88]
mov dword [ebp - 0x9d8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x9d8]
push ecx
lea ecx, [ebp - 0x228]
call fcn.00c28c40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9a0]
call fcn.00c28c00
mov edx, dword [ebp - 0x228]
mov dword [ebp - 0x9e0], edx
push 0xc4b60c
mov eax, dword [ebp - 0x9e0]
push eax
call fcn.00c344dd
add esp, 8
neg eax
sbb eax, eax
neg eax
movzx ecx, al
test ecx, ecx
je 0xc27ebb
push 0x104
push 0
lea edx, [ebp - 0x64c]
push edx
call fcn.00c33270
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x544]
push eax
call fcn.00c33270
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
push str.http:__pmang.dl.sayclub.co.kr_games__s_
lea edx, [ebp - 0x64c]
push edx
call fcn.00c33974
add esp, 0xc
push 0xc4b518
lea eax, [ebp - 0x64c]
push eax
call fcn.00c33c10
add esp, 8
lea ecx, [ebp - 0x64c]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov dword [ebp - 0x994], 0
jmp 0xc27ab3
mov edx, dword [ebp - 0x994]
add edx, 1
mov dword [ebp - 0x994], edx
cmp dword [ebp - 0x994], 5
jge 0xc27ae2
push 0
push 0x10
push 0x104
lea eax, [ebp - 0x544]
push eax
lea ecx, [ebp - 0x64c]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
test eax, eax
jne 0xc27ae0
jmp 0xc27ae2
jmp 0xc27aa4
cmp dword [ebp - 0x994], 5
jl 0xc27b34
mov dword [ebp - 0x9a4], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.00c28c00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x990]
call fcn.00c28c00
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x778]
call fcn.00c01f20
mov eax, dword [ebp - 0x9a4]
jmp 0xc27eff
push 0x104
push 0
lea edx, [ebp - 0x334]
push edx
call fcn.00c33270
add esp, 0xc
lea eax, [ebp - 0x544]
push eax
push 0x104
lea ecx, [ebp - 0x334]
push ecx
push 0xc4b60c
push str.GameName
push str.FIREWALL
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x104
push 0
lea edx, [ebp - 0x224]
push edx
call fcn.00c33270
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x43c]
push eax
call fcn.00c33270
add esp, 0xc
mov ecx, dword [ebp - 0x228]
push ecx
push str.http:__pmang.dl.sayclub.co.kr_games__s_
lea edx, [ebp - 0x224]
push edx
call fcn.00c33974
add esp, 0xc
push str.icon.ico
lea eax, [ebp - 0x224]
push eax
call fcn.00c33c10
add esp, 8
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
mov dword [ebp - 0x998], 0
jmp 0xc27bf5
mov edx, dword [ebp - 0x998]
add edx, 1
mov dword [ebp - 0x998], edx
cmp dword [ebp - 0x998], 5
jge 0xc27c24
push 0
push 0x10
push 0x104
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x224]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileA
test eax, eax
jne 0xc27c22
jmp 0xc27c24
jmp 0xc27be6
cmp dword [ebp - 0x998], 5
jl 0xc27c76
mov dword [ebp - 0x9a8], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.00c28c00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x990]
call fcn.00c28c00
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x778]
call fcn.00c01f20
mov eax, dword [ebp - 0x9a8]
jmp 0xc27eff
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call fcn.00c33270
add esp, 0xc
push 0xc584c0
lea eax, [ebp - 0x11c]
push eax
call fcn.00c33c00
add esp, 8
push str.Common_
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00c33c10
add esp, 8
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x11c]
push eax
call fcn.00c33c10
add esp, 8
push str..ico
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00c33c10
add esp, 8
push 0
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x104
push 0
lea ecx, [ebp - 0x884]
push ecx
call fcn.00c33270
add esp, 0xc
push str.http:__pmang.sayclub.com_game_top.nwz_ssn
lea edx, [ebp - 0x884]
push edx
call fcn.00c33c00
add esp, 8
mov eax, dword [ebp - 0x228]
push eax
lea ecx, [ebp - 0x884]
push ecx
call fcn.00c33c10
add esp, 8
push 0x104
push 0
lea edx, [ebp - 0x75c]
push edx
call fcn.00c33270
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x98c]
push eax
call fcn.00c33270
add esp, 0xc
push 0xc4bd08
lea ecx, [ebp - 0x98c]
push ecx
call fcn.00c33c00
add esp, 8
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x98c]
push eax
call fcn.00c33c10
add esp, 8
push str..lnk
lea ecx, [ebp - 0x98c]
push ecx
call fcn.00c33c10
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x75c]
push eax
call fcn.00c33c00
add esp, 8
push 0xc4b588
lea ecx, [ebp - 0x75c]
push ecx
call fcn.00c33c10
add esp, 8
lea edx, [ebp - 0x98c]
push edx
lea eax, [ebp - 0x75c]
push eax
call fcn.00c33c10
add esp, 8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9ac], esp
lea edx, [ebp - 0x11c]
push edx
call fcn.00c01920
mov dword [ebp - 0xa8c], eax
mov eax, dword [ebp - 0xa8c]
mov dword [ebp - 0xa90], eax
mov byte [ebp - 4], 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9b0], esp
lea edx, [ebp - 0x884]
push edx
call fcn.00c01920
mov dword [ebp - 0xa94], eax
mov eax, dword [ebp - 0xa94]
mov dword [ebp - 0xa98], eax
mov byte [ebp - 4], 5
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x9b4], esp
lea edx, [ebp - 0x75c]
push edx
call fcn.00c01920
mov dword [ebp - 0xa9c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xa80]
call fcn.00c28360
lea eax, [ebp - 0x650]
push eax
push 0xc4ca24
lea ecx, [ebp - 0x9b8]
push ecx
lea ecx, [ebp - 0x990]
call fcn.00c28a70
mov dword [ebp - 0xaa0], eax
mov edx, dword [ebp - 0xaa0]
mov dword [ebp - 0xa60], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa60]
push eax
lea ecx, [ebp - 0x228]
call fcn.00c28c40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9b8]
call fcn.00c28c00
jmp 0xc279ff
mov dword [ebp - 0x9bc], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
call fcn.00c28c00
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x990]
call fcn.00c28c00
mov dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x778]
call fcn.00c01f20
mov eax, dword [ebp - 0x9bc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00c32666
mov esp, ebp
pop ebp
ret 4