Function at 0x423190
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x433d89
mov eax, dword fs:[0]
push eax
sub esp, 0x1b8
mov eax, dword [0x6015cc]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x174], ecx
mov ecx, dword [ebp - 0x174]
add ecx, 0xd4
call dword [sym.imp.MSVCP90.dll_public:_bool___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::empty_void_const]
movzx eax, al
test eax, eax
jne 0x42377b
mov ecx, dword [ebp - 0x174]
cmp dword [ecx + 0xa4], 0
je 0x42377b
push 7
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QStandardPaths::writableLocation_enum_QStandardPaths::StandardLocation_]
add esp, 8
mov dword [ebp - 4], 0
push str.selDel.bat
lea ecx, [ebp - 0x124]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov byte [ebp - 4], 1
push 0x20
lea ecx, [ebp - 0x11d]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
movzx eax, byte [eax]
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x128]
push edx
push 0x20
lea ecx, [ebp - 0x111]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x110], esp
movzx eax, byte [eax]
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x118]
push edx
push str._1_2
lea ecx, [ebp - 0x10c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x17c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x17c]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
mov dword [ebp - 0x184], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x184]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov dword [ebp - 0x188], eax
mov edx, dword [ebp - 0x188]
push edx
lea ecx, [ebp - 0x10]
call dword [0x60341c]
lea ecx, [ebp - 0x128]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x124]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x54]
push ecx
call fcn.00422fb0
add esp, 8
mov byte [ebp - 4], 4
push str.pctassist.exe
lea ecx, [ebp - 0x138]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov byte [ebp - 4], 5
push 0x20
lea ecx, [ebp - 0x131]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x130], esp
movzx edx, byte [eax]
push edx
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x13c]
push ecx
push str.taskkill__im__1__f
lea ecx, [ebp - 0x12c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov dword [ebp - 0x18c], eax
mov edx, dword [ebp - 0x18c]
mov dword [ebp - 0x190], edx
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x190]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x198], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x198]
push ecx
call dword [sym.imp.Qt5Core.dll_public:_static_int___cdecl_QProcess::execute_class_QString_const__]
add esp, 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x13c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x12c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x138]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
push 0x20
lea ecx, [ebp - 0x145]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x144], esp
movzx edx, byte [eax]
push edx
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x174]
add ecx, 0xd4
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x1a0]
push edx
lea eax, [ebp - 0x108]
push eax
push str._1_bin
lea ecx, [ebp - 0x140]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov dword [ebp - 0x1a4], eax
mov ecx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1a8], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x1a8]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x140]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x14c]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const__]
add esp, 8
mov dword [ebp - 0x1ac], eax
mov ecx, dword [ebp - 0x1ac]
push ecx
lea ecx, [ebp - 0x108]
call dword [0x60341c]
lea ecx, [ebp - 0x150]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.EuDownloader
mov edx, dword [ebp - 0x174]
add edx, 0xd4
push edx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
mov byte [ebp - 4], 0xd
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x154]
push ecx
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromWCharArray_wchar_t_const___int_]
add esp, 0xc
mov dword [ebp - 0x1b0], eax
mov edx, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b4], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x1b4]
push eax
lea ecx, [ebp - 0x18]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDir::constructor_class_QString_const__]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x154]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x18]
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QDir::removeRecursively_void_]
push 1
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_fstream_wchar_t__struct_std::char_traits_wchar_t__::constructor_void_]
mov byte [ebp - 4], 0x11
push 0x40
push 2
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_fstream_wchar_t__struct_std::char_traits_wchar_t__::open_wchar_t_const___int__int_]
push str.pcta.bin_pacb.bin
lea ecx, [ebp - 0x170]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov byte [ebp - 4], 0x12
push 0x20
lea ecx, [ebp - 0x169]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x168], esp
movzx edx, byte [eax]
push edx
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0x20
lea ecx, [ebp - 0x15d]
call fcn.00401154
push ecx
mov ecx, esp
mov dword [ebp - 0x15c], esp
movzx edx, byte [eax]
push edx
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QChar::constructor_struct_QLatin1Char_]
push 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x164]
push ecx
push str.timeout__t_5_n_ECHO_OFF__SETLOCAL_ENABLEDELAYEDEXPANSION__n__SET__folder_path__1___n_SET__ext_exclude__2___n_set__search_pattern___n__t_t_tPUSHD___folder_path_____n__t_t_tFOR____in__.__DO____n_t_t_tIF___ext_exclude_______ext_exclude_:__x______n__t_t_tDEL__F__Q________n_t_t_tfor__f__delims____d_in__dir__ad__b___folder_path___search_pattern____do__rmdir__s__q___d__n_t_t_tPOPD_n_t_t_tEXIT__B
lea ecx, [ebp - 0x158]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_char_const__]
mov dword [ebp - 0x1b8], eax
mov edx, dword [ebp - 0x1b8]
mov dword [ebp - 0x1bc], edx
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x1bc]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c4], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x1c4]
call dword [sym.imp.Qt5Core.dll_public:_class_QString___thiscall_QString::arg_class_QString_const___int__class_QChar_]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x164]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x158]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x170]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x70]
push edx
call fcn.00422fb0
add esp, 8
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::size_void_const]
push eax
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::data_void_const]
push eax
lea ecx, [ebp - 0xfc]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::write_wchar_t_const___int_]
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_fstream_wchar_t__struct_std::char_traits_wchar_t__::close_void_]
push 0
push 0
push 0
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP90.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x70]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x104]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_fstream_wchar_t__struct_std::char_traits_wchar_t__::vbase_dtor_void_]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x18]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QDir::destructor_void_]
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x38]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x108]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0042e70e
mov esp, ebp
pop ebp
ret