Function at 0x1003bab7
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x874
mov eax, 0x10077e8b
call fcn.1005acb8
and word [ebp - 0x818], 0
push 0x800
lea eax, [ebp - 0x816]
push 0
push eax
mov edi, ecx
call fcn.100541d0
add esp, 0xc
lea esi, [edi + 0x1200]
push 0xffffffffffffffff
lea eax, [edi + 0x30]
push esi
xor ebx, ebx
mov dword [ebp - 0x848], esi
call fcn.10001d41
lea eax, [ebp - 0x850]
mov ecx, esi
call fcn.10001964
mov ebx, eax
lea eax, [ebp - 0x844]
mov ecx, esi
call fcn.10001984
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001964
push dword [ebx + 4]
mov ecx, dword [ebp - 0x838]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x83c]
call fcn.1002415e
add esp, 0x18
cmp dword [esi + 0x18], 8
jb 0x1003bb5c
mov eax, dword [esi + 4]
jmp 0x1003bb5f
lea eax, [esi + 4]
call fcn.10039ff1
test al, al
jne 0x1003bb6f
xor eax, eax
jmp 0x1003bedc
xor ebx, ebx
push 0x401
lea eax, [ebp - 0x818]
push ebx
push eax
mov dword [ebp - 0x838], ebx
call fcn.100541d0
add esp, 0xc
push ebx
push 0x2b
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003beb0
lea eax, [ebp - 0x818]
push eax
call fcn.10053c3b
pop ecx
lea esi, [edi + 0x121c]
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x84c], esi
call fcn.1000238b
push str.TencentQQDownload
push esi
call fcn.10006ad3
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001964
mov ebx, eax
lea eax, [ebp - 0x868]
mov ecx, esi
call fcn.10001984
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x858]
mov ecx, esi
call fcn.10001964
push dword [ebx + 4]
mov ecx, dword [ebp - 0x840]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x844]
call fcn.1002415e
xor eax, eax
mov dword [ebp - 0x81c], 7
mov dword [ebp - 0x820], eax
mov word [ebp - 0x830], ax
push 0x401
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push eax
call fcn.100541d0
add esp, 0x24
lea esi, [edi + 0x1c]
push esi
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x818]
movsd dword es:[edi], dword [esi]
call fcn.1003e223
add esp, 0x10
test eax, eax
je 0x1003be86
mov eax, ebx
push eax
call fcn.10053c3b
pop ecx
mov ecx, ebx
lea esi, [ebp - 0x834]
call fcn.1000238b
mov ebx, 0x100847dc
push ebx
call fcn.10053c3b
mov edx, dword [ebp - 0x820]
test edx, edx
pop ecx
mov dword [ebp - 0x840], eax
jbe 0x1003bd0c
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003bcc9
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x81c], 8
lea eax, [ecx + edx*2]
mov ecx, dword [ebp - 0x830]
jae 0x1003bd08
lea ecx, [ebp - 0x830]
jmp 0x1003bd08
mov edi, dword [ebp - 0x840]
test edi, edi
mov edx, ebx
jbe 0x1003bcfc
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003bcfe
inc edx
inc edx
dec edi
jne 0x1003bcf2
xor edx, edx
test edx, edx
je 0x1003bd8c
inc ecx
inc ecx
cmp ecx, eax
jb 0x1003bce3
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x834]
call fcn.100018f6
push ebx
call fcn.10053c3b
pop ecx
mov ecx, dword [ebp - 0x820]
test ecx, ecx
jbe 0x1003bdc7
or edx, 0xffffffff
cmp ecx, edx
ja 0x1003bd3c
lea edx, [ecx - 1]
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003bd51
lea ecx, [ebp - 0x830]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x1003bd69
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003bd6b
inc edx
inc edx
dec edi
jne 0x1003bd5f
xor edx, edx
test edx, edx
je 0x1003bdaa
cmp dword [ebp - 0x81c], 8
mov edx, dword [ebp - 0x830]
jae 0x1003bd84
lea edx, [ebp - 0x830]
cmp ecx, edx
je 0x1003bdc7
dec ecx
dec ecx
jmp 0x1003bd54
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003bda1
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
jmp 0x1003bd0f
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003bdbf
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x1003bdca
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x834]
call fcn.100018f6
lea eax, [ebp - 0x870]
mov ecx, esi
call fcn.10001964
mov esi, eax
lea eax, [ebp - 0x880]
lea ecx, [ebp - 0x834]
call fcn.10001984
mov edi, eax
lea eax, [ebp - 0x878]
lea ecx, [ebp - 0x834]
call fcn.10001964
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x858]
call fcn.1002415e
mov eax, dword [ebp - 0x830]
add esp, 0x18
cmp dword [ebp - 0x81c], 8
jae 0x1003be3f
lea eax, [ebp - 0x830]
call fcn.10039ff1
test al, al
je 0x1003be86
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0x18], 8
mov ecx, dword [eax + 0x14]
jb 0x1003be5c
mov eax, dword [eax + 4]
jmp 0x1003be5f
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x834]
call fcn.10001dc7
cmp eax, 0xffffffff
jne 0x1003be90
mov ecx, dword [ebp - 0x848]
lea eax, [ebp - 0x834]
call fcn.1002bada
test al, al
jne 0x1003be90
mov dword [ebp - 0x838], 1
push 0
push 1
lea esi, [ebp - 0x834]
call fcn.10001ef7
cmp dword [ebp - 0x838], 0
je 0x1003bed9
mov esi, dword [ebp - 0x848]
xor ebx, ebx
cmp dword [esi + 0x18], 8
jb 0x1003bebb
mov esi, dword [esi + 4]
jmp 0x1003bebe
add esi, 4
push ebx
push ebx
push str.__install
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
call fcn.1005ad3b
ret