Function at 0x4b0b2c
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete file
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xa
push 0
push 0
dec ecx
jne 0x4b0b34
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b109e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4af0c4
call sub.user32.dll_EnumWindows
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
mov eax, dword [0x63ff54]
mov edx, 0x4b10b4
call fcn.0040570c
jne 0x4b0bb8
push 0
lea eax, [ebp - 8]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4b0bac
mov eax, 0x4b10c0
call fcn.00443930
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046ffe8
jmp 0x4b1059
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
mov eax, dword [0x63ff24]
mov edx, 0x4b10f4
call fcn.0040570c
jne 0x4b1059
mov eax, dword [0x63ff90]
mov edx, 0x4b10b4
call fcn.0040570c
jne 0x4b0bf8
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
or ecx, 0xffffffff
mov edx, 0x18
call fcn.00476744
jmp 0x4b0c20
mov eax, dword [0x63ff90]
mov edx, 0x4b1100
call fcn.0040570c
jne 0x4b0c20
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x18
call fcn.00476744
call fcn.004033d8
lea eax, [ebp - 4]
mov edx, 0x4b110c
call fcn.0040537c
mov eax, 0x18
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00439c3c
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0xc]
mov edx, 1
call fcn.00439c58
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.0040537c
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x2c]
call fcn.00409f20
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004a3da4
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x18]
call fcn.004a3e1c
mov eax, dword [ebp - 0x18]
push eax
mov eax, 5
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x14]
pop eax
call fcn.00439c3c
mov edx, dword [ebp - 0x14]
mov eax, 0x640030
call fcn.00405338
push dword [ebp - 4]
push 0x4b1130
push dword [0x640030]
push 0x4b113c
mov eax, 0x640030
mov edx, 4
call fcn.00405678
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x38]
call fcn.00409f20
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x28]
call fcn.004a3da4
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x34]
call fcn.004a3e1c
mov eax, dword [ebp - 0x34]
push eax
mov eax, 0x14
call fcn.00403400
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x30]
pop eax
call fcn.00439c3c
mov edx, dword [ebp - 0x30]
mov eax, 0x640034
call fcn.00405338
mov eax, dword [0x63ff94]
mov edx, 0x4b10b4
call fcn.0040570c
jne 0x4b0d3d
call fcn.004ac93c
mov eax, dword [0x638f5c]
mov edx, 0x4b1100
call fcn.004055b0
mov eax, dword [0x638f5c]
mov eax, dword [0x638f9c]
mov edx, 0x4b1100
call fcn.004055b0
mov eax, dword [0x638f9c]
mov eax, dword [0x63fff8]
mov edx, 0x4b10b4
call fcn.0040570c
jne 0x4b0df0
lea eax, [ebp - 0x3c]
call fcn.004b0a34
push dword [ebp - 0x3c]
push 0x4b1148
lea edx, [ebp - 0x40]
mov eax, dword [0x63ff2c]
call fcn.004b005c
push dword [ebp - 0x40]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
mov ebx, dword [0x640028]
mov dword [ebp - 0x44], ebx
mov eax, dword [ebp - 0x44]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x48]
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.00470650
mov eax, dword [ebp - 0x48]
mov edx, dword [0x640028]
call fcn.004b0244
mov edx, 6
mov eax, dword [0x640028]
call fcn.0040a468
jmp 0x4b0e38
push dword [0x640030]
push dword [0x640034]
lea edx, [ebp - 0x4c]
mov eax, dword [0x63ff2c]
call fcn.004b005c
push dword [ebp - 0x4c]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
lea edx, [ebp - 0x50]
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.00470650
mov eax, dword [ebp - 0x50]
mov edx, dword [0x640028]
call fcn.004b064c
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
lea eax, [ebp - 0x54]
mov edx, dword [0x640028]
call fcn.00405c3c
mov ecx, dword [ebp - 0x54]
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
mov edx, 1
call fcn.00476b14
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x16
call fcn.00476744
mov eax, dword [0x639114]
mov eax, dword [eax]
call fcn.0046c284
cmp dword [0x63ff88], 0
je 0x4b0eed
cmp dword [0x63ff8c], 0
je 0x4b0eed
xor eax, eax
push ebp
push 0x4b0ee3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff8c]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451b98
mov eax, dword [0x63ff88]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451bcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0eed
mov eax, dword [0x63ffd4]
mov edx, 0x4b1100
call fcn.0040570c
jne 0x4b0f0a
mov dl, 3
mov eax, dword [0x63ff20]
call fcn.0046897c
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
mov eax, dword [0x639238]
cmp dword [eax], 0
je 0x4b0fb8
xor eax, eax
push ebp
push 0x4b0fae
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff20]
call fcn.00467660
mov ebx, eax
mov eax, dword [0x63ff70]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046cc90
mov eax, dword [0x63ff20]
call fcn.00467680
mov ebx, eax
mov eax, dword [0x63ff74]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046cccc
mov edx, dword [0x639238]
mov edx, dword [edx]
mov eax, dword [0x638fbc]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.004524e0
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046c28c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0fb8
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fd18
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.0043d974
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.0043d974
cmp dword [0x63ffa8], 0
je 0x4b101c
mov eax, dword [0x63ffa8]
mov edx, 0x4b1154
call fcn.0040570c
je 0x4b101c
push 1
push 0
push 0
mov eax, dword [0x63ffa8]
call fcn.00405774
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x63ffe4]
mov edx, 0x4b10b4
call fcn.0040570c
jne 0x4b1059
xor eax, eax
push ebp
push 0x4b104f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00444684
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b1059
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b10a5
lea eax, [ebp - 0x54]
call fcn.00405aec
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00405308
lea eax, [ebp - 0x40]
mov edx, 6
call fcn.00405308
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00405308
lea eax, [ebp - 4]
call fcn.004052e4
ret