Function at 0x4122d0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539278
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x58bcc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0
call fcn.00414b00
mov byte [ebp - 4], 1
call fcn.004134f2
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x412325
push 0x80004005
call fcn.004026c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx - 0xc]
test eax, eax
je 0x4127fe
push ecx
lea edx, [ebp + 0xc]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push edx
call fcn.00401d30
lea eax, [ebp - 0x48]
push eax
call fcn.00404f10
push 0x566cdc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402330
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4123a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
test eax, eax
je 0x4123cc
cmp dword [ecx - 0xc], 0
jl 0x4123cc
push eax
push ecx
call fcn.0051405c
mov ecx, dword [ebp - 0x40]
add esp, 8
test eax, eax
je 0x4123cc
sub eax, ecx
sar eax, 1
cmp eax, 0xffffffff
jne 0x4123d2
cmp dword [ebp - 0x34], 0
jne 0x4123fd
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4123f7
cmp dword [ecx - 0xc], 0
jl 0x4123f7
push eax
push ecx
call fcn.0051405c
add esp, 8
test eax, eax
je 0x4123f7
sub eax, dword [ebp - 0x40]
sar eax, 1
cmp eax, 0xffffffff
jne 0x4123fd
cmp dword [ebp - 0x34], 0
je 0x412436
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00405150
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x28]
push eax
push edx
lea ecx, [ebp - 0x30]
call fcn.00414edf
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x412396
cmp dword [ebp - 0x28], 0
jg 0x412441
call fcn.00414256
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp + 8]
push ecx
lea esi, [edi + 0x83c]
lea edx, [ebp - 0x18]
push esi
push edx
call fcn.00405780
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 6
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41248b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00401d30
lea edx, [ebp - 0x18]
lea ecx, [edi + 0x818]
push edx
mov byte [ebp - 4], 7
call fcn.00401e90
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4124cd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x14]
push ecx
add edi, 0x810
push edi
call fcn.00401100
mov byte [ebp - 4], 8
mov edi, dword [ebp - 0x28]
cmp edi, 1
jg 0x4124ee
call fcn.00414256
mov ebx, dword [ebp - 0x2c]
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x412509
push 0x80004005
call fcn.004026c0
mov eax, dword [ebp - 0x14]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412536
test dx, dx
je 0x412532
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412536
add eax, 4
add ecx, 4
test dx, dx
jne 0x412510
xor eax, eax
jmp 0x41253b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x4127d3
test edi, edi
jg 0x412551
call fcn.00414256
push ebx
lea edx, [ebp - 0x1c]
push str.Downloading
push edx
call fcn.004037a0
add esp, 0xc
push str._file
push eax
lea eax, [ebp - 0x18]
mov bl, 9
push eax
mov byte [ebp - 4], bl
call fcn.00403900
add esp, 0xc
mov byte [ebp - 4], 0xa
mov eax, dword [eax]
mov edi, dword [ebp + 8]
push eax
lea ecx, [edi + 0x780]
call fcn.0041de31
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4125b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4125d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str..zip
lea edx, [ebp - 0x10]
push edx
push ecx
call fcn.00403900
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x28], 0
jg 0x4125fd
call fcn.00414256
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [edi + 0x844]
push ecx
lea edx, [ebp + 8]
push edx
call fcn.00405780
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x18], esp
push str..zip
push eax
push ecx
call fcn.00403900
add esp, 0xc
push edi
mov byte [ebp - 4], 0xd
call fcn.00410b60
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41265b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4128ab
cmp dword [ebp - 0x28], 0
jg 0x41266e
call fcn.00414256
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405780
add esp, 8
mov bl, 0xe
mov ecx, esp
mov byte [ebp - 4], bl
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00403900
add esp, 8
mov edx, esp
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x18], esp
push str..zip
lea eax, [ebp - 0x10]
push eax
push edx
call fcn.00403900
add esp, 0xc
push edi
mov byte [ebp - 4], bl
call fcn.00410860
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4126e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4127d3
cmp dword [ebp - 0x28], 0
push 0
jg 0x4126f6
call fcn.00414256
mov ecx, dword [ebp - 0x2c]
push ecx
lea edx, [ebp + 8]
push esi
push edx
call fcn.00405780
add esp, 8
mov ecx, esp
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x1c], esp
push str..New
push eax
push ecx
call fcn.00403900
add esp, 8
mov byte [ebp - 4], 0x11
mov edx, esp
mov dword [ebp - 0x18], esp
push edx
call fcn.00404870
mov byte [ebp - 4], 0x10
call fcn.00404ca0
mov bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41275c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x412869
push str.files.lst
lea ecx, [ebp + 8]
push esi
push ecx
call fcn.00403900
mov eax, dword [eax]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp + 8]
call fcn.004026a0
cmp dword [ebp - 0x28], 0
jg 0x412792
call fcn.00414256
mov edx, dword [ebp - 0x2c]
push edx
lea eax, [ebp + 8]
push esi
push eax
call fcn.00405780
mov eax, dword [eax]
mov ecx, dword [edi + 0x20]
add esp, 0xc
push 5
push 0
push 0
push eax
push str.open
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 8]
call fcn.004026a0
mov edx, dword [edi + 0x20]
push 0
push 0
push 0x10
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4127f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405070
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412821
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414d86
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412853
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebp - 0x14]
call fcn.004026a0
lea ecx, [ebp - 0x48]
call fcn.00405070
lea ecx, [ebp - 0x10]
call fcn.004026a0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414d86
lea ecx, [ebp + 0xc]
call fcn.004026a0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128ce
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x48]
call fcn.00405070
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4128f9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00414d86
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41292b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8