Function at 0x402a40
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file
Download url
Receive data

Disassembly:
push 0xffffffffffffffff
push 0x449c63
mov eax, dword fs:[0]
push eax
sub esp, 0x388
mov eax, dword [0x4594d4]
xor eax, esp
mov dword [esp + 0x380], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4594d4]
xor eax, esp
push eax
lea eax, [esp + 0x39c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x3ac]
fldz
mov ebx, ecx
fstp dword [ebx + 0x11c]
xor ebp, ebp
push 0x58
mov dword [esp + 0x20], eax
xor eax, eax
lea ecx, [esp + 0x134]
push ebp
lea esi, [ebx + 0x118]
lea edi, [ebx + 0x11c]
push ecx
mov dword [esp + 0x38], ebx
mov dword [esi], ebp
mov dword [esp + 0x108], ebp
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
call fcn.0042d120
lea eax, [ebx + 0x10c]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x114], eax
lea eax, [ebx + 0x114]
add esp, 0xc
mov dword [esp + 0x10c], edi
mov dword [eax], 0xe4e1c0
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], esi
call fcn.00444ba0
mov byte [esp + 0x17], al
mov dword [esp + 0x34], ebp
cmp dword [ebx + 0x154], ebp
je 0x402bc3
push 0x206
lea eax, [esp + 0x192]
xor edx, edx
push ebp
push eax
mov byte [esp + 0x23], 0
mov word [esp + 0x198], dx
call fcn.0042d120
mov ecx, dword [esp + 0x28]
add esp, 0xc
push ecx
lea edx, [esp + 0x190]
push str._s.xml
push edx
call fcn.0042bffa
add esp, 0xc
lea eax, [esp + 0x18c]
push str.w__ccsUNICODE
push eax
call fcn.0042c197
add esp, 8
mov dword [esp + 0x34], eax
cmp eax, ebp
je 0x402bc3
push str.anti_spyware_101.com
push str._ver_log__n_sid__s__sid__n
push eax
call fcn.0042bf66
add esp, 0xc
or eax, 0xffffffff
mov dword [esp + 0x38], ebp
mov dword [esp + 0x28], eax
cmp dword [esp + 0x100], eax
je 0x4035b7
mov esi, dword [ebx + 0x12c]
cmp esi, dword [ebx + 0x130]
jbe 0x402bee
call fcn.0042c47c
mov edi, dword [ebx + 0x120]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
lea esp, [esp]
mov esi, dword [ebx + 0x130]
cmp dword [ebx + 0x12c], esi
jbe 0x402c13
call fcn.0042c47c
mov eax, dword [ebx + 0x120]
cmp edi, ebp
je 0x402c21
cmp edi, eax
je 0x402c26
call fcn.0042c47c
cmp dword [esp + 0x24], esi
je 0x4035b7
inc dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0xd8], 7
mov dword [esp + 0xd4], ebp
mov word [esp + 0xc4], cx
mov dword [esp + 0x3a4], ebp
cmp byte [esp + 0x17], cl
je 0x402c83
cmp edi, ebp
jne 0x402c7f
call fcn.0042c47c
xor eax, eax
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 0x10]
jb 0x402c76
call fcn.0042c47c
mov eax, dword [esp + 0x24]
add eax, 0x1c
jmp 0x402ca4
mov eax, dword [edi]
jmp 0x402c68
cmp edi, ebp
jne 0x402ddc
call fcn.0042c47c
xor eax, eax
mov ecx, dword [esp + 0x24]
cmp ecx, dword [eax + 0x10]
jb 0x402ca0
call fcn.0042c47c
mov eax, dword [esp + 0x24]
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0xc8]
call fcn.00405a90
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, 8
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0xd8], edi
jae 0x402cfb
lea eax, [esp + 0xc4]
xor edx, edx
mov ecx, eax
mov dword [esp + 0xbc], 7
mov dword [esp + 0xb8], ebp
mov word [esp + 0xa8], dx
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x402d20
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xa8]
call fcn.00406a40
lea eax, [esp + 0xfc]
push eax
mov ecx, esi
push ecx
mov byte [esp + 0x3ac], 1
call fcn.00445370
add esp, 8
mov byte [esp + 0x3a4], 0
mov dword [esp + 0x28], eax
cmp dword [esp + 0xbc], edi
jb 0x402d7c
mov edx, dword [esp + 0xa8]
push edx
call fcn.0042bbb6
add esp, 4
mov ecx, dword [esp + 0x100]
mov eax, dword [esp + 0x118]
push ecx
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x28], 1
jne 0x402e11
mov edx, dword [esp + 0x30]
cmp dword [edx], ebp
jne 0x402e11
push 0x1c
call fcn.0042c997
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x402de3
lea eax, [esp + 0x18]
mov dword [esi], vtable.CCallback.0
mov dword [esi + 4], vtable.CCallback.1.0
mov dword [esi + 8], ebp
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
jmp 0x402de5
mov eax, dword [edi]
jmp 0x402c92
xor esi, esi
mov dword [esi + 0x18], ebx
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0xd8], edi
jae 0x402dff
lea eax, [esp + 0xc4]
mov ecx, dword [esp + 0x1c]
push esi
push ebp
push ecx
push eax
push ebp
call sub.urlmon.dll_URLDownloadToFileW
mov dword [esp + 0x28], eax
cmp dword [esp + 0x18], 0xc8
je 0x402e50
cmp dword [ebx + 0x154], ebp
jne 0x402e5c
mov dword [esp + 0x3a4], 0xffffffff
cmp dword [esp + 0xd8], edi
jb 0x4033f3
mov edx, dword [esp + 0xc4]
push edx
call fcn.0042bbb6
add esp, 4
jmp 0x4033f3
cmp dword [ebx + 0x154], ebp
je 0x403424
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x403066
call fcn.0042c47c
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x10]
jb 0x402e7d
call fcn.0042c47c
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0xe4], cx
lea eax, [esi + 0x38]
push ebp
lea ecx, [esp + 0xe4]
mov dword [esp + 0xfc], 7
mov dword [esp + 0xf8], ebp
call fcn.00405a90
push 0x44cd2c
mov ebx, 1
xor eax, eax
lea edx, [esp + 0xe0]
mov byte [esp + 0x3a8], 2
call fcn.00405cf0
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402f09
mov eax, 1
lea esi, [esp + 0xdc]
call fcn.004050d0
push 5
mov eax, ebx
mov ecx, esi
call fcn.00405b80
lea eax, [ebx + 1]
push 0x44cd2c
mov ebx, 1
mov edx, esi
call fcn.00405cf0
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402ed2
mov edi, dword [esp + 0x34]
xor ebp, ebp
cmp edi, ebp
je 0x402f49
cmp dword [esp + 0xd8], 8
mov eax, dword [esp + 0xc4]
jae 0x402f2b
lea eax, [esp + 0xc4]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push ecx
push str._link__n_order__d__order__n_bit32__n_http__d__http__n_apierr__d__apierr__n_url__s__url__n
push edi
call fcn.0042bf66
add esp, 0x18
xor bl, bl
cmp dword [esp + 0x28], ebp
jne 0x40306d
cmp dword [esp + 0x18], 0xc8
jne 0x40306d
lea esi, [esp + 0x3c]
call fcn.0040f700
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x3a4], 3
call fcn.0040f560
test al, al
je 0x402fb8
call fcn.0040f5d0
test eax, eax
mov eax, dword [esp + 0x3c]
sete bl
cmp eax, 0xffffffff
je 0x402f9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x402fac
push eax
call fcn.0042bd0e
add esp, 4
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x58], ebp
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0xa8]
push eax
call fcn.00444d80
add esp, 8
cmp edi, ebp
je 0x402ff8
cmp dword [esp + 0xbc], 8
mov eax, dword [esp + 0xa8]
jae 0x402fe9
lea eax, [esp + 0xa8]
push eax
push str._md5__s__md5__n
push edi
call fcn.0042bf66
add esp, 0xc
cmp dword [esp + 0xbc], 8
jb 0x403012
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.0042bbb6
add esp, 4
mov byte [esp + 0x3a4], 2
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0xbc], 7
mov dword [esp + 0xb8], ebp
mov word [esp + 0xa8], dx
cmp eax, 0xffffffff
je 0x403046
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x403057
push eax
call fcn.0042bd0e
add esp, 4
test bl, bl
je 0x40306d
cmp edi, ebp
je 0x40307f
push str._signed_true__signed__n__bit32__n
jmp 0x403076
mov eax, dword [eax]
jmp 0x402e6f
cmp edi, ebp
je 0x40307f
push str._signed_false__signed__n__bit32__n
push edi
call fcn.0042bf66
add esp, 8
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x4031cd
call fcn.0042c47c
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x10]
jb 0x4030a0
call fcn.0042c47c
push 0xffffffffffffffff
push ebp
lea eax, [esi + 0x1c]
lea ecx, [esp + 0xc8]
call fcn.00405a90
mov ebx, dword [esp + 0x1c]
push ebp
push 0x80
push 2
push ebp
push ebp
push 0x40000000
push ebx
mov dword [esp + 0x34], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esp + 0xd8], 8
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0xc4]
jae 0x4030ef
lea eax, [esp + 0xc4]
xor ecx, ecx
mov word [esp + 0xa8], cx
mov ecx, eax
mov dword [esp + 0xbc], 7
mov dword [esp + 0xb8], ebp
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x403110
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xa8]
call fcn.00406a40
lea edx, [esp + 0xfc]
push edx
mov eax, esi
push eax
mov byte [esp + 0x3ac], 4
call fcn.00445370
add esp, 8
mov esi, eax
mov byte [esp + 0x3a4], 2
cmp dword [esp + 0xbc], 8
mov dword [esp + 0x28], esi
jb 0x40316f
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.0042bbb6
add esp, 4
mov eax, dword [esp + 0x100]
mov edx, dword [esp + 0x118]
push eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x403205
mov ecx, dword [esp + 0x30]
cmp dword [ecx], ebp
jne 0x403205
push 0x1c
call fcn.0042c997
mov esi, eax
add esp, 4
cmp esi, ebp
je 0x4031d4
lea edx, [esp + 0x18]
mov dword [esi], vtable.CCallback.0
mov dword [esi + 4], vtable.CCallback.1.0
mov dword [esi + 8], ebp
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ebp
mov dword [esi + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
jmp 0x4031d6
mov eax, dword [eax]
jmp 0x403092
xor esi, esi
mov eax, dword [esp + 0x2c]
mov dword [esi + 0x18], eax
cmp dword [esp + 0xd8], 8
mov eax, dword [esp + 0xc4]
jae 0x4031f5
lea eax, [esp + 0xc4]
push esi
push ebp
push ebx
push eax
push ebp
call sub.urlmon.dll_URLDownloadToFileW
mov esi, eax
mov dword [esp + 0x28], eax
cmp edi, ebp
je 0x403236
cmp dword [esp + 0xd8], 8
mov eax, dword [esp + 0xc4]
jae 0x403221
lea eax, [esp + 0xc4]
mov ecx, dword [esp + 0x18]
push eax
push esi
push ecx
push str._bit64__n_http__d__http__n_apierr__d__apierr__n_url__s__url__n
push edi
call fcn.0042bf66
add esp, 0x14
xor bl, bl
cmp esi, ebp
jne 0x403352
cmp dword [esp + 0x18], 0xc8
jne 0x403352
lea esi, [esp + 0x3c]
call fcn.0040f700
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x3a4], 5
call fcn.0040f560
test al, al
je 0x4032a3
call fcn.0040f5d0
test eax, eax
mov eax, dword [esp + 0x3c]
sete bl
cmp eax, 0xffffffff
je 0x403286
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x403297
push eax
call fcn.0042bd0e
add esp, 4
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x58], ebp
mov edx, dword [esp + 0x1c]
push edx
lea eax, [esp + 0xa8]
push eax
call fcn.00444d80
add esp, 8
mov esi, 8
cmp edi, ebp
je 0x4032e7
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0xbc], esi
jae 0x4032d8
lea eax, [esp + 0xa8]
push eax
push str._md5__s__md5__n
push edi
call fcn.0042bf66
add esp, 0xc
cmp dword [esp + 0xbc], esi
jb 0x403300
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.0042bbb6
add esp, 4
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0xbc], 7
mov dword [esp + 0xb8], ebp
mov word [esp + 0xa8], dx
cmp eax, 0xffffffff
je 0x40332c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x58]
cmp eax, ebp
je 0x40333d
push eax
call fcn.0042bd0e
add esp, 4
test bl, bl
je 0x403352
cmp edi, ebp
je 0x403396
push str._signed_true__signed__n__bit64__n
push edi
call fcn.0042bf66
jmp 0x403366
cmp edi, ebp
je 0x403391
push str._signed_false__signed__n__bit64__n
push edi
call fcn.0042bf66
mov esi, 8
mov eax, dword [esp + 0xe8]
add esp, 8
cmp dword [esp + 0xf4], esi
jae 0x403380
lea eax, [esp + 0xe0]
push eax
push str._tracker__s__tracker__n__link__n
push edi
call fcn.0042bf66
add esp, 0xc
jmp 0x403396
mov esi, 8
cmp dword [esp + 0xf4], esi
jb 0x4033af
mov eax, dword [esp + 0xe0]
push eax
call fcn.0042bbb6
add esp, 4
xor ecx, ecx
mov dword [esp + 0x3a4], 0xffffffff
mov dword [esp + 0xf4], 7
mov dword [esp + 0xf0], ebp
mov word [esp + 0xe0], cx
cmp dword [esp + 0xd8], esi
jb 0x4033ef
mov edx, dword [esp + 0xc4]
push edx
call fcn.0042bbb6
add esp, 4
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
test eax, eax
jne 0x4034c5
call fcn.0042c47c
xor eax, eax
mov edx, dword [esp + 0x24]
cmp edx, dword [eax + 0x10]
jb 0x403414
call fcn.0042c47c
add dword [esp + 0x24], 0x54
mov edi, dword [esp + 0x20]
xor ebp, ebp
jmp 0x402c00
cmp dword [esp + 0x28], ebp
jne 0x403498
mov eax, dword [esp + 0x114]
mov eax, dword [eax]
cmp eax, ebp
je 0x403498
cmp eax, 0x100000
jbe 0x403498
lea esi, [esp + 0x3c]
call fcn.0040f700
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x3a4], 6
call fcn.0040f560
test al, al
je 0x403473
call fcn.0040f5d0
test eax, eax
sete bl
call fcn.0040f780
test bl, bl
jne 0x4034cc
mov ebx, dword [esp + 0x2c]
lea esi, [esp + 0x3c]
call fcn.0040f780
lea esi, [esp + 0xc0]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.00401380
jmp 0x4033f3
mov dword [esp + 0x3a4], 0xffffffff
cmp dword [esp + 0xd8], edi
jb 0x4033f3
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.0042bbb6
add esp, 4
jmp 0x4033f3
mov eax, dword [eax]
jmp 0x403406
lea esi, [esp + 0x20]
call fcn.00405440
add eax, 0x38
cmp dword [eax + 0x14], ebp
jbe 0x403591
lea ecx, [esp + 0xdc]
call fcn.00445160
push 0x44cc78
lea ecx, [esp + 0xa8]
mov byte [esp + 0x3a8], 7
call fcn.00404d10
lea eax, [esp + 0xa4]
push eax
mov byte [esp + 0x3a8], 8
call fcn.00405440
add eax, 0x38
push eax
lea ecx, [esp + 0xe4]
call fcn.004455e0
lea ecx, [esp + 0xa4]
mov esi, eax
mov byte [esp + 0x3a4], 7
call fcn.00404d50
cmp esi, 1
jne 0x40357d
mov eax, dword [esp + 0x20]
cmp eax, ebp
jne 0x40356d
call fcn.0042c47c
xor eax, eax
mov esi, dword [esp + 0x24]
cmp esi, dword [eax + 0x10]
jb 0x403563
call fcn.0042c47c
cmp dword [esi + 0x50], edi
jb 0x403571
mov eax, dword [esi + 0x3c]
jmp 0x403574
mov eax, dword [eax]
jmp 0x403555
lea eax, [esi + 0x3c]
push eax
call fcn.00401d90
add esp, 4
lea ecx, [esp + 0xdc]
mov byte [esp + 0x3a4], 6
call fcn.00445300
lea esi, [esp + 0x3c]
call fcn.0040f780
lea esi, [esp + 0xc0]
mov dword [esp + 0x3a4], 0xffffffff
call fcn.00401380
mov ebx, dword [esp + 0x2c]
jmp 0x4035bc
mov edi, 8
cmp dword [ebx + 0x154], ebp
je 0x4035ea
mov esi, dword [esp + 0x34]
cmp esi, ebp
je 0x4035e0
push str.__ver_log_
push esi
call fcn.0042bf66
push esi
call fcn.0042c900
add esp, 0xc
mov eax, 1
jmp 0x40370f
mov esi, dword [esp + 0x28]
cmp esi, ebp
jne 0x4035fd
mov ecx, dword [esp + 0x114]
cmp dword [ecx], ebp
jne 0x4035e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40370d
mov edx, dword [esp + 0x30]
cmp dword [edx], ebp
jne 0x40370d
mov ecx, dword [ebx + 0x130]
sub ecx, dword [ebx + 0x12c]
mov eax, 0x30c30c31
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x40363b
call fcn.0042c47c
mov eax, dword [ebx + 0x12c]
xor ecx, ecx
push 0xffffffffffffffff
mov word [esp + 0xe4], cx
push ebp
lea ecx, [esp + 0xe4]
mov dword [esp + 0xfc], 7
mov dword [esp + 0xf8], ebp
call fcn.00405a90
push ebp
push str.Download_Error
cmp esi, 0xffffffff
jne 0x403682
mov edx, dword [ebx + 4]
push str.SpyHunter_was_unable_to_create_destination_file_and_install._n_nPlease_click_the
push edx
jmp 0x40368b
mov eax, dword [ebx + 4]
push str.Due_to_an_Internet_connection_issue__SpyHunter_was_unable_to_completely_download_and_install._n_nPlease_click_the
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x4036f4
mov eax, dword [esp + 0xe0]
cmp dword [esp + 0xf4], edi
jae 0x4036ad
lea eax, [esp + 0xe0]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ebp
push ebp
push eax
push str.open
push ebp
call esi
cmp eax, 0x20
jg 0x4036f4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0xe0]
cmp dword [esp + 0xf4], edi
jae 0x4036e7
lea eax, [esp + 0xe0]
push 1
push ebp
push ebp
push eax
push str.open
push ebp
call esi
cmp dword [esp + 0xf4], edi
jb 0x40370d
mov ecx, dword [esp + 0xe0]
push ecx
call fcn.0042bbb6
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x39c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x380]
xor ecx, esp
call fcn.0042bbc1
add esp, 0x394
ret 4