Function at 0x401c00
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
mov eax, dword [0x412464]
sub esp, 0x104
test eax, eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalUnlock]
je 0x4011dd
mov ecx, dword [0x412818]
dec eax
mov dword [0x412464], eax
mov edx, dword [ecx + eax*4]
push edx
call fcn.004010c0
mov eax, dword [0x412818]
mov ecx, dword [0x412464]
add esp, 4
mov edx, dword [eax + ecx*4]
push edx
call esi
push eax
call edi
mov eax, dword [0x412464]
mov ecx, dword [0x412818]
mov edx, dword [ecx + eax*4]
push edx
call esi
push eax
call ebx
mov eax, dword [0x412464]
test eax, eax
jne 0x401194
mov eax, dword [0x412818]
test eax, eax
je 0x401201
push eax
call esi
push eax
call edi
mov eax, dword [0x412818]
push eax
call esi
push eax
call ebx
mov dword [0x412818], 0
mov eax, dword [0x41281c]
lea edx, [esp + 0xc]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40120c
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x40f0a0]
repne scasb al, byte es:[edi]
mov ecx, dword [str.def.phd]
dec edi
lea eax, [esp + 0xc]
mov dword [edi], ecx
push eax
mov dword [edi + 4], edx
call fcn.004010c0
mov eax, dword [0x41281c]
lea edx, [esp + 0x10]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40124b
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x40f0a8]
repne scasb al, byte es:[edi]
mov ecx, dword [str.assoc.cfg]
mov ax, word [0x40f0ac]
dec edi
mov dword [edi], ecx
lea ecx, [esp + 0xc]
push ecx
mov dword [edi + 4], edx
mov word [edi + 8], ax
call fcn.004010c0
mov eax, dword [0x41281c]
lea edx, [esp + 0x10]
add esp, 4
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401294
lea edi, [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.cpic.opt]
repne scasb al, byte es:[edi]
mov eax, dword [0x40f0b4]
mov cl, byte [0x40f0b8]
dec edi
mov dword [edi], edx
lea edx, [esp + 0xc]
push edx
mov dword [edi + 4], eax
mov byte [edi + 8], cl
call fcn.004010c0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 4
xor esi, esi
mov eax, dword [0x41281c]
push esi
push eax
lea ecx, [esp + 0x14]
push str._sdeleteme._d
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
call fcn.004010c0
add esp, 0x14
test eax, eax
jne 0x401305
inc esi
cmp esi, 0x186a0
jl 0x4012d8
pop edi
pop esi
pop ebx
add esp, 0x104
ret
mov eax, dword [0x41281c]
lea edx, [esp - 0x208]
sub esp, 0x228
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x401c14
mov eax, dword [0x40f030]
push ebx
mov ebx, dword [0x412438]
push ebp
lea ecx, [eax + eax*2]
push esi
push edi
lea edx, [esp + 0x30]
lea ecx, [ecx + ecx*4]
lea edi, [ecx + ecx*8]
or ecx, 0xffffffff
add edi, edi
sub edi, eax
xor eax, eax
add edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov cl, byte [esp + eax + 0x30]
mov byte [esp + eax + 0x134], cl
inc eax
test cl, cl
jne 0x401c65
or ecx, 0xffffffff
lea edi, [esp + 0x30]
xor eax, eax
lea edx, [esp + 0x30]
repne scasb al, byte es:[edi]
mov eax, dword [str.__stub]
mov ecx, dword [0x40f0d8]
dec edi
mov dword [edi], eax
xor eax, eax
mov dword [edi + 4], ecx
mov edi, dword [0x412814]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x30]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40f0dc]
mov cl, byte [0x40f0de]
dec edi
mov word [edi], ax
xor eax, eax
mov byte [edi + 2], cl
mov edi, dword [esp + 0x240]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x30]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40f0e0]
mov word [edi - 1], ax
call fcn.00401b50
mov ecx, dword [0x412820]
push ecx
call dword [sym.imp.KERNEL32.dll__lclose]
mov ebp, dword [esp + 0x23c]
push 0
push 0x412450
push ebp
mov dword [0x412820], 0xffffffff
mov dword [0x41244c], 0xfffffffe
call dword [sym.imp.USER32.dll_InvalidateRect]
push ebp
call dword [sym.imp.USER32.dll_UpdateWindow]
lea edx, [esp + 0x30]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea eax, [esp + 0x134]
push 0x401b00
mov dword [0x412810], eax
push 0x1f4
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, ebp
je 0x401db7
push 0
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call esi
test eax, eax
je 0x401df2
cmp dword [esp + 0x18], 0x12
je 0x401dfa
lea edx, [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x14]
push eax
call ebx
push 1
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
call esi
test eax, eax
jne 0x401dca
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x401da4
mov edx, dword [esp + 0x10]
mov byte [0x40f03a], 0
push edx
push 0
call dword [sym.imp.USER32.dll_KillTimer]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
jmp 0x401170