Function at 0x1003a369
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x874
mov eax, 0x10075a4b
call fcn.100588d8
and word [ebp - 0x818], 0
push 0x800
lea eax, [ebp - 0x816]
push 0
push eax
mov edi, ecx
call fcn.10051de0
add esp, 0xc
lea esi, [edi + 0x1200]
push 0xffffffffffffffff
lea eax, [edi + 0x30]
push esi
xor ebx, ebx
mov dword [ebp - 0x848], esi
call fcn.10001d68
lea eax, [ebp - 0x850]
mov ecx, esi
call fcn.10001968
mov ebx, eax
lea eax, [ebp - 0x844]
mov ecx, esi
call fcn.10001988
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001968
push dword [ebx + 4]
mov ecx, dword [ebp - 0x838]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x83c]
call fcn.100239d0
add esp, 0x18
cmp dword [esi + 0x18], 8
jb 0x1003a40e
mov eax, dword [esi + 4]
jmp 0x1003a411
lea eax, [esi + 4]
call fcn.10038899
test al, al
jne 0x1003a421
xor eax, eax
jmp 0x1003a78e
xor ebx, ebx
push 0x401
lea eax, [ebp - 0x818]
push ebx
push eax
mov dword [ebp - 0x838], ebx
call fcn.10051de0
add esp, 0xc
push ebx
push 0x2b
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003a762
lea eax, [ebp - 0x818]
push eax
call fcn.1005184b
pop ecx
lea esi, [edi + 0x121c]
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x84c], esi
call fcn.100022cf
push str.TencentQQDownload
push esi
call fcn.100069d0
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001968
mov ebx, eax
lea eax, [ebp - 0x868]
mov ecx, esi
call fcn.10001988
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x858]
mov ecx, esi
call fcn.10001968
push dword [ebx + 4]
mov ecx, dword [ebp - 0x840]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x844]
call fcn.100239d0
xor eax, eax
mov dword [ebp - 0x81c], 7
mov dword [ebp - 0x820], eax
mov word [ebp - 0x830], ax
push 0x401
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push eax
call fcn.10051de0
add esp, 0x24
lea esi, [edi + 0x1c]
push esi
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x818]
movsd dword es:[edi], dword [esi]
call fcn.1003cb67
add esp, 0x10
test eax, eax
je 0x1003a738
mov eax, ebx
push eax
call fcn.1005184b
pop ecx
mov ecx, ebx
lea esi, [ebp - 0x834]
call fcn.100022cf
mov ebx, 0x1008279c
push ebx
call fcn.1005184b
mov edx, dword [ebp - 0x820]
test edx, edx
pop ecx
mov dword [ebp - 0x840], eax
jbe 0x1003a5be
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003a57b
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x81c], 8
lea eax, [ecx + edx*2]
mov ecx, dword [ebp - 0x830]
jae 0x1003a5ba
lea ecx, [ebp - 0x830]
jmp 0x1003a5ba
mov edi, dword [ebp - 0x840]
test edi, edi
mov edx, ebx
jbe 0x1003a5ae
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003a5b0
inc edx
inc edx
dec edi
jne 0x1003a5a4
xor edx, edx
test edx, edx
je 0x1003a63e
inc ecx
inc ecx
cmp ecx, eax
jb 0x1003a595
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x834]
call fcn.100018fa
push ebx
call fcn.1005184b
pop ecx
mov ecx, dword [ebp - 0x820]
test ecx, ecx
jbe 0x1003a679
or edx, 0xffffffff
cmp ecx, edx
ja 0x1003a5ee
lea edx, [ecx - 1]
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003a603
lea ecx, [ebp - 0x830]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x1003a61b
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003a61d
inc edx
inc edx
dec edi
jne 0x1003a611
xor edx, edx
test edx, edx
je 0x1003a65c
cmp dword [ebp - 0x81c], 8
mov edx, dword [ebp - 0x830]
jae 0x1003a636
lea edx, [ebp - 0x830]
cmp ecx, edx
je 0x1003a679
dec ecx
dec ecx
jmp 0x1003a606
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003a653
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
jmp 0x1003a5c1
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003a671
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x1003a67c
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x834]
call fcn.100018fa
lea eax, [ebp - 0x870]
mov ecx, esi
call fcn.10001968
mov esi, eax
lea eax, [ebp - 0x880]
lea ecx, [ebp - 0x834]
call fcn.10001988
mov edi, eax
lea eax, [ebp - 0x878]
lea ecx, [ebp - 0x834]
call fcn.10001968
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x858]
call fcn.100239d0
mov eax, dword [ebp - 0x830]
add esp, 0x18
cmp dword [ebp - 0x81c], 8
jae 0x1003a6f1
lea eax, [ebp - 0x830]
call fcn.10038899
test al, al
je 0x1003a738
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0x18], 8
mov ecx, dword [eax + 0x14]
jb 0x1003a70e
mov eax, dword [eax + 4]
jmp 0x1003a711
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x834]
call fcn.10001dee
cmp eax, 0xffffffff
jne 0x1003a742
mov ecx, dword [ebp - 0x848]
lea eax, [ebp - 0x834]
call fcn.1003854c
test al, al
jne 0x1003a742
mov dword [ebp - 0x838], 1
push 0
push 1
lea esi, [ebp - 0x834]
call fcn.10001f1e
cmp dword [ebp - 0x838], 0
je 0x1003a78b
mov esi, dword [ebp - 0x848]
xor ebx, ebx
cmp dword [esi + 0x18], 8
jb 0x1003a76d
mov esi, dword [esi + 4]
jmp 0x1003a770
add esi, 4
push ebx
push ebx
push str.__install
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
call fcn.1005895b
ret