Function at 0x1000aa70
Capabilities:
Download url
Get file size
Read file on windows
Receive data
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov dword [ebp - 0x618], ecx
mov eax, dword [ebp - 0x618]
add eax, 0x150a
push eax
push str.RebuildBlockedSites___Loading_FirewallRules_for__ws
call fcn.10010cb0
add esp, 8
mov ecx, dword [ebp - 0x618]
add ecx, 0x150a
push ecx
push str.SELECT__FROM_FirewallRules_WHERE_lower_WindowsUser_lower__ws_
push 0x104
lea edx, [ebp - 0x320]
push edx
call fcn.10003100
add esp, 0x10
lea eax, [ebp - 0x320]
push eax
push str.RebuildBlockedSites____hs
call fcn.10010cb0
add esp, 8
push 0x100d7d68
mov ecx, dword [ebp - 0x618]
add ecx, 0x150a
push ecx
call fcn.1009ebf1
add esp, 8
test eax, eax
jne 0x1000aaf7
mov al, 1
jmp 0x1000b168
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x320]
push edx
mov ecx, dword [ebp - 0x618]
call fcn.10017210
cmp dword [ebp - 0x214], 0
jne 0x1000acea
mov eax, dword [ebp - 0x618]
add eax, 0x148a
push eax
mov ecx, dword [ebp - 0x618]
add ecx, 0x150a
push ecx
push str.http:__www.exploreanywhere.net_ea_updates_GetFirewall.php_user_wsnocache1machine_ws
push 0x104
lea edx, [ebp - 0x538]
push edx
call fcn.10003de0
add esp, 0x14
push 0
push 0
push 0x104
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x538]
push ecx
push 0
call sub.urlmon.dll_URLDownloadToCacheFileW
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x324], eax
push 0
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
add ecx, 1
push ecx
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x608], eax
mov edx, dword [ebp - 0x608]
mov dword [ebp - 0x330], edx
mov eax, dword [ebp - 0x328]
add eax, 1
push eax
push 0
mov ecx, dword [ebp - 0x330]
push ecx
call fcn.1009eb40
add esp, 0xc
push 0
lea edx, [ebp - 0x328]
push edx
mov eax, dword [ebp - 0x328]
push eax
mov ecx, dword [ebp - 0x330]
push ecx
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x328]
add eax, 2
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1009ead1
add esp, 4
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x330]
push ecx
push 0x100defa0
mov edx, dword [ebp - 0x328]
add edx, 2
push edx
mov eax, dword [ebp - 0x32c]
push eax
call fcn.10003de0
add esp, 0x10
mov ecx, dword [ebp - 0x32c]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.10017010
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x320]
push edx
mov ecx, dword [ebp - 0x618]
call fcn.10017210
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x610], eax
mov ecx, dword [ebp - 0x610]
push ecx
call fcn.1009ea5c
add esp, 4
mov edx, dword [ebp - 0x32c]
mov dword [ebp - 0x614], edx
mov eax, dword [ebp - 0x614]
push eax
call fcn.1009ea5c
add esp, 4
mov ecx, dword [ebp - 0x618]
add ecx, 0x1b8a
call fcn.1000dee0
mov ecx, dword [ebp - 0x618]
add ecx, 0x1ba2
call fcn.1000dee0
mov ecx, dword [ebp - 0x618]
add ecx, 0x1bba
call fcn.1000e170
mov dword [ebp - 0x20c], 0
mov ecx, dword [ebp - 0x214]
push ecx
push str.RebuildBlockedSites___Loading_FirewallRules___Rows_d
call fcn.10010cb0
add esp, 8
mov dword [ebp - 0x53c], 0
jmp 0x1000ad56
mov edx, dword [ebp - 0x53c]
add edx, 1
mov dword [ebp - 0x53c], edx
mov eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x214]
jg 0x1000b154
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x56c], eax
mov ecx, dword [ebp - 0x20c]
add ecx, 1
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x550], ecx
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x564], edx
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x560], eax
mov ecx, dword [ebp - 0x20c]
add ecx, 1
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x548], ecx
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x544], edx
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x54c], eax
mov ecx, dword [ebp - 0x20c]
add ecx, 1
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x554], ecx
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x558], edx
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
mov edx, dword [ebp - 0x210]
mov eax, dword [edx + ecx*4]
mov dword [ebp - 0x55c], eax
mov ecx, dword [ebp - 0x20c]
add ecx, 1
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp - 0x20c]
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x540], ecx
mov edx, dword [ebp - 0x20c]
add edx, 1
mov dword [ebp - 0x20c], edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x210]
mov edx, dword [ecx + eax*4]
mov dword [ebp - 0x568], edx
mov eax, dword [ebp - 0x20c]
add eax, 1
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x550], 0
jne 0x1000af26
jmp 0x1000ad47
cmp dword [ebp - 0x564], 0
jne 0x1000af34
jmp 0x1000ad47
cmp dword [ebp - 0x560], 0
jne 0x1000af42
jmp 0x1000ad47
cmp dword [ebp - 0x554], 0
jne 0x1000af50
jmp 0x1000ad47
mov ecx, dword [ebp - 0x564]
push ecx
mov edx, dword [ebp - 0x550]
push edx
push str.Blocked_hs___hs
call fcn.10010cb0
add esp, 0xc
mov eax, dword [ebp - 0x564]
push eax
call fcn.1009f268
add esp, 4
test eax, eax
jle 0x1000b14f
mov ecx, dword [ebp - 0x560]
push ecx
push str.Blocking_firewalled_site__hs
call fcn.10010cb0
add esp, 8
mov dword [ebp - 0x600], 0xa
mov edx, dword [ebp - 0x554]
push edx
push 0x100defa0
push 0x40
lea eax, [ebp - 0x5fc]
push eax
call fcn.10003de0
add esp, 0x10
mov ecx, dword [ebp - 0x560]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.1000a690
mov dword [ebp - 0x574], eax
lea edx, [ebp - 0x574]
push edx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1b8a
call fcn.1000de70
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0
je 0x1000b014
mov eax, dword [ebp - 0x578]
push eax
mov ecx, dword [ebp - 0x618]
add ecx, 0x1b8a
call fcn.1000de30
lea ecx, [ebp - 0x600]
push ecx
lea edx, [ebp - 0x574]
push edx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1b8a
call fcn.1000dda0
mov eax, dword [ebp - 0x548]
push eax
call fcn.1009f268
add esp, 4
mov dword [ebp - 0x570], eax
cmp dword [ebp - 0x570], 0
jbe 0x1000b0af
lea ecx, [ebp - 0x570]
push ecx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1bba
call fcn.1000e100
mov dword [ebp - 0x604], eax
cmp dword [ebp - 0x604], 0
je 0x1000b090
mov edx, dword [ebp - 0x604]
push edx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1bba
call fcn.1000e0c0
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0x570]
push ecx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1bba
call fcn.1000e050
mov edx, dword [ebp - 0x540]
push edx
call fcn.1009f268
add esp, 4
test eax, eax
jle 0x1000b14f
mov eax, dword [ebp - 0x544]
push eax
call fcn.1009ec30
add esp, 4
test eax, eax
jbe 0x1000b14f
mov ecx, dword [ebp - 0x544]
push ecx
mov ecx, dword [ebp - 0x618]
call fcn.1000a690
mov dword [ebp - 0x574], eax
lea edx, [ebp - 0x574]
push edx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1ba2
call fcn.1000de70
mov dword [ebp - 0x578], eax
cmp dword [ebp - 0x578], 0
je 0x1000b130
mov eax, dword [ebp - 0x578]
push eax
mov ecx, dword [ebp - 0x618]
add ecx, 0x1ba2
call fcn.1000de30
lea ecx, [ebp - 0x600]
push ecx
lea edx, [ebp - 0x574]
push edx
mov ecx, dword [ebp - 0x618]
add ecx, 0x1ba2
call fcn.1000dda0
jmp 0x1000ad47
mov eax, dword [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x618]
call fcn.10017240
mov al, 1
mov esp, ebp
pop ebp
ret