Function at 0x417424
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x41742d
add esp, 0xffffffdc
mov eax, dword [ebp - 4]
mov eax, 0x4d2c88
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, 0x4d2850
call fcn.004865d0
test esi, esi
je 0x417463
cmp dword [ebp + 0xc], 0
je 0x417463
test edi, edi
jne 0x417474
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4177ea
cmp byte [esi], 0
je 0x41747e
cmp byte [edi], 0
jne 0x41748f
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4177ea
mov edx, dword [sym.multiinstall.exe__Form1]
mov eax, dword [edx]
cmp byte [eax + 0x3b1c], 0
jne 0x4174ba
cmp byte [0x4c6fa0], 0
jne 0x4174ba
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4177ea
cmp byte [0x4c6fa0], 0
jne 0x4174e0
push 0x64
mov ecx, dword [sym.multiinstall.exe__Form1]
mov eax, dword [ecx]
add eax, 0x3b1c
push eax
push 0x4c6fa0
call fcn.00417ef0
add esp, 0xc
push esi
push edi
lea edi, [ebp - 0x828]
mov esi, 0x4c7005
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0x1828]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x1828]
mov esi, 0x4c7806
mov ecx, 0x400
lea edx, [ebx + 0x143]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x1000
push eax
push 0
push edx
call fcn.00416c14
add esp, 0x10
mov ecx, 0x100
lea eax, [ebp - 0x1828]
lea edx, [ebp - 0x1c28]
push esi
push edi
lea edi, [ebp - 0x1c28]
mov esi, 0x4c8807
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x400
push eax
push edx
call fcn.00417ef0
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x1c28]
push ecx
call fcn.00419214
add esp, 8
lea eax, [ebp - 0x1c28]
push 0x400
push esi
push eax
call fcn.00417f30
add esp, 0xc
push edi
mov esi, 0x4c8c08
lea edi, [ebp - 0x2028]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
push 0x400
call fcn.00416720
push eax
lea eax, [ebp - 0x2028]
push eax
call fcn.00417ef0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x2028]
push edx
call fcn.0041891c
add esp, 8
push 0x400
lea ecx, [ebx + 0x154]
push ecx
lea eax, [ebp - 0x2028]
push eax
call fcn.00417f30
add esp, 0xc
jmp 0x4175fd
push 0x400
lea edx, [ebx + 0x160]
push edx
lea ecx, [ebp - 0x2028]
push ecx
call fcn.00417f30
add esp, 0xc
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x2028]
lea eax, [ebp - 4]
call fcn.00491ec0
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00439d18
test al, al
lea eax, [ebp - 4]
setne dl
and edx, 1
push edx
mov edx, 2
dec dword [ebp - 0xc]
call fcn.00492004
pop ecx
test ecx, ecx
jne 0x4175e2
push edi
lea edi, [ebp - 0x5028]
mov esi, 0x4c9009
mov ecx, 0xc00
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x1828]
push 0x1000
push eax
lea edx, [ebx + 0x162]
push 1
push edx
call fcn.00416c14
add esp, 0x10
push 0x3000
lea ecx, [ebp - 0x1828]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.00417ef0
add esp, 0xc
push 0x3000
lea edx, [ebx + 0x166]
push edx
lea ecx, [ebp - 0x5028]
push ecx
call fcn.00417f30
add esp, 0xc
push 0x3000
lea eax, [ebx + 0x168]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.00417f30
add esp, 0xc
lea ecx, [ebp - 0x828]
push 0x800
push ecx
push 0x4c6fa0
call fcn.0041713c
add esp, 0xc
push 0x3000
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.00417f30
add esp, 0xc
push 0x3000
lea ecx, [ebx + 0x16f]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.00417f30
add esp, 0xc
push 0x3000
lea edx, [ebx + 0x166]
push edx
lea ecx, [ebp - 0x5028]
push ecx
call fcn.00417f30
add esp, 0xc
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.00417f30
add esp, 0xc
lea ecx, [ebp - 0x828]
push 0x800
push ecx
push edi
call fcn.0041713c
add esp, 0xc
push 0x3000
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.00417f30
add esp, 0xc
push 0x3000
lea ecx, [ebx + 0x16f]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.00417f30
add esp, 0xc
mov esi, 0x4cc00a
lea edi, [ebp - 0x8028]
mov ecx, 0xc00
rep movsd dword es:[edi], dword [esi]
push 0x3000
lea eax, [ebp - 0x8028]
push eax
lea edx, [ebp - 0x5028]
push edx
lea ecx, [ebp - 0x1c28]
push ecx
call fcn.00416f4c
add esp, 0x10
lea eax, [ebp - 0x2028]
lea edx, [ebp - 0x8028]
push 0
push 0
push eax
push edx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
lea ecx, [ebp - 0x2028]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret