Function at 0x4126f0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539658
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x58bc40]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.0041c0cf
mov byte [ebp - 4], 1
call fcn.00413912
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412745
push 0x80004005
call fcn.004026c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x412c1e
push ecx
lea edx, [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edx
call fcn.00401d30
lea eax, [ebp - 0x48]
push eax
call fcn.004055b0
push 0x568a68
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402330
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4127c2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
test eax, eax
je 0x4127ec
cmp dword [ecx - 0xc], 0
jl 0x4127ec
push eax
push ecx
call fcn.00514464
mov ecx, dword [ebp - 0x40]
add esp, 8
test eax, eax
je 0x4127ec
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4127f2
cmp dword [ebp - 0x34], 0
jne 0x41281d
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x412817
cmp dword [ecx - 0xc], 0
jl 0x412817
push eax
push ecx
call fcn.00514464
add esp, 8
test eax, eax
je 0x412817
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x41281d
cmp dword [ebp - 0x34], 0
je 0x412856
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004057f0
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x28]
push eax
push edx
lea ecx, [ebp - 0x30]
call fcn.0041c4ae
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4127b6
cmp dword [ebp - 0x28], 0
jg 0x412861
call fcn.0041467d
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp + 8]
push ecx
lea esi, [edi + 0x66c]
lea edx, [ebp - 0x18]
push esi
push edx
call fcn.00405e20
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128ab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401d30
lea edx, [ebp - 0x18]
lea ecx, [edi + 0x648]
push edx
mov byte [ebp - 4], 7
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push ecx
add edi, 0x640
push edi
call fcn.00401100
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x28]
cmp edi, 1
jg 0x41290e
call fcn.0041467d
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x412929
push 0x80004005
call fcn.004026c0
mov eax, dword [ebp - 0x14]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412956
test dx, dx
je 0x412952
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412956
add eax, 4
add ecx, 4
test dx, dx
jne 0x412930
xor eax, eax
jmp 0x41295b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x412bf3
test edi, edi
jg 0x412971
call fcn.0041467d
push ebx
lea edx, [ebp - 0x1c]
push str.Downloading
push edx
call fcn.00403f30
add esp, 0xc
push str._file
push eax
lea eax, [ebp - 0x18]
mov bl, 9
push eax
mov byte [ebp - 4], bl
call fcn.00404010
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
mov edi, dword [ebp + 8]
push eax
lea ecx, [edi + 0x5b0]
call fcn.00425354
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4129d1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4129f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..zip
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00404010
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x28], 0
jg 0x412a1d
call fcn.0041467d
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [edi + 0x674]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00405e20
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x18], esp
push str..zip
push eax
push ecx
call fcn.00404010
add esp, 0xc
push edi
mov byte [ebp - 4], 0xd
call fcn.00410f80
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x412a7b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412ccb
cmp dword [ebp - 0x28], 0
jg 0x412a8e
call fcn.0041467d
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405e20
add esp, 8
mov bl, 0xe
mov ecx, esp
mov byte [ebp - 4], bl
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00404010
add esp, 8
mov edx, esp
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], esp
push str..zip
lea eax, [ebp - 0x10]
push eax
push edx
call fcn.00404010
add esp, 0xc
push edi
mov byte [ebp - 4], bl
call fcn.00410c80
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412b01
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412bf3
cmp dword [ebp - 0x28], 0
push 0
jg 0x412b16
call fcn.0041467d
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405e20
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00404010
add esp, 8
mov byte [ebp - 4], 0x11
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.00404f10
mov byte [ebp - 4], 0x10
call fcn.00405340
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412b7c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412c89
push str.files.lst
lea ecx, [ebp + 8]
push esi
push ecx
call fcn.00404010
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.004026a0
cmp dword [ebp - 0x28], 0
jg 0x412bb2
call fcn.0041467d
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp + 8]
push esi
push eax
call fcn.00405e20
mov eax, dword [eax]
mov ecx, dword [edi + 0x20]
add esp, 0xc
push 5
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
call fcn.004026a0
mov edx, dword [edi + 0x20]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412c16
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405710
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412c41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0041c355
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412c73
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
call fcn.004026a0
lea ecx, [ebp - 0x48]
call fcn.00405710
lea ecx, [ebp - 0x10]
call fcn.004026a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0041c355
lea ecx, [ebp + 0xc]
call fcn.004026a0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412cee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405710
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412d19
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.0041c355
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412d4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8