Function at 0x1003bd30
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x874
mov eax, 0x1007762b
call fcn.1005a354
and word [ebp - 0x818], 0
push 0x800
lea eax, [ebp - 0x816]
push 0
push eax
mov edi, ecx
call fcn.10053710
add esp, 0xc
lea esi, [edi + 0x1200]
push 0xffffffffffffffff
lea eax, [edi + 0x30]
push esi
xor ebx, ebx
mov dword [ebp - 0x848], esi
call fcn.10001d45
lea eax, [ebp - 0x850]
mov ecx, esi
call fcn.10001968
mov ebx, eax
lea eax, [ebp - 0x844]
mov ecx, esi
call fcn.10001988
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001968
push dword [ebx + 4]
mov ecx, dword [ebp - 0x838]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x83c]
call fcn.10025178
add esp, 0x18
cmp dword [esi + 0x18], 8
jb 0x1003bdd5
mov eax, dword [esi + 4]
jmp 0x1003bdd8
lea eax, [esi + 4]
call fcn.1003a26a
test al, al
jne 0x1003bde8
xor eax, eax
jmp 0x1003c155
xor ebx, ebx
push 0x401
lea eax, [ebp - 0x818]
push ebx
push eax
mov dword [ebp - 0x838], ebx
call fcn.10053710
add esp, 0xc
push ebx
push 0x2b
lea eax, [ebp - 0x818]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1003c129
lea eax, [ebp - 0x818]
push eax
call fcn.1005317b
pop ecx
lea esi, [edi + 0x121c]
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x84c], esi
call fcn.100022ac
push str.TencentQQDownload
push esi
call fcn.10006aa8
lea eax, [ebp - 0x860]
mov ecx, esi
call fcn.10001968
mov ebx, eax
lea eax, [ebp - 0x868]
mov ecx, esi
call fcn.10001988
mov dword [ebp - 0x840], eax
lea eax, [ebp - 0x858]
mov ecx, esi
call fcn.10001968
push dword [ebx + 4]
mov ecx, dword [ebp - 0x840]
push dword [ebx]
push dword [ecx + 4]
push dword [ecx]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x844]
call fcn.10025178
xor eax, eax
mov dword [ebp - 0x81c], 7
mov dword [ebp - 0x820], eax
mov word [ebp - 0x830], ax
push 0x401
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push eax
call fcn.10053710
add esp, 0x24
lea esi, [edi + 0x1c]
push esi
push str.DownloadProxy.Downloader.1
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x818]
movsd dword es:[edi], dword [esi]
call fcn.1003e693
add esp, 0x10
test eax, eax
je 0x1003c0ff
mov eax, ebx
push eax
call fcn.1005317b
pop ecx
mov ecx, ebx
lea esi, [ebp - 0x834]
call fcn.100022ac
mov ebx, 0x100846e4
push ebx
call fcn.1005317b
mov edx, dword [ebp - 0x820]
test edx, edx
pop ecx
mov dword [ebp - 0x840], eax
jbe 0x1003bf85
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003bf42
lea ecx, [ebp - 0x830]
cmp dword [ebp - 0x81c], 8
lea eax, [ecx + edx*2]
mov ecx, dword [ebp - 0x830]
jae 0x1003bf81
lea ecx, [ebp - 0x830]
jmp 0x1003bf81
mov edi, dword [ebp - 0x840]
test edi, edi
mov edx, ebx
jbe 0x1003bf75
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003bf77
inc edx
inc edx
dec edi
jne 0x1003bf6b
xor edx, edx
test edx, edx
je 0x1003c005
inc ecx
inc ecx
cmp ecx, eax
jb 0x1003bf5c
or ecx, 0xffffffff
push ecx
xor edi, edi
lea esi, [ebp - 0x834]
call fcn.100018fa
push ebx
call fcn.1005317b
pop ecx
mov ecx, dword [ebp - 0x820]
test ecx, ecx
jbe 0x1003c040
or edx, 0xffffffff
cmp ecx, edx
ja 0x1003bfb5
lea edx, [ecx - 1]
cmp dword [ebp - 0x81c], 8
mov ecx, dword [ebp - 0x830]
jae 0x1003bfca
lea ecx, [ebp - 0x830]
lea ecx, [ecx + edx*2]
test eax, eax
mov edi, eax
mov edx, ebx
jbe 0x1003bfe2
movzx esi, word [ecx]
cmp word [edx], si
je 0x1003bfe4
inc edx
inc edx
dec edi
jne 0x1003bfd8
xor edx, edx
test edx, edx
je 0x1003c023
cmp dword [ebp - 0x81c], 8
mov edx, dword [ebp - 0x830]
jae 0x1003bffd
lea edx, [ebp - 0x830]
cmp ecx, edx
je 0x1003c040
dec ecx
dec ecx
jmp 0x1003bfcd
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003c01a
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
jmp 0x1003bf88
cmp dword [ebp - 0x81c], 8
mov eax, dword [ebp - 0x830]
jae 0x1003c038
lea eax, [ebp - 0x830]
sub ecx, eax
sar ecx, 1
mov eax, ecx
jmp 0x1003c043
or eax, 0xffffffff
push 0xffffffffffffffff
lea edi, [eax + 1]
lea esi, [ebp - 0x834]
call fcn.100018fa
lea eax, [ebp - 0x870]
mov ecx, esi
call fcn.10001968
mov esi, eax
lea eax, [ebp - 0x880]
lea ecx, [ebp - 0x834]
call fcn.10001988
mov edi, eax
lea eax, [ebp - 0x878]
lea ecx, [ebp - 0x834]
call fcn.10001968
push dword [esi + 4]
push dword [esi]
push dword [edi + 4]
push dword [edi]
push dword [eax + 4]
push dword [eax]
lea eax, [ebp - 0x858]
call fcn.10025178
mov eax, dword [ebp - 0x830]
add esp, 0x18
cmp dword [ebp - 0x81c], 8
jae 0x1003c0b8
lea eax, [ebp - 0x830]
call fcn.1003a26a
test al, al
je 0x1003c0ff
mov eax, dword [ebp - 0x84c]
cmp dword [eax + 0x18], 8
mov ecx, dword [eax + 0x14]
jb 0x1003c0d5
mov eax, dword [eax + 4]
jmp 0x1003c0d8
add eax, 4
push ecx
push eax
lea eax, [ebp - 0x834]
call fcn.10001dcb
cmp eax, 0xffffffff
jne 0x1003c109
mov ecx, dword [ebp - 0x848]
lea eax, [ebp - 0x834]
call fcn.10039ed6
test al, al
jne 0x1003c109
mov dword [ebp - 0x838], 1
push 0
push 1
lea esi, [ebp - 0x834]
call fcn.10001efb
cmp dword [ebp - 0x838], 0
je 0x1003c152
mov esi, dword [ebp - 0x848]
xor ebx, ebx
cmp dword [esi + 0x18], 8
jb 0x1003c134
mov esi, dword [esi + 4]
jmp 0x1003c137
add esi, 4
push ebx
push ebx
push str.__install
push esi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
inc eax
call fcn.1005a3d7
ret