Function at 0x42baf0
Capabilities:
Check for peb beingdebugged flag
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4e6def
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x512054]
xor eax, esp
mov dword [esp + 0x4c0], eax
push ebx
push esi
push edi
mov eax, dword [0x512054]
xor eax, esp
push eax
lea eax, [esp + 0x4d8]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push str._FROM_PAGE__DownloadFiles
mov dword [esp + 0x54], edi
call fcn.0043e8f0
xor eax, eax
mov word [edi], ax
mov dword [edi + 2], eax
mov dword [edi + 6], eax
mov dword [edi + 0xa], eax
mov word [edi + 0xe], ax
mov ecx, dword [esi + 4]
add esp, 4
push ecx
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetParent]
lea edx, [esp + 0xac]
push edx
mov dword [esp + 0x30], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp + 0x10]
push eax
lea ecx, [esp + 0xb0]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
cmp eax, ebx
jge 0x42bb93
push eax
call fcn.004c94e0
lea esi, [esp + 0xac]
lea edi, [esp + 0x28]
mov dword [esp + 0x4e0], ebx
call fcn.00437c10
mov byte [esp + 0x4e0], 1
mov eax, dword [eax]
cmp eax, ebx
je 0x42bbbc
mov eax, dword [eax]
jmp 0x42bbbe
xor eax, eax
lea edx, [esp + 0x20]
push edx
mov ecx, eax
call fcn.00406bd0
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x42bc0e
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebx
jne 0x42bc0a
cmp esi, ebx
je 0x42bc0a
mov eax, dword [esi]
cmp eax, ebx
je 0x42bbf1
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x42bc01
push eax
call fcn.004ca7dd
add esp, 4
push esi
call fcn.004c9610
add esp, 4
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xac]
mov byte [esp + 0x4e0], 4
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push ecx
call ebx
mov edx, dword [0x5195ac]
mov eax, dword [edx + 0xc]
mov ecx, 0x5195ac
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x4e0], 5
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
push ecx
call edi
lea edx, [ebp + 0x30]
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jge 0x42bc6b
push eax
call fcn.004c94e0
lea esi, [esp + 0x3c]
mov byte [esp + 0x4e0], 6
call fcn.00433da0
mov ecx, esi
test al, al
push ecx
sete byte [esp + 0x1f]
mov byte [esp + 0x4e4], 5
call ebx
cmp byte [esp + 0x1b], 0
je 0x42bf4b
push 0x58
lea edx, [esp + 0x58]
push 0
push edx
call fcn.004cc620
add esp, 0xc
push 0x208
lea eax, [esp + 0x2c8]
push 0
push eax
call fcn.004cc620
add esp, 0xc
push 0x208
lea ecx, [esp + 0xc0]
push 0
push ecx
call fcn.004cc620
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
call edi
lea eax, [ebp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
test eax, eax
jge 0x42bcfa
push eax
call fcn.004c94e0
lea esi, [esp + 0x3c]
lea edi, [esp + 0x38]
mov byte [esp + 0x4e0], 7
call fcn.00437c10
mov byte [esp + 0x4e0], 8
mov eax, dword [eax]
test eax, eax
je 0x42bd21
mov ecx, dword [eax]
jmp 0x42bd23
xor ecx, ecx
lea edx, [esp + 0x14]
push edx
call fcn.00406bd0
lea edi, [esp + 0x38]
call fcn.00437b00
lea eax, [esp + 0x3c]
push eax
mov byte [esp + 0x4e4], 0xb
call ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x34]
push edx
mov ebx, 0x4f7b18
call fcn.0040ab10
add esp, 8
mov byte [esp + 0x4e0], 0xc
mov eax, dword [esp + 0x30]
mov ecx, dword [eax - 0xc]
inc ecx
xor esi, esi
cmp ecx, esi
je 0x42bd86
cmp ecx, 0x7fffffff
ja 0x42bd86
lea edx, [esp + 0xbc]
call fcn.004164d0
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x2c4]
lea ecx, [esp + 0xbc]
mov dword [esp + 0x70], edx
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], ecx
lea edx, [esp + 0x54]
xor eax, eax
xor ecx, ecx
push edx
mov dword [esp + 0x58], 0x58
mov dword [esp + 0x60], esi
mov dword [esp + 0x70], 1
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x78], 0x104
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], 0x4f7b20
mov dword [esp + 0x8c], 0x80000
mov word [esp + 0x90], ax
mov word [esp + 0x92], cx
mov dword [esp + 0x94], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
test eax, eax
je 0x42bf02
mov ecx, dword [esp + 0x70]
lea eax, [esp + 0x34]
push eax
call fcn.00406bd0
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x28]
push edx
mov ebx, 0x4f669c
mov byte [esp + 0x4e8], 0xd
call fcn.0040ab10
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x58]
push edx
mov ebx, eax
mov byte [esp + 0x4f0], 0xe
call fcn.0041a030
add esp, 0x10
lea edi, [esp + 0x1c]
mov byte [esp + 0x4e0], 0xf
call fcn.00405e00
mov byte [esp + 0x4e0], 0xe
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42beb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4e0], 0xd
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42beda
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4e0], 0xc
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bf02
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4e0], 0xb
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42bf2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x4e0], 5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x42c03e
push 0x208
lea ecx, [esp + 0xc0]
push 0
push ecx
call fcn.004cc620
add esp, 0xc
push 0
push 0x10
lea edx, [esp + 0xc4]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x42c04a
mov edi, dword [esp + 0x20]
lea esi, [esp + 0x14]
call fcn.0044a550
push 0x4f05c4
push 0x4f8910
mov eax, esi
push eax
mov byte [esp + 0x4ec], 0x10
call fcn.004060b0
push 0x4f05c4
push 0x4f6904
mov ecx, esi
push ecx
call fcn.004060b0
push 0x4f05c4
push 0x4f66b8
mov edx, esi
push edx
call fcn.004060b0
push 0x4f05c4
push 0x4f7b30
mov eax, esi
push eax
call fcn.004060b0
push 0x4f05c4
push 0x4f7b34
mov ecx, esi
push ecx
call fcn.004060b0
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0xc0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0xbc]
lea edi, [esp + 0x1c]
call fcn.00406b90
mov ecx, dword [esp + 0x1c]
push ecx
push 0x4f7b38
call fcn.0043e8f0
mov byte [esp + 0x4e8], 5
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
add esp, 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x42c04a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x2c]
push 0
push ecx
call fcn.00429b50
mov esi, eax
add esp, 8
lea eax, [esp + 0x20]
mov edi, esi
call fcn.00405e00
lea edi, [esi + 4]
lea eax, [esp + 0x1c]
call fcn.00405e00
lea edx, [esp + 0x24]
push edx
push 0
push esi
push 0x429dc0
push 0
push 0
mov dword [esp + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0x4e0], 4
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c0c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x4e0], 0xffffffff
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42c0eb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x4d8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4c0]
xor ecx, esp
call fcn.004c961b
mov esp, ebp
pop ebp
ret 0x38