Function at 0x477d30
Capabilities:
Accept command line arguments
Create http request
Create process on windows
Get common file path
Parse pe header
Read data from internet
Read file on windows
Receive data
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53eab2
mov eax, dword fs:[0]
push eax
mov eax, 0x1508
call fcn.00500f90
mov eax, dword [0x5bc684]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 0x1484], eax
mov dword [ebp - 0x148c], ecx
call fcn.004779f0
mov edx, dword [0x5bbfe4]
add esp, 4
mov dword [ebp - 0x1478], edx
mov dword [ebp - 4], 0
push 0x54f15a
lea ecx, [ebp - 0x1478]
call fcn.004bfc00
push 0
push 0xe00b
lea ecx, [ebp - 0x1478]
call fcn.004c1150
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x1478]
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
mov ebx, eax
test ebx, ebx
jne 0x477dee
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1478]
call fcn.004bfa40
lea eax, [ebx + 4]
jmp 0x478351
push 0x4f
lea ecx, [ebp - 0x5f]
push 0
push ecx
mov byte [ebp - 0x60], 0
call fcn.004ff6f0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0x5bf948
push ebx
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1490], eax
lea edx, [ebp - 0x1490]
push edx
mov ecx, 0x4f
sub ecx, eax
push ecx
lea edx, [ebp + eax - 0x60]
push edx
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov esi, eax
test esi, esi
je 0x477e4b
mov eax, dword [ebp - 0x1490]
test eax, eax
jne 0x477e20
push edi
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
call edi
push ebx
call edi
test esi, esi
jne 0x477e75
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1478]
call fcn.004bfa40
lea eax, [esi + 4]
jmp 0x478351
lea eax, [ebp - 0x1488]
push eax
lea ecx, [ebp - 0x147c]
push ecx
lea edx, [ebp - 0x1480]
push edx
lea eax, [ebp - 0x60]
push eax
call fcn.004777f0
mov esi, dword [ebp - 0x1488]
lea eax, [esi - 0x2036]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x478338
call fcn.00477af0
mov ecx, 0x104
push esi
mov dword [ebp - 0x1480], eax
lea eax, [ebp - 0x164]
push ecx
push eax
call fcn.00477820
add esp, 0xc
push ebx
push 0xe00c
lea ecx, [ebp - 0x147c]
call fcn.00406200
mov byte [ebp - 4], 5
push ebx
lea ecx, [ebp - 0x1474]
cmp dword [ebp - 0x1480], ebx
je 0x477f4a
push 0x88
call fcn.00406200
mov byte [ebp - 4], 6
fild dword [ebp - 0x1480]
mov ecx, dword [ebp - 0x1480]
test ecx, ecx
jns 0x477f15
fadd qword [0x55fd08]
fld qword [0x56e018]
mov edx, dword [ebp - 0x147c]
mov eax, dword [ebp - 0x1474]
fmul st(1), st(0)
sub esp, 8
lea ecx, [ebp - 0x470]
fmulp st(1)
fstp qword [esp]
push esi
push edx
push eax
push 0x104
push ecx
call fcn.00500ba9
add esp, 0x1c
jmp 0x477f7b
push 0x89
call fcn.00406200
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x147c]
mov eax, dword [ebp - 0x1474]
push esi
push edx
push eax
lea ecx, [ebp - 0x470]
push 0x104
push ecx
call fcn.00500ba9
add esp, 0x14
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1474]
call fcn.004bfa40
push 0
push 0x8a
lea ecx, [ebp - 0x1488]
call fcn.00406200
mov byte [ebp - 4], 0xa
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edx, dword [ebp - 0x1484]
push eax
push edx
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x14d0]
call fcn.0047b010
mov byte [ebp - 4], 0xb
push 0
push 0x5c0b4c
lea ecx, [ebp - 0x14d0]
call fcn.004c3750
cmp eax, 2
jne 0x478021
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14d0]
call fcn.00477980
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1488]
call fcn.004bfa40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x147c]
call fcn.004bfa40
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1478]
call fcn.004bfa40
xor eax, eax
jmp 0x478351
mov ecx, dword [ebp - 0x1480]
neg ecx
push 1
sbb ecx, ecx
lea edx, [ebp - 0x1480]
and ecx, edx
push ecx
push 1
push 1
lea eax, [ebp - 0x164]
push eax
push 0x5bf840
call fcn.0040ac80
mov esi, eax
add esp, 0x18
test esi, esi
je 0x478094
xor ebx, ebx
cmp esi, 0x4c7
setne bl
add ebx, 2
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x14d0]
call fcn.00477980
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1488]
call fcn.004bfa40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x147c]
call fcn.004bfa40
jmp 0x47833d
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
lea ecx, [ebp - 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x478114
push 0
lea edx, [ebp - 0x1494]
push edx
push 0x1000
lea eax, [ebp - 0x1470]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, 0x5a4d
cmp word [ebp - 0x1470], cx
jne 0x4780fb
mov eax, dword [ebp - 0x1434]
cmp dword [ebp + eax - 0x1470], 0x4550
lea eax, [ebp + eax - 0x1470]
je 0x478105
mov ebx, 3
mov esi, 0x4c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x478062
lea edx, [ebp - 0x268]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
cmp byte [edi], 0x22
jne 0x47814d
lea eax, [edi + 1]
push 0x54f324
push eax
call fcn.004fee10
mov esi, eax
add esp, 8
test esi, esi
je 0x478161
inc esi
jmp 0x47815d
push 0x54f320
push edi
call fcn.004fee10
add esp, 8
mov esi, eax
test esi, esi
jne 0x478163
mov esi, edi
cmp byte [esi], 0x20
jne 0x478169
inc esi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x47818c
cmp byte [eax], 0
je 0x47818c
lea edx, [ebp - 0x36c]
sub edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x478180
jmp 0x4781a0
push 0x104
lea ecx, [ebp - 0x36c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x36c]
push 0x5c
push edx
call fcn.004ff460
add esp, 8
test eax, eax
je 0x4781b9
mov byte [eax + 1], 0
mov eax, dword [0x5bbfe4]
mov dword [ebp - 0x1474], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x1474]
call fcn.004bfc00
push 0x56e010
lea ecx, [ebp - 0x1474]
call fcn.004bfd50
lea edx, [ebp - 0x36c]
push edx
lea ecx, [ebp - 0x1474]
call fcn.004bfd50
cmp byte [esi], 0
je 0x47821a
push 0x20
lea ecx, [ebp - 0x1474]
call fcn.004bfd90
push esi
lea ecx, [ebp - 0x1474]
call fcn.004bfd50
push 0x44
lea eax, [ebp - 0x1514]
push 0
push eax
call fcn.004ff6f0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0x14a4]
push ecx
mov ecx, dword [ebp - 0x1474]
lea edx, [ebp - 0x1514]
push edx
mov dword [ebp - 0x14a4], eax
mov dword [ebp - 0x14a0], eax
mov dword [ebp - 0x149c], eax
mov dword [ebp - 0x1498], eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x24
push 0
push 0
push 0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4782fd
push eax
push 0x8b
lea ecx, [ebp - 0x1484]
call fcn.00406200
mov bl, 0x10
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1484]
lea edx, [ebp - 0x164]
push edx
push eax
lea ecx, [ebp - 0x268]
push ecx
call fcn.004ff1e4
add esp, 0xc
push 0
push 0x8f
lea ecx, [ebp - 0x148c]
call fcn.00406200
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x148c]
push 0x40
push edx
lea eax, [ebp - 0x268]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x148c]
call fcn.004bfa40
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1484]
call fcn.004bfa40
jmp 0x478331
mov eax, dword [0x5bfd6c]
test eax, eax
je 0x478317
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x5bfd6c], 0
mov ecx, dword [ebp - 0x148c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x14a0]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 1
call fcn.00502895
mov ebx, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1478]
call fcn.004bfa40
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe1f5
mov esp, ebp
pop ebp
ret