Function at 0x4021b0
Capabilities:
Create process on windows
Read data from internet
Receive data
Send data
Send http request

Disassembly:
mov eax, 0x1474
call fcn.00405630
push ebx
push ebp
push esi
push edi
xor eax, eax
xor esi, esi
mov ebx, 0x363225
mov ebp, 0x423225
mov edi, 0x443325
mov cl, byte [esi + 0x45a6a2]
movsx edx, cl
add edx, 0xffffffe0
cmp edx, 0x1d
ja case.0x4021e9.33
movzx edx, byte [edx + 0x402704]
jmp dword [edx*4 + 0x4026ec]
mov byte [esp + eax + 0x18], 0x2b
jmp 0x402223
mov dword [esp + eax + 0x18], 0x353225
add eax, 3
jmp 0x402224
mov dword [esp + eax + 0x18], ebx
add eax, 3
jmp 0x402224
mov dword [esp + eax + 0x18], ebp
add eax, 3
jmp 0x402224
mov dword [esp + eax + 0x18], edi
add eax, 3
jmp 0x402224
mov byte [esp + eax + 0x18], cl
inc eax
inc esi
cmp esi, 0x10
jae 0x402233
cmp byte [esi + 0x45a6a2], 0
jne 0x4021d1
mov byte [esp + eax + 0x18], 0
lea eax, [esp + 0x18]
push eax
push 0x45a67c
lea ecx, [esp + 0x88]
push str.Xeed_check_codetrueXPL_checkcode1111TPL_username_sTPL_password_sactionAuthenticatorevent_submit_do_loginanythingTPL_redirect_urlhttp:__chongzhi.taobao.com_item.do_method__3Dlist__26type__3D1__26category__3D0__26supplier__3D0__26promoted__3D0__26order__3D0__26desc__3D0__26page__3D1__26size__3D100
push ecx
mov dword [esp + 0x24], esi
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edx, dword [0x45a658]
mov ebp, dword [sym.imp.WININET.dll_HttpOpenRequestA]
add esp, 0x10
push 0
push 0x4000000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push edx
mov edi, eax
call ebp
mov ebx, dword [sym.imp.WININET.dll_HttpSendRequestA]
push edi
mov esi, eax
lea eax, [esp + 0x84]
push eax
push 0x46
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call ebx
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4022b0
lea ecx, [esp + 0x14]
push ecx
mov edx, 0xffff
sub edx, eax
push edx
lea eax, [eax + 0x44a4e8]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x4022e4
cmp eax, 0x1770
jb 0x4022b0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
push 0x44a4e8
call fcn.00402e80
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push str.sessionID
push 0x40a4e8
call esi
add esp, 0x10
test eax, eax
je 0x402443
push str.sessionID
push 0x40a4e8
call esi
movq xmm0, qword [eax + 0xa]
add esp, 8
push 5
push 0
push 0
movq qword [0x40a46b], xmm0
movq xmm0, qword [eax + 0x12]
push str.http:__regcheckcode.taobao.com_auction_checkcode_sessionID11111111111111111111111111111111
movq qword [0x40a473], xmm0
movq xmm0, qword [eax + 0x1a]
push str.open
movq qword [0x40a47b], xmm0
movq xmm0, qword [eax + 0x22]
push 0
movq qword [0x40a483], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [0x45a670]
push 0
push 0x401dc0
push edx
push 0x67
push 0x400000
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [0x45a658]
mov eax, dword [0x44a4e8]
push 0
push 0x4000000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push ecx
mov dword [esp + 0xc3], eax
mov byte [esp + 0xa0], 0x6e
mov byte [esp + 0xb5], 0x54
call ebp
push edi
lea edx, [esp + 0x84]
push edx
push 0x46
mov esi, eax
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call ebx
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4023f0
lea ecx, [esp + 0x14]
push ecx
mov edx, 0xffff
sub edx, eax
push edx
lea eax, [eax + 0x44a4e8]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x402424
cmp eax, 0x1770
jb 0x4023f0
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
push 0x44a4e8
call fcn.00402e80
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
push str.http:__aq.taobao.com_durex_validate_param
push 0x40a4e8
call esi
mov esi, eax
add esp, 8
test esi, esi
je 0x40254d
add esi, 0x2a
push 0x3d
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov byte [eax], 0
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0xa8c]
push eax
lea ecx, [esp + 0x5c]
push ecx
mov eax, esi
call fcn.00402730
add esp, 0x14
test al, al
jne 0x40249e
push 0
push 0
push 0
push 0x4092f0
jmp 0x4026d7
lea edx, [esp + 0x18]
push edx
push 0x45a67c
lea eax, [esp + 0x88]
push str.Xeed_check_codetrueXPL_checkcode1111TPL_username_sTPL_password_sactionAuthenticatorevent_submit_do_loginanythingTPL_redirect_urlhttp:__chongzhi.taobao.com_item.do_method__3Dlist__26type__3D1__26category__3D0__26supplier__3D0__26promoted__3D0__26order__3D0__26desc__3D0__26page__3D1__26size__3D100
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, dword [0x45a658]
add esp, 0x10
push 0
push 0x4000000
push 0
push 0
push str.HTTP_1.0
push str._member_login.jhtml
push str.POST
push ecx
mov edi, eax
call ebp
push edi
lea edx, [esp + 0x84]
push edx
push 0x46
mov esi, eax
push str.Accept_Encoding:_gzip_r_nContent_Type:_application_x_www_form_urlencoded
push esi
call ebx
xor eax, eax
mov dword [esp + 0x10], eax
mov edi, edi
lea ecx, [esp + 0x14]
push ecx
mov edx, 0xffff
sub edx, eax
push edx
lea eax, [eax + 0x44a4e8]
push eax
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x402534
cmp eax, 0x1770
jb 0x402500
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x10]
push ecx
push 0x44a4e8
call fcn.00402e80
add esp, 8
mov edi, dword [sym.imp.MSVCRT.dll_strstr]
push str.id_tbcpCrumbs_
push 0x40a4e8
call edi
add esp, 8
test eax, eax
je 0x402672
movq xmm0, qword [eax + 0x17]
mov edx, dword [0x45a660]
push 0
push 0x4000000
movq qword [0x40a4a8], xmm0
movq xmm0, qword [eax + 0x1f]
push 0
movq qword [0x40a4b0], xmm0
movq xmm0, qword [eax + 0x27]
push 0
movq qword [0x40a4b8], xmm0
movq xmm0, qword [eax + 0x2f]
push str.HTTP_1.0
movq qword [0x40a4c0], xmm0
movq xmm0, qword [eax + 0x37]
push str._ajax.do_methodgetDurexParamcallbackautoman
movq qword [0x40a4c8], xmm0
movq xmm0, qword [eax + 0x3f]
push 0x408f64
movq qword [0x40a4d0], xmm0
push edx
mov byte [0x40a4d7], 0
call ebp
push 0
push 0
push 0
mov esi, eax
push 0
push esi
call ebx
lea eax, [esp + 0x10]
push eax
push 0x1f4
push 0x44a4e8
push esi
call dword [sym.imp.WININET.dll_InternetReadFile]
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov ecx, dword [esp + 0x10]
push str.param:
push 0x44a4e8
mov byte [ecx + 0x44a4e8], 0
call edi
mov esi, eax
add esp, 8
test esi, esi
je 0x402665
add esi, 7
push 0x27
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov byte [eax], 0
lea edx, [esp + 0x88]
push edx
lea eax, [esp + 0xa8c]
push eax
lea ecx, [esp + 0x5c]
push ecx
mov eax, esi
call fcn.00402730
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1474
ret
push 0
push 0
push 0
push str.eQEQ_Ps
jmp 0x4026d7
push 0x4093b8
push 0x40a4e8
call edi
add esp, 8
test eax, eax
je 0x402692
push 0
push 0
push 0
push 0x4093c8
jmp 0x4026d7
push 0x4093d8
push 0x40a4e8
call edi
add esp, 8
test eax, eax
je 0x4026b2
push 0
push 0
push 0
push 0x4093e8
jmp 0x4026d7
push 0x4093fc
push 0x40a4e8
call edi
add esp, 8
push 0
push 0
push 0
test eax, eax
je 0x4026d2
push 0x409408
jmp 0x4026d7
push 0x409414
push 0
call dword [sym.imp.USER32.dll_MessageBoxExW]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x1474
ret