Function at 0x401321
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
sub esp, 0x810
push ebx
push edi
lea eax, [esp + 0x610]
mov edi, edx
push eax
push 0x104
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x401350
or eax, 0xffffffff
jmp 0x401549
lea eax, [esp + 0x20]
push eax
xor eax, eax
push eax
push 0x40209c
lea eax, [esp + 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x401348
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov eax, edx
cmp word [esp + 0x20], ax
je 0x40138d
inc eax
cmp word [esp + eax*2 + 0x20], dx
jne 0x401385
push ebp
push esi
push 0x6c
pop ecx
push 0x72
mov word [esp + eax*2 + 0x2a], cx
pop ecx
push 0x75
mov word [esp + eax*2 + 0x28], cx
pop ecx
push 0x2e
mov word [esp + eax*2 + 0x26], cx
pop ecx
push edx
push 0x80
push 2
push edx
push edx
mov word [esp + eax*2 + 0x34], cx
lea eax, [esp + 0x3c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, eax
or esi, 0xffffffff
cmp ebp, esi
je 0x401545
and dword [esp + 0x18], 0
lea edx, [esp + 0x18]
and dword [esp + 0x1c], 0
push ecx
mov ecx, ebx
call fcn.004010f1
mov ebx, dword [esp + 0x20]
lea edx, [esp + 0x234]
pop ecx
mov esi, edx
mov ecx, str._InternetShortcut__r_nURL
sub ecx, esi
mov al, 0x5b
or esi, 0xffffffff
mov byte [edx], al
inc edx
mov al, byte [ecx + edx]
test al, al
jne 0x401406
mov byte [edx], al
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
jmp 0x401426
mov cl, al
inc ebx
call fcn.004012a5
add edx, eax
mov al, byte [ebx]
test al, al
jne 0x40141a
mov word [edx], 0xa0d
lea eax, [esp + 0x20]
add edx, 2
xor ebx, ebx
push ebx
push eax
lea eax, [esp + 0x238]
mov byte [edx], bl
sub edx, eax
push edx
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebp
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x4014dc
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.00401235
cmp byte [esp + 0x230], bl
je 0x4014ba
mov ebp, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x230]
push ebx
push ebx
push esi
push eax
push ebx
push 0xfde9
call ebp
mov ebx, eax
test ebx, ebx
jle 0x4014ba
push ebx
lea ecx, [esp + 0x14]
call fcn.00401250
push ebx
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x234]
push ebx
push esi
push eax
push 0
push 0xfde9
call ebp
jmp 0x4014be
mov ebx, dword [esp + 0x14]
push 0
push ebx
mov edx, str.URL_Shortcut_content:
mov ecx, edi
call fcn.0040115d
pop ecx
pop ecx
lea ecx, [esp + 0x10]
mov edi, eax
call fcn.00401235
xor ebx, ebx
cmp dword [esp + 0x24], 0
je 0x401533
push 5
push ebx
push ebx
lea eax, [esp + 0x34]
mov ebp, str.open
push eax
push ebp
push ebx
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
call ebx
mov esi, eax
test edi, edi
je 0x40150e
push edi
mov edx, ebp
mov ecx, esi
call fcn.00401757
pop ecx
mov edi, eax
cmp esi, 0x20
ja 0x401533
push 5
xor ecx, ecx
lea eax, [esp + 0x2c]
push ecx
push ecx
push eax
push ecx
push ecx
call ebx
mov esi, eax
test edi, edi
je 0x401533
push edi
xor edx, edx
mov ecx, esi
call fcn.00401757
pop ecx
push dword [esp + 0x1c]
xor eax, eax
cmp esi, 0x20
cmova esi, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
pop ebp
pop edi
pop ebx
add esp, 0x810
ret