Function at 0x403155
Capabilities:
Create http request
Get common file path
Inspect section memory permissions

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0xfffffffffffffff0
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebp, dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
and ebx, 0x40000000
je 0x40317d
mov ecx, dword [esi + 4]
push ecx
call ebp
jmp 0x403189
mov edx, dword [esi + 4]
push 4
push edx
call dword [sym.imp.USER32.dll_GetWindow]
mov ecx, dword [esi + 4]
mov edi, eax
lea eax, [esp + 0x30]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
test ebx, ebx
jne 0x403200
test edi, edi
je 0x4031bb
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x10000000
je 0x4031b9
test eax, 0x20000000
je 0x4031bb
xor edi, edi
lea edx, [esp + 0x20]
push 0
push edx
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
test edi, edi
jne 0x4031f2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
jmp 0x40322d
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x40322d
mov edx, dword [esi + 4]
push edx
call ebp
mov ebx, dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, eax
lea eax, [esp + 0x20]
push eax
push ebp
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call ebx
lea edx, [esp + 0x10]
push 2
push edx
push ebp
push edi
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
add eax, ecx
sub ebx, edx
cdq
sub eax, edx
sub ebp, edi
mov ecx, eax
mov eax, ebp
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar ecx, 1
sar eax, 1
sub ecx, eax
mov eax, dword [esp + 0x14]
add eax, edx
cdq
sub eax, edx
mov edi, eax
mov eax, ebx
cdq
sub eax, edx
sar edi, 1
sar eax, 1
sub edi, eax
mov eax, dword [esp + 0x20]
cmp ecx, eax
jl 0x40328a
mov eax, dword [esp + 0x28]
lea edx, [ecx + ebp]
cmp edx, eax
jle 0x40328c
sub eax, ebp
mov ecx, eax
mov eax, dword [esp + 0x24]
cmp edi, eax
jl 0x4032a1
mov eax, dword [esp + 0x2c]
lea edx, [edi + ebx]
cmp edx, eax
jle 0x4032a3
sub eax, ebx
mov edi, eax
mov eax, dword [esi + 4]
push 0x15
push 0xffffffffffffffff
push 0xffffffffffffffff
push edi
push ecx
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, dword [0x415aa8]
push 0
push 0xc
call edi
push eax
push 0xb
call edi
mov ebx, dword [sym.imp.USER32.dll_LoadImageA]
push eax
push 1
push 0x80
push ebp
call ebx
mov ecx, dword [esi + 4]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0x80
push ecx
call ebp
mov edx, dword [0x415aa8]
push 0
push 0x32
mov dword [esp + 0x18], edx
call edi
push eax
push 0x31
call edi
push eax
mov eax, dword [esp + 0x1c]
push 1
push 0x80
push eax
call ebx
mov ecx, dword [esi + 4]
xor ebx, ebx
push eax
push ebx
push 0x80
push ecx
call ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x415a98]
mov edi, eax
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x415b28]
push edi
call fcn.00405270
mov edi, eax
mov eax, dword [0x415a98]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, ebx
je 0x403368
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], ecx
jmp 0x40336c
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
lea ecx, [edi + 4]
push edx
call fcn.00405210
cmp esi, ebx
je 0x403386
lea eax, [esi + 0x20]
mov dword [esp + 0x10], eax
jmp 0x40338a
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x10]
push ecx
lea ecx, [edi + 0x10]
call fcn.00405210
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4033b6
lea edx, [esp + 0x10]
lea ecx, [esi + 0x24]
push edx
mov dword [esp + 0x14], eax
mov word [esp + 0x18], 4
call fcn.004052b0
push ebx
push ebx
push ebx
push 1
push str.GetFetion_1.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi + 0x3c], eax
mov edi, str.Fetion_install.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.Fetion_install.exe
lea ecx, [esi + 0x40]
call fcn.00401520
lea edi, [esi + 0x50]
mov dword [esi + 0x154], ebx
push edi
push 0x104
mov dword [esi + 0x158], ebx
mov dword [esi + 0x15c], ebx
mov byte [esi + 0x160], 0
mov dword [esi + 0x198], ebx
mov dword [esi + 0x19c], ebx
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40342d
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3e9
push eax
call edi
push 0x640000
push ebx
mov ecx, eax
push 0x401
push ecx
mov dword [esi + 0x164], eax
call ebp
mov edx, dword [esi + 0x164]
push ebx
push 1
push 0x404
push edx
call ebp
mov eax, dword [esi + 4]
push 0x3ee
push eax
call edi
mov ecx, dword [0x4120b0]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, esi
call fcn.004047e0
mov ecx, esi
call fcn.00404d20
mov ecx, esi
call fcn.004043e0
mov ecx, esi
call fcn.00404160
mov edx, dword [esi + 4]
lea edi, [esi + 0x1a0]
push 0x7e8
push edx
mov ecx, edi
call fcn.00405440
push 0xce
mov ecx, edi
call fcn.00405460
push 0x412678
push 0x80
mov ecx, edi
call fcn.004054d0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x10