Function at 0x412210
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5391a8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x58bcc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00414a40
mov byte [ebp - 4], 1
call fcn.00413432
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412265
push 0x80004005
call fcn.004026c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x41273e
push ecx
lea edx, [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edx
call fcn.00401d30
lea eax, [ebp - 0x48]
push eax
call fcn.00404f10
push 0x566cdc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402330
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4122e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
test eax, eax
je 0x41230c
cmp dword [ecx - 0xc], 0
jl 0x41230c
push eax
push ecx
call fcn.00513fa6
mov ecx, dword [ebp - 0x40]
add esp, 8
test eax, eax
je 0x41230c
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x412312
cmp dword [ebp - 0x34], 0
jne 0x41233d
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x412337
cmp dword [ecx - 0xc], 0
jl 0x412337
push eax
push ecx
call fcn.00513fa6
add esp, 8
test eax, eax
je 0x412337
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41233d
cmp dword [ebp - 0x34], 0
je 0x412376
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00405150
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x28]
push eax
push edx
lea ecx, [ebp - 0x30]
call fcn.00414e1f
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4122d6
cmp dword [ebp - 0x28], 0
jg 0x412381
call fcn.00414196
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp + 8]
push ecx
lea esi, [edi + 0x83c]
lea edx, [ebp - 0x18]
push esi
push edx
call fcn.00405780
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4123cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401d30
lea edx, [ebp - 0x18]
lea ecx, [edi + 0x818]
push edx
mov byte [ebp - 4], 7
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41240d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push ecx
add edi, 0x810
push edi
call fcn.00401100
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x28]
cmp edi, 1
jg 0x41242e
call fcn.00414196
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x412449
push 0x80004005
call fcn.004026c0
mov eax, dword [ebp - 0x14]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412476
test dx, dx
je 0x412472
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412476
add eax, 4
add ecx, 4
test dx, dx
jne 0x412450
xor eax, eax
jmp 0x41247b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x412713
test edi, edi
jg 0x412491
call fcn.00414196
push ebx
lea edx, [ebp - 0x1c]
push str.Downloading
push edx
call fcn.004037a0
add esp, 0xc
push str._file
push eax
lea eax, [ebp - 0x18]
mov bl, 9
push eax
mov byte [ebp - 4], bl
call fcn.00403900
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
mov edi, dword [ebp + 8]
push eax
lea ecx, [edi + 0x780]
call fcn.0041dd50
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4124f1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412514
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..zip
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00403900
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x28], 0
jg 0x41253d
call fcn.00414196
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [edi + 0x844]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00405780
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x18], esp
push str..zip
push eax
push ecx
call fcn.00403900
add esp, 0xc
push edi
mov byte [ebp - 4], 0xd
call fcn.00410b60
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41259b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4127eb
cmp dword [ebp - 0x28], 0
jg 0x4125ae
call fcn.00414196
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405780
add esp, 8
mov bl, 0xe
mov ecx, esp
mov byte [ebp - 4], bl
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00403900
add esp, 8
mov edx, esp
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], esp
push str..zip
lea eax, [ebp - 0x10]
push eax
push edx
call fcn.00403900
add esp, 0xc
push edi
mov byte [ebp - 4], bl
call fcn.00410860
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412621
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412713
cmp dword [ebp - 0x28], 0
push 0
jg 0x412636
call fcn.00414196
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405780
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00403900
add esp, 8
mov byte [ebp - 4], 0x11
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.00404870
mov byte [ebp - 4], 0x10
call fcn.00404ca0
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41269c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4127a9
push str.files.lst
lea ecx, [ebp + 8]
push esi
push ecx
call fcn.00403900
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.004026a0
cmp dword [ebp - 0x28], 0
jg 0x4126d2
call fcn.00414196
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp + 8]
push esi
push eax
call fcn.00405780
mov eax, dword [eax]
mov ecx, dword [edi + 0x20]
add esp, 0xc
push 5
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
call fcn.004026a0
mov edx, dword [edi + 0x20]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412736
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405070
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412761
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414cc6
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412793
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
call fcn.004026a0
lea ecx, [ebp - 0x48]
call fcn.00405070
lea ecx, [ebp - 0x10]
call fcn.004026a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414cc6
lea ecx, [ebp + 0xc]
call fcn.004026a0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41280e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405070
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412839
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414cc6
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41286b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8