Function at 0x42370f
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x87c
mov eax, 0x4466cb
call fcn.0042e044
xor ebx, ebx
push 0x800
lea eax, [ebp - 0x81a]
push ebx
push eax
mov esi, ecx
mov word [ebp - 0x81c], bx
call fcn.0042b000
add esp, 0xc
lea edi, [esi + 0x1200]
push 0xffffffffffffffff
push ebx
lea eax, [esi + 0x30]
mov ecx, edi
mov dword [ebp - 0x848], edi
call fcn.004020c0
lea ebx, [ebp - 0x858]
call fcn.00403a20
lea ebx, [ebp - 0x844]
mov dword [ebp - 0x83c], eax
call fcn.00403a70
lea ebx, [ebp - 0x868]
mov dword [ebp - 0x84c], eax
call fcn.00403a20
mov ecx, dword [ebp - 0x83c]
push dword [ecx + 4]
push dword [ecx]
mov ecx, dword [ebp - 0x84c]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x850]
push eax
call fcn.00426733
add esp, 0x1c
cmp dword [edi + 0x18], 8
jb 0x4237b9
mov eax, dword [edi + 4]
jmp 0x4237bc
lea eax, [edi + 4]
call fcn.00421c96
xor ebx, ebx
cmp al, bl
jne 0x4237ce
xor eax, eax
jmp 0x423afd
push 0x401
lea eax, [ebp - 0x81c]
push ebx
push eax
mov dword [ebp - 0x83c], ebx
call fcn.0042b000
add esp, 0xc
push ebx
push 0x2b
lea eax, [ebp - 0x81c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423ad1
lea edi, [esi + 0x121c]
push edi
lea edx, [ebp - 0x81c]
mov dword [ebp - 0x854], edi
call fcn.00401eb0
push str.TencentQQDownload
push edi
call fcn.00414213
lea ebx, [ebp - 0x868]
call fcn.00403a20
lea ebx, [ebp - 0x870]
mov dword [ebp - 0x84c], eax
call fcn.00403a70
lea ebx, [ebp - 0x860]
mov dword [ebp - 0x840], eax
call fcn.00403a20
mov ecx, dword [ebp - 0x84c]
push dword [ecx + 4]
push dword [ecx]
mov ecx, dword [ebp - 0x840]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x844]
push eax
call fcn.00426733
add esp, 0x1c
xor ecx, ecx
lea eax, [ebp - 0x838]
mov dword [ebp - 0x820], 7
call fcn.00402030
and dword [ebp - 4], 0
push 0x401
lea eax, [ebp - 0x81c]
push 0
push eax
call fcn.0042b000
add esp, 0xc
add esi, 0x1c
push esi
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x81c]
movsd dword es:[edi], dword [esi]
call fcn.004268ce
add esp, 0x10
test eax, eax
je 0x423aab
lea eax, [ebp - 0x838]
push eax
mov edx, ebx
call fcn.00401eb0
mov ecx, dword [ebp - 0x824]
test ecx, ecx
mov edi, 0x44cc64
jbe 0x423945
cmp dword [ebp - 0x820], 8
mov eax, dword [ebp - 0x834]
jae 0x42390d
lea eax, [ebp - 0x834]
cmp dword [ebp - 0x820], 8
lea ebx, [eax + ecx*2]
mov eax, dword [ebp - 0x834]
jae 0x423941
lea eax, [ebp - 0x834]
jmp 0x423941
movzx ecx, word [eax]
xor esi, esi
inc esi
mov edx, edi
cmp word [edx], cx
je 0x42393b
inc edx
inc edx
dec esi
jne 0x42392f
xor edx, edx
test edx, edx
je 0x4239ba
inc eax
inc eax
cmp eax, ebx
jb 0x423927
or eax, 0xffffffff
xor ebx, ebx
lea esi, [ebp - 0x838]
call fcn.00402200
mov eax, dword [ebp - 0x824]
test eax, eax
jbe 0x4239ed
or ecx, 0xffffffff
cmp eax, ecx
ja 0x42396d
lea ecx, [eax - 1]
cmp dword [ebp - 0x820], 8
mov eax, dword [ebp - 0x834]
jae 0x423982
lea eax, [ebp - 0x834]
lea eax, [eax + ecx*2]
movzx ecx, word [eax]
xor esi, esi
inc esi
mov edx, edi
cmp word [edx], cx
je 0x423999
inc edx
inc edx
dec esi
jne 0x42398d
xor edx, edx
test edx, edx
mov ecx, dword [ebp - 0x834]
je 0x4239d8
cmp dword [ebp - 0x820], 8
jae 0x4239b2
lea ecx, [ebp - 0x834]
cmp eax, ecx
je 0x4239ed
dec eax
dec eax
jmp 0x423985
cmp dword [ebp - 0x820], 8
mov ecx, dword [ebp - 0x834]
jae 0x4239cf
lea ecx, [ebp - 0x834]
sub eax, ecx
sar eax, 1
jmp 0x423948
cmp dword [ebp - 0x820], 8
jae 0x4239e7
lea ecx, [ebp - 0x834]
sub eax, ecx
sar eax, 1
jmp 0x4239f0
or eax, 0xffffffff
lea ebx, [eax + 1]
or eax, 0xffffffff
lea esi, [ebp - 0x838]
call fcn.00402200
lea ebx, [ebp - 0x878]
mov edi, esi
call fcn.00403a20
lea ebx, [ebp - 0x888]
mov esi, eax
call fcn.00403a70
lea ebx, [ebp - 0x880]
mov dword [ebp - 0x840], eax
call fcn.00403a20
push dword [esi + 4]
mov ecx, dword [ebp - 0x840]
push dword [esi]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x860]
push eax
call fcn.00426733
mov eax, dword [ebp - 0x834]
add esp, 0x1c
cmp dword [ebp - 0x820], 8
jae 0x423a65
lea eax, [ebp - 0x834]
call fcn.00421c96
test al, al
je 0x423aab
mov eax, dword [ebp - 0x854]
cmp dword [eax + 0x18], 8
mov ebx, dword [eax + 0x14]
jb 0x423a82
mov eax, dword [eax + 4]
jmp 0x423a85
add eax, 4
push eax
lea eax, [ebp - 0x838]
call fcn.00403fe0
cmp eax, 0xffffffff
jne 0x423ab5
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x838]
call fcn.00404ec0
test eax, eax
je 0x423ab5
mov dword [ebp - 0x83c], 1
lea esi, [ebp - 0x838]
call fcn.00401e80
cmp dword [ebp - 0x83c], 0
je 0x423afa
mov edi, dword [ebp - 0x848]
xor ebx, ebx
cmp dword [edi + 0x18], 8
jb 0x423adc
mov edi, dword [edi + 4]
jmp 0x423adf
add edi, 4
push ebx
push ebx
push str.__install
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
call fcn.0042e08e
ret