Function at 0x1004f65d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x874
mov eax, 0x10078140
call fcn.1005d50a
and word [ebp - 0x818], 0
push 0x800
lea eax, [ebp - 0x816]
push 0
push eax
mov edi, ecx
call fcn.10054f10
add esp, 0xc
lea esi, [edi + 0x1200]
push 0xffffffffffffffff
lea eax, [edi + 0x30]
push esi
xor ebx, ebx
mov dword [ebp - 0x848], esi
call fcn.1000388f
lea eax, [ebp - 0x850]
mov ecx, esi
call fcn.10006bc3
mov ebx, eax
lea eax, [ebp - 0x844]
mov ecx, esi
call fcn.1000a3dd
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10006bc3
push dword [ebx + 4]
mov ecx, dword [ebp - 0x838]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x83c]
push eax
call fcn.1005204d
add esp, 0x1c
cmp dword [esi + 0x18], 8
jb 0x1004f703
mov eax, dword [esi + 4]
jmp 0x1004f706
lea eax, [esi + 4]
call fcn.1004db77
test al, al
jne 0x1004f716
xor eax, eax
jmp 0x1004fa88
xor ebx, ebx
push 0x401
lea eax, [ebp - 0x818]
push ebx
push eax
mov dword [ebp - 0x838], ebx
call fcn.10054f10
add esp, 0xc
push ebx
push 0x2b
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1004fa5c
lea eax, [ebp - 0x818]
push eax
call fcn.10054c67
pop ecx
lea esi, [edi + 0x121c]
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x84c], esi
call fcn.100035ef
push str.TencentQQDownload
push esi
call fcn.10002dff
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10006bc3
mov ebx, eax
lea eax, [ebp - 0x868]
mov ecx, esi
call fcn.1000a3dd
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x858]
mov ecx, esi
call fcn.10006bc3
push dword [ebx + 4]
mov ecx, dword [ebp - 0x840]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x844]
push eax
call fcn.1005204d
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x81c], 7
mov dword [ebp - 0x820], eax
mov word [ebp - 0x830], ax
push 0x401
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push eax
call fcn.10054f10
add esp, 0xc
lea esi, [edi + 0x1c]
push esi
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x818]
movsd dword es:[edi], dword [esi]
call fcn.10052498
add esp, 0x10
test eax, eax
je 0x1004fa32
mov eax, ebx
push eax
call fcn.10054c67
pop ecx
mov ecx, ebx
lea esi, [ebp - 0x834]
call fcn.100035ef
mov ebx, 0x10086948
push ebx
call fcn.10054c67
mov edx, dword [ebp - 0x820]
test edx, edx
pop ecx
mov dword [ebp - 0x840], eax
jbe 0x1004f8b7
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1004f874
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x81c], 8
lea eax, [ecx + edx*2]
mov ecx, dword [ebp - 0x830]
jae 0x1004f8b3
lea ecx, [ebp - 0x830]
jmp 0x1004f8b3
mov edi, dword [ebp - 0x840]
test edi, edi
mov edx, ebx
jbe 0x1004f8a7
movzx esi, word [ecx]
cmp word [edx], si
je 0x1004f8a9
inc edx
inc edx
dec edi
jne 0x1004f89d
xor edx, edx
test edx, edx
je 0x1004f937
inc ecx
inc ecx
cmp ecx, eax
jb 0x1004f88e
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x834]
call fcn.100039ff
push ebx
call fcn.10054c67
pop ecx
mov ecx, dword [ebp - 0x820]
test ecx, ecx
jbe 0x1004f972
or edx, 0xffffffff
cmp ecx, edx
ja 0x1004f8e7
lea edx, [ecx - 1]
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1004f8fc
lea ecx, [ebp - 0x830]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x1004f914
movzx esi, word [ecx]
cmp word [edx], si
je 0x1004f916
inc edx
inc edx
dec edi
jne 0x1004f90a
xor edx, edx
test edx, edx
je 0x1004f955
cmp dword [ebp - 0x81c], 8
mov edx, dword [ebp - 0x830]
jae 0x1004f92f
lea edx, [ebp - 0x830]
cmp ecx, edx
je 0x1004f972
dec ecx
dec ecx
jmp 0x1004f8ff
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1004f94c
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
jmp 0x1004f8ba
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1004f96a
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x1004f975
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x834]
call fcn.100039ff
lea eax, [ebp - 0x870]
mov ecx, esi
call fcn.10006bc3
mov esi, eax
lea eax, [ebp - 0x880]
lea ecx, [ebp - 0x834]
call fcn.1000a3dd
mov edi, eax
lea eax, [ebp - 0x878]
lea ecx, [ebp - 0x834]
call fcn.10006bc3
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x858]
push eax
call fcn.1005204d
mov eax, dword [ebp - 0x830]
add esp, 0x1c
cmp dword [ebp - 0x81c], 8
jae 0x1004f9eb
lea eax, [ebp - 0x830]
call fcn.1004db77
test al, al
je 0x1004fa32
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0x18], 8
mov ecx, dword [eax + 0x14]
jb 0x1004fa08
mov eax, dword [eax + 4]
jmp 0x1004fa0b
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x834]
call fcn.1000a67b
cmp eax, 0xffffffff
jne 0x1004fa3c
mov ecx, dword [ebp - 0x848]
lea eax, [ebp - 0x834]
call fcn.1004da3b
test al, al
jne 0x1004fa3c
mov dword [ebp - 0x838], 1
push 0
push 1
lea esi, [ebp - 0x834]
call fcn.100031e5
cmp dword [ebp - 0x838], 0
je 0x1004fa85
mov esi, dword [ebp - 0x848]
xor ebx, ebx
cmp dword [esi + 0x18], 8
jb 0x1004fa67
mov esi, dword [esi + 4]
jmp 0x1004fa6a
add esi, 4
push ebx
push ebx
push str.__install
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
call fcn.1005d58d
ret