Function at 0x413e08
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x298]
sub esp, 0x410
mov eax, dword [0x4806f0]
xor eax, ebp
mov dword [ebp + 0x294], eax
push ebx
push esi
xor ebx, ebx
push edi
mov edi, ecx
mov dword [ebp + 0x74], 1
cmp dword [ebp + 0x2a0], ebx
je 0x414019
lea ecx, [edi + 0x110]
call fcn.00401005
test al, al
jne 0x413fdf
lea esi, [edi + 0x160]
mov ecx, esi
call fcn.00401005
test al, al
jne 0x413fd6
push esi
lea ecx, [ebp + 0x80]
call fcn.0042f130
push 7
lea eax, [ebp + 0x78]
push eax
lea ecx, [ebp + 0x80]
call fcn.0042f880
cmp byte [eax + 7], 0xff
jne 0x413e8a
mov eax, dword [eax]
push str.file:__
push eax
call fcn.0044ebc0
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp + 0x78]
inc bl
call fcn.0042f1e0
test bl, bl
je 0x413ed0
push 7
lea eax, [ebp + 0x78]
push eax
lea ecx, [ebp + 0x80]
call fcn.0042fcb0
push eax
lea ecx, [ebp + 0x80]
call fcn.0042f220
lea ecx, [ebp + 0x78]
call fcn.0042f1e0
cmp byte [ebp + 0x87], 0xff
lea eax, [ebp + 0x80]
jne 0x413ee5
mov eax, dword [ebp + 0x80]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x413fc9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x87], 0xff
lea eax, [ebp + 0x80]
jne 0x413f1f
mov eax, dword [ebp + 0x80]
push 0x104
lea ecx, [ebp + 0x88]
push ecx
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp byte [ebp + 0x87], 0xff
lea eax, [ebp + 0x80]
jne 0x413f4b
mov eax, dword [ebp + 0x80]
push eax
lea ecx, [ebp + 0x7c]
call fcn.0040d1c3
mov esi, dword [ebp + 0x7c]
push esi
call fcn.00406d4b
pop ecx
test eax, eax
jne 0x413fbb
push str.actionlocal_download
lea ecx, [ebp + 0x78]
call fcn.0042f200
push ebx
lea eax, [ebp + 0x78]
push eax
mov ecx, edi
call fcn.004118f7
lea ecx, [ebp + 0x78]
call fcn.0042f1e0
cmp byte [ebp + 0x87], 0xff
lea ecx, [ebp + 0x80]
jne 0x413f98
mov ecx, dword [ebp + 0x80]
push 5
mov eax, 0x4727a6
push eax
push eax
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esi - 0x10]
call fcn.00406d31
jmp 0x41414e
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esi - 0x10]
call fcn.00406d31
lea ecx, [ebp + 0x80]
call fcn.0042f1e0
xor ebx, ebx
cmp dword [edi + 0x5c], ebx
jne 0x414159
push edi
lea ecx, [ebp - 0x178]
call fcn.0040aa10
push 4
push 0xad
lea ecx, [ebp - 0x178]
call fcn.0040a9c5
cmp eax, 3
je 0x414005
mov dword [ebp + 0x74], ebx
lea ecx, [ebp - 0x178]
call fcn.0040aaea
cmp dword [ebp + 0x74], ebx
je 0x414159
push str.actionbackup_download
lea ecx, [ebp + 0x78]
call fcn.0042f200
push ebx
lea eax, [ebp + 0x78]
push eax
mov ecx, edi
call fcn.004118f7
lea ecx, [ebp + 0x78]
call fcn.0042f1e0
lea ecx, [ebp + 0x80]
call fcn.0042ef80
lea esi, [edi + 0xb0]
mov ecx, esi
call fcn.00401005
test al, al
jne 0x4140b7
push str.http:__
mov ecx, esi
call fcn.0042f060
push esi
test eax, eax
jl 0x414074
lea ecx, [ebp + 0x80]
call fcn.0042f220
jmp 0x41409b
lea eax, [edi + 0xe8]
push eax
lea eax, [ebp + 0x78]
push eax
call fcn.0042f950
add esp, 0xc
push eax
lea ecx, [ebp + 0x80]
call fcn.0042f220
lea ecx, [ebp + 0x78]
call fcn.0042f1e0
lea eax, [ebp + 0x80]
push eax
mov ecx, edi
call fcn.00423d57
cmp eax, 0xc8
jb 0x4140b7
cmp eax, 0x190
jb 0x4140eb
lea eax, [edi + 0xa8]
push eax
lea eax, [ebp + 0x78]
push eax
mov ecx, edi
call fcn.0040de75
push eax
lea ecx, [ebp + 0x80]
call fcn.0042f220
lea ecx, [ebp + 0x78]
call fcn.0042f1e0
lea eax, [ebp + 0x80]
push eax
mov ecx, edi
call fcn.00423d57
push 0x38
lea eax, [ebp + 0x3c]
push ebx
push eax
call fcn.0044f280
add esp, 0xc
cmp byte [ebp + 0x87], 0xff
mov dword [ebp + 0x38], 0x3c
mov dword [ebp + 0x3c], 0x440
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x44], str.open
lea eax, [ebp + 0x80]
jne 0x414127
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0x48], eax
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x41414e
push dword [ebp + 0x70]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x80]
call fcn.0042f1e0
mov ecx, dword [ebp + 0x294]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0044f6e0
add ebp, 0x298
leave
ret 4