This program downloads a file from a remote server and stores it as c:\tempdownload.exe on the local system.
new
operator at ❶, which tells us that this code is creating an object. A reference to the object is returned in EAX, and is eventually stored in var_8
at ❷ and var_4
at ❸. var_4
is moved into ECX at ❹, indicating that it will be passed as the this
pointer in a function call. A pointer to the URL is then stored at the beginning of the object, followed by a call to the function sub_401040
, which is shown in .this
pointer in ECX accessed and stored in var_4
at ❶. The remainder of the code is arguments being placed on the stack for the call to URLDownloadToFileA
. To obtain the URL that will be used for the function call, the this
pointer is accessed at ❷, then the first data element stored in the object is accessed at ❸, and then it’s pushed onto the stack at ❹.Recall from the main
method that the first element stored in the object was the URL string . The main
method returns, and the program is finished executing.