Function at 0x4b0908
Capabilities:
Check internet connectivity via wininet
Create process on windows
Delete file
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x4b0910
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4b0efc
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x4aedfc
call sub.user32.dll_EnumWindows
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
push 0
push 0x4aedfc
call sub.user32.dll_EnumWindows
lea edx, [ebp - 0x10]
mov eax, dword [0x63ff2c]
call fcn.004afd80
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 0x4b0f14
call fcn.004055fc
mov eax, dword [ebp - 8]
call fcn.0040a420
test al, al
je 0x4b0984
mov eax, dword [ebp - 8]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.00405774
mov ebx, eax
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff54]
mov edx, 0x4b0f2c
call fcn.0040570c
jne 0x4b0a0b
push 0
lea eax, [ebp - 0xc]
push eax
call sub.wininet.dll_InternetGetConnectedState
test eax, eax
je 0x4b09ff
mov eax, 0x4b0f38
call fcn.00443904
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046ffbc
jmp 0x4b0eb2
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff24]
mov edx, 0x4b0f6c
call fcn.0040570c
jne 0x4b0eb2
mov eax, dword [0x63ff90]
mov edx, 0x4b0f2c
call fcn.0040570c
jne 0x4b0a4b
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
or ecx, 0xffffffff
mov edx, 0x18
call fcn.00476718
jmp 0x4b0a73
mov eax, dword [0x63ff90]
mov edx, 0x4b0f78
call fcn.0040570c
jne 0x4b0a73
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x18
call fcn.00476718
call fcn.004033d8
lea eax, [ebp - 4]
mov edx, 0x4b0f84
call fcn.0040537c
mov eax, 0x18
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00439c10
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov edx, 1
call fcn.00439c2c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.0040537c
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x34]
call fcn.00409f20
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.004a3d54
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x20]
call fcn.004a3dcc
mov eax, dword [ebp - 0x20]
push eax
mov eax, 5
call fcn.00403400
mov edx, eax
inc edx
lea ecx, [ebp - 0x1c]
pop eax
call fcn.00439c10
mov edx, dword [ebp - 0x1c]
mov eax, 0x640030
call fcn.00405338
push dword [ebp - 4]
push 0x4b0fa8
push dword [0x640030]
push 0x4b0fb4
mov eax, 0x640030
mov edx, 4
call fcn.00405678
mov eax, 0x270f
call fcn.00403400
lea edx, [ebp - 0x40]
call fcn.00409f20
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x30]
call fcn.004a3d54
lea eax, [ebp - 0x30]
lea edx, [ebp - 0x3c]
call fcn.004a3dcc
mov eax, dword [ebp - 0x3c]
push eax
mov eax, 0x14
call fcn.00403400
mov edx, eax
add edx, 0xa
lea ecx, [ebp - 0x38]
pop eax
call fcn.00439c10
mov edx, dword [ebp - 0x38]
mov eax, 0x640034
call fcn.00405338
mov eax, dword [0x63ff94]
mov edx, 0x4b0f2c
call fcn.0040570c
jne 0x4b0b90
call fcn.004ac8e8
mov eax, dword [0x638f5c]
mov edx, 0x4b0f78
call fcn.004055b0
mov eax, dword [0x638f5c]
mov eax, dword [0x638f9c]
mov edx, 0x4b0f78
call fcn.004055b0
mov eax, dword [0x638f9c]
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x63fff8]
mov edx, 0x4b0f2c
call fcn.0040570c
jne 0x4b0c49
lea eax, [ebp - 0x44]
call fcn.004b0810
push dword [ebp - 0x44]
push 0x4b0fc0
lea edx, [ebp - 0x48]
mov eax, dword [0x63ff2c]
call fcn.004afd80
push dword [ebp - 0x48]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
mov ebx, dword [0x640028]
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x4c]
call fcn.00405774
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
lea edx, [ebp - 0x50]
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.00470624
mov eax, dword [ebp - 0x50]
mov edx, dword [0x640028]
call fcn.004aff68
mov edx, 6
mov eax, dword [0x640028]
call fcn.0040a468
jmp 0x4b0c91
push dword [0x640030]
push dword [0x640034]
lea edx, [ebp - 0x54]
mov eax, dword [0x63ff2c]
call fcn.004afd80
push dword [ebp - 0x54]
mov eax, 0x640028
mov edx, 3
call fcn.00405678
lea edx, [ebp - 0x58]
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.00470624
mov eax, dword [ebp - 0x58]
mov edx, dword [0x640028]
call fcn.004b0370
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
lea eax, [ebp - 0x5c]
mov edx, dword [0x640028]
call fcn.00405c3c
mov ecx, dword [ebp - 0x5c]
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
mov edx, 1
call fcn.00476ae8
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x360]
xor ecx, ecx
mov edx, 0x16
call fcn.00476718
mov eax, dword [0x639114]
mov eax, dword [eax]
call fcn.0046c258
cmp dword [0x63ff88], 0
je 0x4b0d46
cmp dword [0x63ff8c], 0
je 0x4b0d46
xor eax, eax
push ebp
push 0x4b0d3c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff8c]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451b6c
mov eax, dword [0x63ff88]
call fcn.0040a05c
mov edx, eax
mov eax, dword [0x63ff20]
call fcn.00451ba0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0d46
mov eax, dword [0x63ffd4]
mov edx, 0x4b0f78
call fcn.0040570c
jne 0x4b0d63
mov dl, 3
mov eax, dword [0x63ff20]
call fcn.00468950
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x639238]
cmp dword [eax], 0
je 0x4b0e11
xor eax, eax
push ebp
push 0x4b0e07
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x63ff20]
call fcn.00467634
mov ebx, eax
mov eax, dword [0x63ff70]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046cc64
mov eax, dword [0x63ff20]
call fcn.00467654
mov ebx, eax
mov eax, dword [0x63ff74]
call fcn.0040a05c
add ebx, eax
mov edx, ebx
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046cca0
mov edx, dword [0x639238]
mov edx, dword [edx]
mov eax, dword [0x638fbc]
mov eax, dword [eax]
mov eax, dword [eax + 0x360]
call fcn.004524b4
mov eax, dword [0x638fbc]
mov eax, dword [eax]
call fcn.0046c260
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0e11
mov eax, dword [0x63902c]
mov eax, dword [eax]
call fcn.0046fcec
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x368]
mov dl, 1
call fcn.0043d948
mov eax, dword [0x63ff20]
mov eax, dword [eax + 0x364]
mov dl, 1
call fcn.0043d948
cmp dword [0x63ffa8], 0
je 0x4b0e75
mov eax, dword [0x63ffa8]
mov edx, 0x4b0fcc
call fcn.0040570c
je 0x4b0e75
push 1
push 0
push 0
mov eax, dword [0x63ffa8]
call fcn.00405774
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x63ffe4]
mov edx, 0x4b0f2c
call fcn.0040570c
jne 0x4b0eb2
xor eax, eax
push ebp
push 0x4b0ea8
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00444658
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0eb2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0f03
lea eax, [ebp - 0x5c]
call fcn.00405aec
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00405308
lea eax, [ebp - 0x48]
mov edx, 6
call fcn.00405308
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.00405308
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405308
ret