Function at 0x407e33
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
lea ecx, [ebp - 8]
call fcn.00401041
push str._table_aligncenter__tr__td__n
lea ecx, [ebp - 8]
call fcn.00401168
push str._br_
lea ecx, [ebp - 8]
call fcn.004011a4
push str._form_idxxx_action
lea ecx, [ebp - 8]
call fcn.004011a4
push 0x41e164
lea ecx, [ebp - 0x20]
call fcn.0040108c
lea eax, [ebp - 0x1c]
push eax
call fcn.0040791a
pop ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.00401100
lea ecx, [ebp - 0x1c]
call fcn.00401a9f
push 0x41aa0c
lea ecx, [ebp - 0x20]
call fcn.004011a4
push str.seite
lea ecx, [ebp - 0x20]
call fcn.004011a4
push str.Freeware
lea ecx, [ebp - 0x20]
call fcn.004011a4
mov esi, 0x41a9f4
lea ecx, [ebp - 0x20]
push esi
call fcn.004011a4
push dword [0x41ace4]
lea ecx, [ebp - 0x20]
call fcn.004011a4
push esi
lea ecx, [ebp - 0x20]
call fcn.004011a4
push str.Autoupdate
lea ecx, [ebp - 0x20]
call fcn.004011a4
lea eax, [ebp - 0x20]
lea ecx, [ebp - 8]
push eax
call fcn.00401186
push str._methodpost__br__n
lea ecx, [ebp - 8]
call fcn.004011a4
mov esi, 0x41a7d8
lea ecx, [ebp - 0x30]
push esi
call fcn.0040108c
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040108c
push 0
call fcn.0040d394
imul eax, eax, 0x1af
pop ecx
mov dword [0x41e89c], eax
lea ecx, [ebp - 0x24]
call fcn.00401041
push 0x41a078
lea ecx, [ebp - 0x1c]
call fcn.0040108c
push dword [0x41e89c]
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0040164f
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00401a9f
lea eax, [ebp - 0x28]
push eax
call fcn.00407bad
pop ecx
lea ecx, [ebp - 0x38]
call fcn.00401041
mov ebx, 0x41a9d0
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0040a125
pop ecx
mov edi, str._value_
push eax
push edi
push str.Version
lea ecx, [ebp - 0x10]
call fcn.0040108c
push eax
mov esi, str._input_typehidden_name
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 0x1c]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 4]
call fcn.00401a9f
lea eax, [ebp - 0x2c]
push ebx
push eax
push edi
push str.Unicode
lea ecx, [ebp - 0x14]
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
push ebx
push 0x41e8a0
push edi
push str.Portable
lea ecx, [ebp - 0x14]
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
lea eax, [ebp - 0x30]
push ebx
push eax
push edi
push 0x41a988
lea ecx, [ebp - 0x14]
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
push ebx
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x14]
push eax
push edi
push str.time
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
push str._value_YES___n
push str.Passiv_Autoupdate
lea ecx, [ebp - 0xc]
call fcn.0040108c
push eax
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea eax, [ebp - 0x1c]
push ebx
push eax
call fcn.0040bb12
pop ecx
push eax
push edi
push str.LangName
lea ecx, [ebp - 0x14]
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
lea ecx, [ebp - 0x1c]
call fcn.00401a9f
lea eax, [ebp - 0x3c]
push eax
push ecx
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.0040104d
call fcn.0040768f
pop ecx
test eax, eax
pop ecx
je 0x408336
lea ecx, [ebp - 0x1c]
call fcn.00401041
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x3c]
call fcn.004084cd
lea eax, [ebp - 0x1c]
mov ecx, 0x41e88c
push eax
call fcn.00401100
lea eax, [ebp - 0x1c]
push ebx
push eax
push edi
push str.Ihre_SHA
lea ecx, [ebp - 0x14]
call fcn.0040108c
push eax
lea eax, [ebp - 0x18]
push esi
push eax
call fcn.00405de4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00405d9c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00405d53
push eax
lea eax, [ebp - 4]
push eax
call fcn.00405d9c
push eax
lea ecx, [ebp - 8]
call fcn.00401186
lea ecx, [ebp - 4]
call fcn.00401a9f
lea ecx, [ebp - 0x10]
call fcn.00401a9f
lea ecx, [ebp - 0xc]
call fcn.00401a9f
lea ecx, [ebp - 0x18]
call fcn.00401a9f
lea ecx, [ebp - 0x14]
call fcn.00401a9f
lea ecx, [ebp - 0x1c]
call fcn.00401a9f
push str._input_typesubmit_namexxxx_value_9658_9658__Start_Autoupdate_9668_9668___stylefont_size:20px__font_weight:bold___br__n
lea ecx, [ebp - 8]
call fcn.004011a4
push str.__form___td___tr___table__n
lea ecx, [ebp - 8]
call fcn.004011a4
push str._script__n
lea ecx, [ebp - 8]
call fcn.004011a4
push str.el_fdocument.getElementById__xxx____el_f.submit____n
lea ecx, [ebp - 8]
call fcn.004011a4
push str.__script__n
lea ecx, [ebp - 8]
call fcn.004011a4
mov ax, word [0x41e7e0]
push 0x40
mov word [ebp - 0x144], ax
pop ecx
xor eax, eax
lea edi, [ebp - 0x142]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x144]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x41ace4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x144]
push eax
call esi
push 0x41a580
lea ecx, [ebp - 4]
call fcn.0040108c
push dword [eax]
lea eax, [ebp - 0x144]
push eax
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
push str.Autoupdate
lea ecx, [ebp - 4]
call fcn.0040108c
push dword [eax]
lea eax, [ebp - 0x144]
push eax
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
push str._.html
lea ecx, [ebp - 4]
call fcn.0040108c
push dword [eax]
lea eax, [ebp - 0x144]
push eax
call esi
lea ecx, [ebp - 4]
call fcn.00401a9f
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 0x144]
mov ecx, esp
push eax
call fcn.0040108c
call fcn.004079fd
pop ecx
pop ecx
call fcn.00407a69
xor esi, esi
push 5
push esi
lea eax, [ebp - 0x144]
push esi
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, dword [sym.imp.USER32.dll_KillTimer]
mov dword [0x41e8a4], esi
mov esi, 0x28038
push esi
push dword [ebp + 8]
call edi
push esi
push dword [ebp + 8]
call edi
push 0x407d54
push 0x3e8
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [ebp - 0x38]
call fcn.00401a9f
lea ecx, [ebp - 0x28]
call fcn.00401a9f
lea ecx, [ebp - 0x24]
call fcn.00401a9f
lea ecx, [ebp - 0x2c]
call fcn.00401a9f
lea ecx, [ebp - 0x30]
call fcn.00401a9f
lea ecx, [ebp - 0x20]
call fcn.00401a9f
lea ecx, [ebp - 8]
call fcn.00401a9f
pop edi
pop esi
pop ebx
leave
ret