Function at 0x4017e0
Capabilities:
Create process on windows
Delete file
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push ebx
mov ecx, ebx
mov dword [esp + 0x20], edi
call fcn.004024a0
push eax
call fcn.00404a70
add esp, 8
push 0x40518d
push 0x4051ac
mov ecx, ebx
call fcn.00402360
lea ecx, [esp + 0x10]
call fcn.004024b0
mov eax, dword [esp + 0x1c]
push eax
push 0x4051a8
mov ecx, ebx
xor esi, esi
call fcn.00402160
cmp eax, 0xffffffff
je 0x401a97
nop
inc eax
push eax
push 0x4051a8
mov ecx, ebx
mov dword [esp + 0x24], eax
inc esi
call fcn.00402160
cmp eax, 0xffffffff
jne 0x401840
cmp esi, edi
mov dword [esp + 0x2c], esi
je 0x401a97
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
jle 0x401a97
lea ecx, [esp + 0x1c]
push ecx
push 0x4051a8
lea edx, [esp + 0x40]
push edx
mov ecx, ebx
call fcn.004027e0
mov ecx, eax
call fcn.004024a0
sub esp, 8
mov ecx, esp
push eax
call fcn.00402550
lea ecx, [esp + 0x18]
call fcn.00402780
lea ecx, [esp + 0x38]
call fcn.00402590
push 0x40518d
lea ecx, [esp + 0x14]
call fcn.00402410
test eax, eax
je 0x4018c7
inc dword [esp + 0x18]
jmp 0x401a8d
lea ecx, [esp + 0x30]
call fcn.004024b0
push 0
push 0x2c
lea ecx, [esp + 0x18]
or edi, 0xffffffff
call fcn.004021c0
mov esi, eax
cmp esi, 0xffffffff
je 0x401932
push esi
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x18]
call fcn.00402630
mov ecx, eax
call fcn.004024a0
sub esp, 8
mov ecx, esp
push eax
call fcn.00402550
lea ecx, [esp + 0x38]
call fcn.00402780
lea ecx, [esp + 0x50]
call fcn.00402590
inc esi
push esi
push 0
lea ecx, [esp + 0x18]
call fcn.00402200
lea ecx, [esp + 0x30]
call fcn.004023e0
mov edi, eax
lea ecx, [esp + 0x10]
call fcn.004024a0
push 0x100
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea edx, [esp + 0x58]
push edx
lea ecx, [esp + 0x24]
call fcn.00402550
push str.System32_
lea ecx, [esp + 0x24]
call fcn.00402110
push 0xffffffffffffffff
push 0x2f
lea ecx, [esp + 0x18]
call fcn.004022a0
inc eax
push eax
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x1c]
call fcn.004025b0
mov ecx, eax
call fcn.004024a0
push eax
lea ecx, [esp + 0x24]
call fcn.00402110
lea ecx, [esp + 0x40]
call fcn.00402590
lea ecx, [esp + 0x20]
call fcn.004024a0
push eax
lea ecx, [esp + 0x14]
call fcn.004024a0
push eax
call fcn.004044f0
add esp, 8
test eax, eax
je 0x401a6e
lea ecx, [esp + 0x20]
call fcn.004024a0
cmp edi, 0xffffffff
mov dword [esp + 0x28], eax
jne 0x4019e2
push 5
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
jmp 0x401a6e
push 0x80000000
lea ecx, [esp + 0x24]
call fcn.004024a0
push eax
call fcn.00404230
add esp, 8
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebx, edi
jne 0x401a60
push 0xffffffffffffffff
push 0x2f
lea ecx, [esp + 0x18]
call fcn.004022a0
inc eax
push eax
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x1c]
call fcn.004025b0
mov ecx, eax
call fcn.004024a0
sub esp, 8
mov ecx, esp
push eax
call fcn.00402550
call fcn.00401620
add esp, 8
lea ecx, [esp + 0x48]
call fcn.00402590
mov edx, dword [esp + 0x28]
push 5
push edx
call dword [sym.imp.KERNEL32.DLL_WinExec]
jmp 0x401a6b
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov ebx, dword [ebp + 8]
mov eax, dword [esp + 0x18]
inc eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], eax
call fcn.00402590
lea ecx, [esp + 0x30]
call fcn.00402590
mov esi, dword [esp + 0x2c]
cmp dword [esp + 0x18], esi
jl 0x401872
lea ecx, [esp + 0x10]
call fcn.00402590
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret