Function at 0x4b0d50
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete file
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4b0d58
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b1344
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4af244
call sub.user32.dll_EnumWindows
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
push 0
push 0x4af244
call sub.user32.dll_EnumWindows
lea edx, [ebp - 0x10]
mov eax, dword [0x63ff2c]
call fcn.004b01c8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0x4b135c
call fcn.004055fc
mov eax, dword [ebp - 8]
call fcn.0040a420
test al, al
je 0x4b0dcc
mov eax, dword [ebp - 8]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405774
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff54]
mov edx, 0x4b1374
call fcn.0040570c
jne 0x4b0e53
push 0
lea eax, [ebp - 0xc]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4b0e47
mov eax, 0x4b1380
call fcn.00443904
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046ffbc
jmp 0x4b12fa
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff24]
mov edx, 0x4b13b4
call fcn.0040570c
jne 0x4b12fa
mov eax, dword [0x63ff90]
mov edx, 0x4b1374
call fcn.0040570c
jne 0x4b0e93
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
or ecx, 0xffffffff
mov edx, 0x18
call fcn.00476718
jmp 0x4b0ebb
mov eax, dword [0x63ff90]
mov edx, 0x4b13c0
call fcn.0040570c
jne 0x4b0ebb
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x18
call fcn.00476718
call fcn.004033d8
lea eax, [ebp - 4]
mov edx, 0x4b13cc
call fcn.0040537c
mov eax, 0x18
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00439c10
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, 1
call fcn.00439c2c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040537c
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x34]
call fcn.00409f20
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004a3d54
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x20]
call fcn.004a3dcc
mov eax, dword [ebp - 0x20]
push eax
mov eax, 5
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x1c]
pop eax
call fcn.00439c10
mov edx, dword [ebp - 0x1c]
mov eax, 0x640030
call fcn.00405338
push dword [ebp - 4]
push 0x4b13f0
push dword [0x640030]
push 0x4b13fc
mov eax, 0x640030
mov edx, 4
call fcn.00405678
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x40]
call fcn.00409f20
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x30]
call fcn.004a3d54
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x3c]
call fcn.004a3dcc
mov eax, dword [ebp - 0x3c]
push eax
mov eax, 0x14
call fcn.00403400
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x38]
pop eax
call fcn.00439c10
mov edx, dword [ebp - 0x38]
mov eax, 0x640034
call fcn.00405338
mov eax, dword [0x63ff94]
mov edx, 0x4b1374
call fcn.0040570c
jne 0x4b0fd8
call fcn.004aca14
mov eax, dword [0x638f60]
mov edx, 0x4b13c0
call fcn.004055b0
mov eax, dword [0x638f60]
mov eax, dword [0x638fa0]
mov edx, 0x4b13c0
call fcn.004055b0
mov eax, dword [0x638fa0]
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x63fff8]
mov edx, 0x4b1374
call fcn.0040570c
jne 0x4b1091
lea eax, [ebp - 0x44]
call fcn.004b0c58
push dword [ebp - 0x44]
push 0x4b1408
lea edx, [ebp - 0x48]
mov eax, dword [0x63ff2c]
call fcn.004b01c8
push dword [ebp - 0x48]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
mov ebx, dword [0x640028]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x50]
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.00470624
mov eax, dword [ebp - 0x50]
mov edx, dword [0x640028]
call fcn.004b03b0
mov edx, 6
mov eax, dword [0x640028]
call fcn.0040a468
jmp 0x4b10d9
push dword [0x640030]
push dword [0x640034]
lea edx, [ebp - 0x54]
mov eax, dword [0x63ff2c]
call fcn.004b01c8
push dword [ebp - 0x54]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
lea edx, [ebp - 0x58]
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.00470624
mov eax, dword [ebp - 0x58]
mov edx, dword [0x640028]
call fcn.004b07b8
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
lea eax, [ebp - 0x5c]
mov edx, dword [0x640028]
call fcn.00405c3c
mov ecx, dword [ebp - 0x5c]
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
mov edx, 1
call fcn.00476ae8
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x16
call fcn.00476718
mov eax, dword [0x63911c]
mov eax, dword [eax]
call fcn.0046c258
cmp dword [0x63ff88], 0
je 0x4b118e
cmp dword [0x63ff8c], 0
je 0x4b118e
xor eax, eax
push ebp
push 0x4b1184
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff8c]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451b6c
mov eax, dword [0x63ff88]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451ba0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b118e
mov eax, dword [0x63ffd4]
mov edx, 0x4b13c0
call fcn.0040570c
jne 0x4b11ab
mov dl, 3
mov eax, dword [0x63ff20]
call fcn.00468950
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x639244]
cmp dword [eax], 0
je 0x4b1259
xor eax, eax
push ebp
push 0x4b124f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff20]
call fcn.00467634
mov ebx, eax
mov eax, dword [0x63ff70]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fc0]
mov eax, dword [eax]
call fcn.0046cc64
mov eax, dword [0x63ff20]
call fcn.00467654
mov ebx, eax
mov eax, dword [0x63ff74]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fc0]
mov eax, dword [eax]
call fcn.0046cca0
mov edx, dword [0x639244]
mov edx, dword [edx]
mov eax, dword [0x638fc0]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.004524b4
mov eax, dword [0x638fc0]
mov eax, dword [eax]
call fcn.0046c260
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1259
mov eax, dword [0x639030]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.0043d948
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.0043d948
cmp dword [0x63ffa8], 0
je 0x4b12bd
mov eax, dword [0x63ffa8]
mov edx, 0x4b1414
call fcn.0040570c
je 0x4b12bd
push 1
push 0
push 0
mov eax, dword [0x63ffa8]
call fcn.00405774
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x63ffe4]
mov edx, 0x4b1374
call fcn.0040570c
jne 0x4b12fa
xor eax, eax
push ebp
push 0x4b12f0
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00444658
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b12fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b134b
lea eax, [ebp - 0x5c]
call fcn.00405aec
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00405308
lea eax, [ebp - 0x48]
mov edx, 6
call fcn.00405308
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00405308
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405308
ret