Function at 0x439bd1
Capabilities:
Check for time delay via gettickcount
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
push ebx
push esi
push edi
push ebp
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x439f7c
push 0x12348765
push 0x56d2ad
push dword fs:[0]
mov dword fs:[0], esp
mov dword [ebp - reloc.gdi32.dll_AbortDoc], 0
cmp byte [0x5cb583], 0
je 0x439f84
cmp byte [0x5cb5cc], 0
jne 0x439f84
mov dword [0x5cc7c0], 0
push 0xa
push 0x57fa50
push 1
call fcn.0040b8e9
mov byte [0x57fac0], al
push 0xa
push 0x57fa66
push 0
call fcn.0040b937
mov dword [ebp - 0xc], eax
push 0xe
push 0x57fa7c
push 3
call fcn.0040b937
mov dword [ebp - 0x1c], eax
cmp eax, 0
jae 0x439c71
mov dword [ebp - 0x1c], 0
cmp byte [ebp + 8], 0
jne 0x439c97
cmp byte [0x57fac0], 0
je 0x439f84
call fcn.00438690
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x1c]
cmp eax, edx
jb 0x439f84
call fcn.00438690
mov dword [ebp - 0xc], eax
push 0xa
push 0x57fa66
push eax
call fcn.0040b966
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00439b65
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00411c6c
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.00439b65
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x104
sub eax, 0x20a
push eax
push 0x12
push 0x57fa9a
call fcn.00415c21
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_DeleteFileW
push 0x12
push 0x57fa9a
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056ea61
push 0xf
push 0x57fb4e
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0056ea61
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call sub.kernel32.dll_DeleteFileW
push 4
push 0x57fb6e
call fcn.00412d23
call sub.kernel32.dll_GetTickCount
mov dword [0x5cc7c4], eax
push 0x439943
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x57fb78
call sub.mclib32.dll__URLDownloadFile_12
mov dword [ebp - 0x18], eax
push 4
push 0x57fbd8
call fcn.00412d23
cmp dword [ebp - 0x18], 0
jne 0x439de2
push 0x104
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0
push 0
call fcn.00410cad
mov dword [ebp - 0x10], eax
cmp eax, 0
je 0x439f84
push eax
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
call fcn.0041111f
lea eax, [ebp - 0x10]
push eax
call fcn.00410d4e
push 0x107
lea eax, reloc.gdi32.dll_AbortDoc
push eax
lea eax, [ebp - 1]
push eax
call fcn.00416f09
cmp byte [ebp - 1], 0
jne 0x439df6
cmp byte [ebp + 8], 0
je 0x439f84
push dword [ebp + 0xc]
push 1
jmp 0x439f34
cmp eax, dword [0x5cb08c]
jg 0x439e12
cmp byte [ebp + 8], 0
je 0x439f84
push dword [ebp + 0xc]
push 2
jmp 0x439f34
push 4
push 0x57fbe2
call fcn.00412d23
push 0
call fcn.00427f96
push 4
push 0x57fbec
call fcn.00412d23
mov dword [0x5cbf60], 0x25e
push 0
push 0x43978f
push 0xc55
push 1
push 0
call fcn.00448109
mov dword [ebp - 8], eax
push 0xa
push 0x57fa50
push dword [0x57fac0]
call fcn.0040b918
push 4
push 0x57fbf6
call fcn.00412d23
cmp byte [0x57fac0], 0
jne 0x439e88
push 0xa
push 0x57fa66
push 0
call fcn.0040b966
cmp dword [ebp - 8], 0
je 0x439f84
push 5
push 0x57fc00
call fcn.00412d23
mov byte [0x5cc7c8], 0
mov dword [ebp - 0x20], 0xc56
mov eax, dword [0x578140]
push 0
push 0x439a09
push 0
push dword [ebp - 0x20]
push eax
call sub.user32.dll_CreateDialogParamW
mov dword [0x5cc7c0], eax
push 5
push 0x57fc0c
call fcn.00412d23
call sub.kernel32.dll_GetTickCount
mov dword [0x5cc7c4], eax
push 0x439943
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x57fc18
call sub.mclib32.dll__URLDownloadFile_12
mov dword [ebp - 0x18], eax
push 5
push 0x57fc7e
call fcn.00412d23
push dword [0x5cc7c0]
call sub.user32.dll_DestroyWindow
push 5
push 0x57fc8a
call fcn.00412d23
cmp byte [0x5cc7c8], 0
jne 0x439f84
cmp dword [ebp - 0x18], 0
je 0x439f3b
cmp byte [ebp + 8], 0
je 0x439f84
push dword [ebp + 0xc]
push 3
call fcn.00439b1d
jmp 0x439f84
push 1
push 0
push 0x57fc96
lea eax, reloc.gdi32.dll_AbortDoc
push eax
push 0x57fc98
push 0
call sub.shell32.dll_ShellExecuteW
push 5
push 0x57fca2
call fcn.00412d23
mov al, 1
pop dword fs:[0]
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret 8
mov al, 0
jmp 0x439f65