Function at 0x410061
Capabilities:
Contain obfuscated stackstrings
Delete file
Read file on windows

Disassembly:
push 0xd48
mov eax, 0x44f8fe
call fcn.004483bb
mov edi, ecx
mov dword [ebp - 0xcf0], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xce4], eax
and dword [ebp - 0xd14], 0
mov dword [ebp - 4], 1
lea esi, [edi + 0x40]
call fcn.004014da
push str.UCI.UCIURL
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 2
mov ecx, dword [edi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0xcd4]
push ecx
lea ecx, [ebp - 0xcdc]
push ecx
mov ebx, eax
call fcn.00413c05
mov byte [ebp - 4], 3
add edi, 0x48
mov dword [ebp - 0xcf4], edi
call fcn.0040488e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcdc]
call fcn.00401452
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xcd4]
call fcn.00401452
lea ecx, [ebp - 0xd08]
call fcn.004013f2
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xcec]
call fcn.004013f2
mov byte [ebp - 4], 5
push str.UCI.InstallUIURLOverride
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 6
mov esi, dword [ebp - 0xcf0]
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0xcd4]
push ecx
lea ecx, [ebp - 0xcdc]
push ecx
mov ebx, eax
call fcn.00413c05
mov byte [ebp - 4], 7
lea edi, [ebp - 0xcec]
call fcn.0040488e
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xcdc]
call fcn.00401452
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcd4]
call fcn.00401452
push 0x454548
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 8
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0xcd4]
push ecx
mov ecx, eax
call fcn.00413eb0
mov bl, al
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xcd4]
call fcn.00401452
test bl, bl
je 0x4101d8
mov esi, edi
call fcn.004014da
mov esi, dword [ebp - 0xcf0]
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
mov eax, dword [eax + 0xa0]
mov dword [esi + 0x60], eax
lea ecx, [ebp - 0xd04]
call fcn.004013f2
mov byte [ebp - 4], 9
lea eax, [ebp - 0xd00]
push eax
call fcn.0042a1ea
mov byte [ebp - 4], 0xa
mov dword [esp], str.DisplayName
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 0xb
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
lea ecx, [ebp - 0xcd4]
push ecx
lea ecx, [ebp - 0xd1c]
push ecx
mov ebx, eax
call fcn.00413c05
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcd4]
call fcn.00401452
mov edi, dword [ebp - 0xce4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov byte [ebp - 0xcd5], 1
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
push 0x10
call fcn.0041a807
test al, al
jne 0x410806
mov eax, dword [ebp - 0xcec]
cmp dword [eax - 0xc], 0
jne 0x41059b
lea edi, [ebp - 0x430]
call fcn.00408653
mov byte [ebp - 4], 0xe
push str.UCI.UCIHash
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 0xf
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
mov ecx, edi
push ecx
mov edi, dword [ebp - 0xce4]
lea ecx, [ebp - 0xcd4]
mov edx, eax
call fcn.0041a98b
mov byte [ebp - 0xcd5], al
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xcd4]
call fcn.00401452
cmp byte [ebp - 0xcd5], 0
je 0x4103f2
lea ecx, [ebp - 0xcdc]
call fcn.004013f2
mov byte [ebp - 4], 0x10
mov eax, dword [esi + 0xb4]
mov dword [ebp - method.appenv::IAppInternetRequestCallback.virtual_0], vtable.appenv::IAppInternetRequestCallback.0
mov edi, vtable.appenv::CUCIPageDownloadEvents.0
mov dword [ebp - 0xd10], edi
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 0x11
push dword [esi + 0xb4]
lea eax, [ebp - 0xcd0]
push eax
call fcn.0041bc2c
mov byte [ebp - 4], 0x12
push 0x454fa0
lea eax, [ebp - 0xcd4]
push eax
call fcn.004081d8
mov byte [ebp - 4], 0x13
push dword [ebp - 0xce4]
push 2
lea eax, [ebp - 0x430]
push eax
lea ebx, [ebp - 0xd00]
push 0
lea eax, [ebp - 0xcd4]
push eax
push 0
push ecx
mov eax, esp
mov dword [ebp - 0xcf8], esp
push eax
mov ecx, dword [ebp - 0xcf4]
call fcn.0042bbe6
pop ecx
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0xd10]
push eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xcd0]
call fcn.0041bdc3
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0xcd4]
add eax, 0xfffffff0
call fcn.0040114e
push dword [ebp - 0xce4]
lea eax, [ebp - 0xcd0]
push eax
call fcn.0041bec3
mov byte [ebp - 0xcd5], al
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xcd0]
call fcn.0041bcbc
mov byte [ebp - 4], 0x10
mov dword [ebp - 0xd10], edi
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xcdc]
call fcn.00401452
mov byte [ebp - 4], 0x16
mov byte [ebp - 0xcd6], 0
push str.http:__
lea eax, [ebp - 0xcd4]
push eax
call fcn.00401415
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xce0]
call fcn.004013f2
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0xcfc]
call fcn.0040cdd8
mov byte [ebp - 4], 0x19
push 3
push 1
push SysReAllocString
push dword [ebp - 0xd00]
lea esi, [ebp - 0xcfc]
call fcn.0040cde0
xor esi, esi
cmp eax, esi
jl 0x410507
push esi
lea eax, [ebp - 0xcdc]
push eax
push 1
lea eax, [ebp - 0xce5]
push eax
push dword [ebp - 0xcfc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp eax, esi
jne 0x41047c
call fcn.0040cd57
jmp 0x41047e
xor eax, eax
cmp eax, esi
jl 0x410507
cmp dword [ebp - 0xcdc], 1
jne 0x410507
movsx ax, byte [ebp - 0xce5]
movzx eax, ax
mov ecx, dword [ebp - 0xce0]
cmp dword [ecx - 0xc], esi
jne 0x4104b9
cmp eax, 0x20
je 0x410454
cmp eax, 9
je 0x410454
cmp eax, 0xd
je 0x410454
cmp eax, 0xa
je 0x410454
cmp eax, 0xd
je 0x410507
cmp eax, 0xa
je 0x410507
push eax
lea eax, [ebp - 0xce0]
call fcn.0041223b
mov eax, dword [ebp - 0xce0]
mov eax, dword [eax - 0xc]
mov ecx, dword [ebp - 0xcd4]
cmp eax, dword [ecx - 0xc]
jne 0x410454
push ecx
lea eax, [ebp - 0xce0]
push eax
call fcn.0040fb84
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0xcd6], al
test al, al
jne 0x410454
cmp dword [ebp - 0xcfc], esi
je 0x410521
push dword [ebp - 0xcfc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 0xcfc], esi
cmp byte [ebp - 0xcd6], 0
je 0x410546
lea eax, [ebp - 0xce0]
call fcn.0040fbab
lea eax, [ebp - 0xce0]
lea edi, [ebp - 0xd08]
call fcn.0040488e
push dword [ebp - 0xd00]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov byte [ebp - 4], 0x18
lea esi, [ebp - 0xcfc]
call fcn.0040ce5d
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0xce0]
call fcn.00401452
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xcd4]
call fcn.00401452
mov dword [ebp - 4], 0xe
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x430]
call fcn.00408687
mov esi, dword [ebp - 0xcf0]
mov eax, dword [ebp - 0xcec]
lea edi, [esi + 0x40]
cmp dword [eax - 0xc], 0
je 0x41089e
lea eax, [ebp - 0xcec]
call fcn.0040488e
push 0x4562c8
lea eax, [esi + 0x4c]
push eax
call fcn.0040145c
lea eax, [ebp - 0xd54]
push eax
call fcn.0041c4bc
mov byte [ebp - 4], 0x1c
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
push eax
lea eax, [ebp - 0xd54]
push eax
call fcn.0041c4ce
lea eax, [ebp - 0xce0]
push eax
lea eax, [ebp - 0xd54]
push eax
call fcn.0041c768
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp + 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0xce0]
call fcn.0040a0ee
mov ebx, vtable.apputil::CAppCrypto.0
mov dword [ebp - 0xcf8], ebx
mov byte [ebp - 4], 0x1e
lea edi, [ebp - 0x430]
call fcn.00408653
mov byte [ebp - 4], 0x1f
push 5
mov ecx, dword [ebp - 0xce4]
mov esi, edi
call fcn.0041ae9f
pop ecx
test al, al
je 0x4107b2
lea eax, [ebp - 0xcd4]
push eax
call fcn.00404718
mov byte [ebp - 4], 0x20
push dword [ebp - 0xce4]
lea eax, [ebp - 0xcd4]
push eax
lea edx, [ebp - 0xce0]
mov ecx, edi
call fcn.0041b911
push str.data
lea eax, [ebp - 0xcdc]
push eax
lea ecx, [ebp - 0xcd4]
call fcn.0040fb21
pop ecx
pop ecx
mov byte [ebp - 4], 0x21
mov esi, dword [ebp - 0xcf0]
lea edi, [esi + 0x30]
call fcn.00409fa0
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0xcdc]
add eax, 0xfffffff0
call fcn.0040114e
lea ecx, [ebp - 0xcf4]
call fcn.004013f2
mov byte [ebp - 4], 0x23
push 0x45534c
lea eax, [ebp - 0xcdc]
push eax
call fcn.00401415
mov byte [ebp - 4], 0x24
push dword [ebp - 0xce0]
lea eax, [ebp - 0xd0c]
push eax
call fcn.0040484d
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xcdc]
push ecx
push eax
lea eax, [ebp - 0xd24]
push eax
call fcn.0042fff2
add esp, 0xc
mov edi, eax
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0xd18]
push eax
lea eax, [esi + 4]
call fcn.00428193
mov byte [ebp - 4], 0x27
mov eax, dword [eax]
mov eax, dword [eax - 0xc]
push dword [edi]
push eax
push str._r_n_using_POST_protocol__the_length_is__d_r_n_s_r_n
lea eax, [ebp - 0xcf4]
push eax
call fcn.00401766
add esp, 0x10
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0xd18]
add eax, 0xfffffff0
call fcn.0040114e
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xd24]
call fcn.00401452
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0xd0c]
call fcn.00401452
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0xcdc]
call fcn.00401452
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [eax]
push dword [ebp - 0xcf4]
mov ecx, eax
call dword [edx + 8]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xcf4]
call fcn.00401452
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0xcd4]
add eax, 0xfffffff0
call fcn.0040114e
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x430]
call fcn.00408687
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0xcf8], ebx
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0xce0]
add eax, 0xfffffff0
call fcn.0040114e
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0xd54]
push eax
call fcn.004089d1
mov esi, dword [ebp - 0xcf0]
cmp byte [ebp - 0xcd5], 0
je 0x410929
mov edi, dword [ebp - 0xce4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
mov ebx, eax
call fcn.0041a7d0
test eax, eax
je 0x4108da
mov ecx, dword [esi + 0xb4]
mov eax, dword [ecx]
call dword [eax]
mov ebx, eax
call fcn.0041a7d0
test al, 0x10
jne 0x4108da
push 0x4545c4
lea eax, [ebp - 0xd04]
push eax
call fcn.0040145c
jmp 0x410929
mov eax, dword [ebp - 0xd08]
cmp dword [eax - 0xc], 0
je 0x4108bf
lea eax, [ebp - 0xd08]
call fcn.0040488e
push 0x454224
jmp 0x4105be
lea eax, [esi + 0x48]
call fcn.0040488e
push str.nud
lea eax, [esi + 0x4c]
push eax
call fcn.0040145c
jmp 0x4107f3
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x68], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0xa4], eax
lea edi, [esi + 0xac]
lea eax, [ebp + 0x14]
call fcn.00409fa0
push dword [ebp - 0xce4]
lea eax, [ebp - 0xcf8]
push eax
mov ecx, esi
call fcn.004109a5
mov byte [ebp - 4], 0x2b
lea edi, [ebp - 0xd04]
call fcn.0040488e
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcf8]
call fcn.00401452
lea eax, [ebp - 0xd04]
mov esi, dword [ebp - 0xd20]
call fcn.00401403
or dword [ebp - 0xd14], 1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xd1c]
call fcn.00401452
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xd00]
call fcn.00401452
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xd04]
call fcn.00401452
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xcec]
call fcn.00401452
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd08]
call fcn.00401452
and dword [ebp - 4], 0
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.0040114e
mov eax, esi
call fcn.00448417
ret 0x14