Function at 0x404980
Capabilities:
Create process on windows
Delete file
Download url
Execute command
Receive data
Terminate process

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409a2b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x40d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00404060
xor esi, esi
mov ecx, 1
mov edi, 0x40d838
xor eax, eax
lock cmpxchg dword [edi], ecx
test eax, eax
je 0x404a06
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x4049eb
push 0
jmp 0x4049ed
push 1
call edi
inc esi
mov ecx, 1
xor eax, eax
mov edx, 0x40d838
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x4049e2
mov edi, edx
cmp dword [0x40d83c], 0
jne 0x404a20
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x40d83c], eax
xor eax, eax
xchg dword [edi], eax
cmp dword [0x40d85c], 0xf
mov eax, 0x40d848
push dword [0x40d858]
cmova eax, dword [0x40d848]
push eax
call fcn.00408158
mov edx, eax
lea ecx, [ebp - 0xb4]
call fcn.004019a0
add esp, 8
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x88]
cmp dword [ebp - 0xa0], 7
lea eax, [ebp - 0xb4]
push 0xffffffffffffffff
cmova eax, dword [ebp - 0xb4]
push 3
push ecx
push eax
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xffff
call fcn.004082f0
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x90], eax
push ecx
push eax
lea ecx, [ebp - 0x98]
call fcn.00402d40
mov eax, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x90]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], 0x40d0b0
test eax, eax
je 0x404b0f
cmp eax, 1
sete byte [ebp - 0x99]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xa0]
cmp ecx, 7
jbe 0x404b2a
mov edx, dword [ebp - 0xb4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404b20
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404b20
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov byte [ebp - 0x99], 1
test ecx, ecx
jne 0x404e03
jmp 0x404ad0
push ecx
push edx
call fcn.00408911
add esp, 8
cmp byte [ebp - 0x99], 0
je 0x404bdc
cmp dword [0x40d85c], 0xf
mov eax, 0x40d848
push dword [0x40d858]
cmova eax, dword [0x40d848]
push eax
call fcn.00408158
mov edx, eax
lea ecx, [ebp - 0xb4]
call fcn.004019a0
add esp, 8
mov dword [ebp - 4], 1
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0x40d0b0
call fcn.004035b0
cmp dword [ebp - 0x1c], 0
jne 0x404e17
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xa0]
cmp ecx, 7
jbe 0x404bdc
mov edx, dword [ebp - 0xb4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404bd2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404bd2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.00408911
add esp, 8
cmp dword [0x40d888], 0
je 0x404d4a
cmp dword [0x40d8a8], 0
je 0x404d4a
call fcn.00404710
mov edi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test al, al
je 0x404cd4
cmp byte [0x40d834], 0
jne 0x404c33
push 0
push 0
push str.7z.exe
push str.https:__www.7_zip.org_a_7zr.exe
push 0
call edi
test eax, eax
jne 0x404df6
mov byte [0x40d834], 1
push 0
push 0
push str.Dynast.io.Updater.exe.7z
push str.https:__raw.githubusercontent.com_OldSpectorPvP_OldSpectorPvP_main_Dynast.io.Updater.exe.7z
push 0
call edi
push str.cmd__c_7z_x_Dynast.io.Updater.exe.7z__t7z__y__nul_2_1
mov esi, eax
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push str.Dynast.io.Updater.exe.7z
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jne 0x404cd4
lea eax, [ebp - 0x98]
mov dword [ebp - 0x68], 0x44
push eax
lea eax, [ebp - 0x68]
xorps xmm0, xmm0
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push str.Dynast.io.Updater.exe
push str.Dynast.io.Updater.exe
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
movlpd qword [ebp - 0x44], xmm0
movlpd qword [ebp - 0x3c], xmm0
movlpd qword [ebp - 0x34], xmm0
movlpd qword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x98], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x98]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x94]
call esi
cmp byte [0x40d834], 0
jne 0x404cfe
push 0
push 0
push str.7z.exe
push str.https:__www.7_zip.org_a_7zr.exe
push 0
call edi
test eax, eax
jne 0x404df6
mov byte [0x40d834], 1
cmp dword [0x40d878], 7
mov eax, 0x40d864
push 0
cmova eax, dword [0x40d864]
push 0
push eax
push str.https:__raw.githubusercontent.com_OldSpectorPvP_OldSpectorPvP_main_fix.dll
push 0
call edi
test eax, eax
jne 0x404df6
call fcn.00403c30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00408682
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
cmp byte [0x40d834], 0
mov esi, dword [sym.imp.urlmon.dll_URLDownloadToFileW]
jne 0x404d7a
push 0
push 0
push str.7z.exe
push str.https:__www.7_zip.org_a_7zr.exe
push 0
call esi
test eax, eax
jne 0x404df6
mov byte [0x40d834], 1
push 0
push 0
push str.game.7z.001
push str.https:__raw.githubusercontent.com_OldSpectorPvP_OldSpectorPvP_main_game.7z.001
push 0
call esi
test eax, eax
jne 0x404df6
push eax
push eax
push str.game.7z.002
push str.https:__raw.githubusercontent.com_OldSpectorPvP_OldSpectorPvP_main_game.7z.002
push eax
call esi
test eax, eax
jne 0x404df6
push eax
push eax
push str.game.7z.003
push str.https:__raw.githubusercontent.com_OldSpectorPvP_OldSpectorPvP_main_game.7z.003
push eax
call esi
test eax, eax
jne 0x404df6
push str.cmd__c_7z_x_game.7z.001__t7z.split__y__nul_2_1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 4
push str.game.7z.001
call esi
push str.game.7z.002
call esi
push str.game.7z.003
call esi
mov ecx, 0x40a960
call fcn.00404680
call fcn.004044d0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
call fcn.004044d0
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
lea eax, [ebp - 0xb4]
mov ecx, str.exists
push eax
lea edx, [ebp - 0x1c]
call fcn.00402cc0
lea eax, [ebp - 0xb4]
mov ecx, str.create_directories
push eax
lea edx, [ebp - 0x1c]
call fcn.00402cc0
int3