Function at 0x401000
Capabilities:
Create process on windows
Get geographical location
Read .ini file
Set current directory

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x104
push 0x406ce0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x406ce0
push 0x4068cc
push 0x406ce0
call fcn.00401c30
mov edi, 0x406ce0
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 8
mov eax, ecx
mov esi, edi
mov edi, 0x406fec
push 0x407820
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 1
rep movsb byte es:[edi], byte [esi]
mov edi, str.ulAR.cfg
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x800
mov esi, edi
mov edx, ecx
mov edi, 0x406fec
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov edi, str.CheckApp
or ecx, 0xffffffff
xor eax, eax
push str.
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4068cc
mov eax, ecx
mov esi, edi
mov edi, 0x4068cc
mov dword [0x40781c], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401eb6
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 8
test eax, eax
je 0x4012da
mov ebp, dword [sym.imp.USER32.dll_FindWindowA]
mov ecx, dword [0x40781c]
push 0xa
push 0x4068cc
push ecx
call fcn.00404a36
mov edi, 0x406120
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x406fec
mov edx, ecx
mov esi, edi
mov edi, 0x4072fc
push 0x104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4068cc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x4072fc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4068cc
push edi
push str.
push 0x4072fc
push str.AppRun
call ebx
push str.
push edi
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x4012b5
push 0x406114
push edi
call fcn.00401e40
add esp, 8
mov dword [0x4067c4], eax
test eax, eax
je 0x401277
mov dword [0x4065b0], edi
mov byte [eax], 0
mov edx, dword [0x4067c4]
mov edi, dword [0x4065b0]
inc edx
or ecx, 0xffffffff
xor eax, eax
mov dword [0x4067c4], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x407a30
mov eax, ecx
mov esi, edi
mov edi, 0x407a30
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x407614
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401bd0
push 0x407614
call fcn.00401bd0
add esp, 8
push 0x407614
push 0x407a30
call ebp
test eax, eax
jne 0x4017a5
push 0x407c3c
push 0x407a30
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40124f
push 0x407614
push eax
call ebp
test eax, eax
jne 0x4017a5
push 0x407c3c
push 0x407614
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x4012b5
push eax
push 0x407a30
call ebp
test eax, eax
jne 0x4017a5
jmp 0x4012b5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x407a30
mov eax, ecx
mov esi, edi
mov edi, 0x407a30
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401bd0
add esp, 4
push 0
push 0x407a30
call ebp
test eax, eax
jne 0x4017a5
mov eax, dword [0x40781c]
push str.
inc eax
push 0x4068cc
mov dword [0x40781c], eax
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x4010e8
push 0x406fec
push 0x104
push 0x407510
push str.
push str.KeyRoot
push str.Installed
call ebx
mov ebp, 0x80000002
push str.
push 0x407510
mov dword [0x407400], ebp
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x40137b
push 0x4060fc
push 0x407510
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40133d
mov dword [0x407400], 0x80000000
jmp 0x40137b
push 0x4060f8
push 0x407510
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40135f
mov dword [0x407400], 0x80000001
jmp 0x40137b
push 0x4060f4
push 0x407510
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40137b
mov dword [0x407400], ebp
push 0x406fec
push 0x104
push 0x406ad4
push str.
push str.SubKey
push str.Installed
call ebx
push str.
push 0x406ad4
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x4014ac
push 0x406114
push 0x406ad4
call fcn.00401e40
add esp, 8
mov dword [0x40750c], eax
test eax, eax
je 0x40144b
mov dword [0x4065b4], 0x406ad4
mov byte [eax], 0
mov edx, dword [0x40750c]
mov edi, dword [0x4065b4]
inc edx
or ecx, 0xffffffff
xor eax, eax
mov dword [0x40750c], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x406ad4
mov eax, ecx
mov esi, edi
mov edi, 0x406ad4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x407b34
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401bd0
push 0x407b34
call fcn.00401bd0
add esp, 8
jmp 0x401470
mov edi, 0x407c3c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x407b34
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x407400]
push 0x406bd8
push 0x407508
push 0x4066c0
push 0x407b34
push 0x406ad4
push ecx
mov dword [0x406bd8], 0x104
call fcn.00401ca0
push 0x4066c0
call fcn.00401b60
add esp, 0x1c
push 0x406fec
push 0x104
push 0x4067c8
push str.
push str.Item
push str.Installed
call ebx
push str.
push 0x4067c8
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x4016c7
push str.
push 0x406ad4
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401516
push 0x407c3c
push 0x406ad4
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x4015f1
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
or ecx, 0xffffffff
xor eax, eax
push 0x406ad4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [0x406bd8], 0x104
mov edx, ecx
mov esi, edi
mov edi, 0x406ad4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401b60
mov edi, 0x4067c8
or ecx, 0xffffffff
xor eax, eax
push 0x4060ac
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4068cc
mov eax, ecx
mov esi, edi
mov edi, 0x4068cc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401e40
add esp, 0xc
mov dword [0x4071f4], eax
test eax, eax
je 0x401592
mov byte [eax], 0
mov edi, 0x4068cc
or ecx, 0xffffffff
xor eax, eax
push 0x406bd8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x407508
mov esi, edi
mov edx, ecx
mov edi, 0x406ad4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x4066c0
and ecx, 3
push eax
push 0x406ad4
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.00401ca0
push 0x4066c0
push 0x4068cc
push 0x4066c0
call fcn.00401c30
add esp, 0x24
mov edi, 0x4067c8
or ecx, 0xffffffff
xor eax, eax
push 0x407c3c
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4068cc
mov eax, ecx
mov esi, edi
mov edi, 0x4068cc
mov dword [0x407c38], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x4016c7
push 0x4060ac
push 0x4068cc
call fcn.00401e40
add esp, 8
mov dword [0x4066bc], eax
test eax, eax
jne 0x40165f
mov eax, 0x4069cf
mov dword [0x4066bc], eax
push 0
push 0x4068cc
push 0x4066c0
mov byte [eax], 0
call fcn.00401d00
add esp, 0xc
test eax, eax
je 0x401684
mov dword [0x407c38], 1
mov ecx, dword [0x4066bc]
xor eax, eax
push 0x407c3c
push 0x4068cc
lea edi, [ecx + 1]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4068cc
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40163a
push 0x406fec
push 0x104
push 0x4070f0
push str.
push 0x4060a8
push str.Installed
call ebx
push 0x406fec
push 0x104
push 0x406bdc
push str.
push str.Auto
push str.Installed
call ebx
push 0x406bdc
call fcn.00401bd0
push 0x4068cc
push 0x4070f0
call fcn.00401dc0
mov eax, dword [esp + 0x28]
push 0x406de4
push eax
call fcn.00401dc0
push 0x406ee8
push 0x406bdc
call fcn.00401dc0
push str.stop
push 0x4068cc
call fcn.00401eb6
add esp, 0x24
test eax, eax
jne 0x40175b
mov dword [0x406030], eax
jmp 0x40179c
push 0x406ee8
push 0x406de4
call fcn.00401e40
add esp, 8
test eax, eax
je 0x401793
push 0x407c3c
push 0x406ee8
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401793
mov dword [0x406030], 0
jmp 0x40179c
mov eax, dword [0x406030]
test eax, eax
jne 0x4017ae
mov eax, dword [0x407c38]
test eax, eax
je 0x4017ae
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
push 0x406fec
push 0x104
push 0x407718
push str.
push 0x407820
push str.Include
call ebx
push str.
push 0x407718
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x4018c3
push 0x406fec
push 0x104
push 0x407718
push str.
push 0x407820
push str.Include
mov byte [0x407820], 0x30
mov byte [0x407821], 0x34
call ebx
push str.
push 0x407718
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x4018c3
push 0x406fec
push 0x104
push 0x407718
push str.
push str.Default
push str.Include
call ebx
push str.
push 0x407718
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x40189e
push 0x407c3c
push 0x407718
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x40189e
mov edi, 0x407718
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x407820
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x4018be
mov edi, str.0409
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x407820
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x406fec
push 0x104
push 0x40792c
push str.
push 0x407820
push str.Locale
call ebx
push str.
push 0x40792c
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x40190f
push 0x407c3c
push 0x40792c
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x40192f
push 0x406fec
push 0x104
push 0x40792c
push str.
push str.Default
push str.Locale
call ebx
push str.
push 0x40792c
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401987
push 0x407c3c
push 0x40792c
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401987
mov edi, 0x406ce0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x4065b8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40792c
jmp 0x4019b1
mov edi, 0x406ce0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4065b8
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Setup.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x406fec
mov esi, edi
mov edx, ecx
mov edi, 0x4065b8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x104
push 0x407828
and ecx, 3
push str.
push 0x407820
rep movsb byte es:[edi], byte [esi]
push str.CurrentFolder
call ebx
push str.
push 0x407828
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401a25
push 0x407c3c
push 0x407828
call fcn.00401eb6
add esp, 8
test eax, eax
jne 0x401a45
push 0x406fec
push 0x104
push 0x407828
push str.
push str.Default
push str.CurrentFolder
call ebx
push str.
push 0x407828
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401ac5
push 0x407c3c
push 0x407828
call fcn.00401eb6
add esp, 8
test eax, eax
je 0x401ac5
mov edi, 0x406ce0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x407404
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x407828
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x407404
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x401adc
push 0x407404
push 0x4068cc
push 0x4065b8
call fcn.00401c30
add esp, 0xc
push 0x406de4
push 0x4068cc
push 0x4065b8
call fcn.00401c30
push 0
push 0x4068cc
push 0x406de4
call fcn.00401d00
add esp, 0x18
test eax, eax
jne 0x401b2c
push eax
push str.AutoRun
push str.File_didnt_be_found.
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x10
push 0x407404
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 1
push 0
push 0
push 0x4065b8
push str.open
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x10