Function at 0x428634
Capabilities:
Delete file
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x42863d
add esp, 0xffffffdc
mov eax, dword [ebp - 4]
mov eax, 0x4ed304
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov ebx, 0x4ed2b7
call fcn.00490d08
test esi, esi
je 0x428673
cmp dword [ebp + 0xc], 0
je 0x428673
test edi, edi
jne 0x428684
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4289df
cmp byte [esi], 0
je 0x42868e
cmp byte [edi], 0
jne 0x42869f
mov ecx, dword [ebp - 0x28]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x4289df
mov edx, dword [sym.multiinstall.exe__Form1]
mov eax, dword [edx]
cmp byte [eax + 0x3b1c], 0
jne 0x4286ca
cmp byte [0x4e524c], 0
jne 0x4286ca
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4289df
cmp byte [0x4e524c], 0
jne 0x4286f0
push 0x64
mov ecx, dword [sym.multiinstall.exe__Form1]
mov eax, dword [ecx]
add eax, 0x3b1c
push eax
push 0x4e524c
call fcn.004119e8
add esp, 0xc
push esi
push edi
lea edi, [ebp - 0x828]
mov esi, 0x4e52b1
mov ecx, pe_nt_image_headers32
lea eax, [ebp - 0x1828]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x1828]
mov esi, 0x4e5ab2
mov ecx, 0x400
lea edx, [ebx + 2]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x1000
push eax
push 0
push edx
call fcn.0040a248
add esp, 0x10
mov ecx, 0x100
lea eax, [ebp - 0x1828]
lea edx, [ebp - 0x1c28]
push esi
push edi
lea edi, [ebp - 0x1c28]
mov esi, 0x4e6ab3
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push 0x400
push eax
push edx
call fcn.004119e8
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x1c28]
push ecx
call fcn.00412074
add esp, 8
lea eax, [ebp - 0x1c28]
push 0x400
push esi
push eax
call fcn.004119a0
add esp, 0xc
push edi
mov esi, 0x4e6eb4
lea edi, [ebp - 0x2028]
mov ecx, 0x100
rep movsd dword es:[edi], dword [esi]
pop edi
push 0x400
call fcn.00402b64
push eax
lea eax, [ebp - 0x2028]
push eax
call fcn.004119e8
add esp, 0xc
push 0x400
lea edx, [ebp - 0x2028]
push edx
call fcn.0041203c
add esp, 8
push 0x400
lea ecx, [ebx + 0x13]
push ecx
lea eax, [ebp - 0x2028]
push eax
call fcn.004119a0
add esp, 0xc
jmp 0x428804
push 0x400
lea edx, [ebx + 0x1f]
push edx
lea ecx, [ebp - 0x2028]
push ecx
call fcn.004119a0
add esp, 0xc
mov word [ebp - 0x18], 8
lea edx, [ebp - 0x2028]
lea eax, [ebp - 4]
call fcn.0049c954
inc dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.004420d4
test al, al
lea eax, [ebp - 4]
setne dl
and edx, 1
push edx
mov edx, 2
dec dword [ebp - 0xc]
call fcn.0049ca98
pop ecx
test ecx, ecx
jne 0x4287ec
push edi
lea edi, [ebp - 0x5028]
mov esi, 0x4e72b5
mov ecx, 0xc00
rep movsd dword es:[edi], dword [esi]
pop edi
lea eax, [ebp - 0x1828]
push 0x1000
push eax
lea edx, [ebx + 0x21]
push 1
push edx
call fcn.0040a248
add esp, 0x10
push 0x3000
lea ecx, [ebp - 0x1828]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.004119e8
add esp, 0xc
push 0x3000
lea edx, [ebx + 0x25]
push edx
lea ecx, [ebp - 0x5028]
push ecx
call fcn.004119a0
add esp, 0xc
push 0x3000
lea eax, [ebx + 0x27]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.004119a0
add esp, 0xc
lea ecx, [ebp - 0x828]
push 0x800
push ecx
push 0x4e524c
call fcn.0040c680
add esp, 0xc
push 0x3000
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.004119a0
add esp, 0xc
push 0x3000
lea ecx, [ebx + 0x2e]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.004119a0
add esp, 0xc
push 0x3000
lea edx, [ebx + 0x25]
push edx
lea ecx, [ebp - 0x5028]
push ecx
call fcn.004119a0
add esp, 0xc
push 0x3000
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.004119a0
add esp, 0xc
lea ecx, [ebp - 0x828]
push 0x800
push ecx
push edi
call fcn.0040c680
add esp, 0xc
push 0x3000
lea eax, [ebp - 0x828]
push eax
lea edx, [ebp - 0x5028]
push edx
call fcn.004119a0
add esp, 0xc
push 0x3000
lea ecx, [ebx + 0x2e]
push ecx
lea eax, [ebp - 0x5028]
push eax
call fcn.004119a0
add esp, 0xc
mov esi, 0x4ea2b6
lea edi, [ebp - 0x8028]
mov ecx, 0xc00
rep movsd dword es:[edi], dword [esi]
push 0x3000
lea eax, [ebp - 0x8028]
push eax
lea edx, [ebp - 0x5028]
push edx
lea ecx, [ebp - 0x1c28]
push ecx
call fcn.0040c490
add esp, 0x10
lea eax, [ebp - 0x2028]
lea edx, [ebp - 0x8028]
push 0
push 0
push eax
push edx
push 0
call sub.URLMON.DLL_URLDownloadToFileA
lea ecx, [ebp - 0x2028]
push ecx
call sub.KERNEL32.DLL_DeleteFileA
mov eax, dword [ebp - 0x28]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret