Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Get session user name

Disassembly:
push 0xc0
push 0
push 0x40cc94
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x40cc98], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x40cc94], eax
call fcn.00407f20
call fcn.00407a74
call fcn.00407070
call fcn.00406a96
call fcn.00406570
call fcn.004060dc
call fcn.00405fa0
call fcn.00405746
call fcn.00405260
push 7
push 0x40c0e8
push 0x38
mov eax, 0x40cd4c
call fcn.00406690
mov eax, dword [0x40ce00]
push eax
push eax
push 0x400
call fcn.004057e0
lea ecx, [0x40cca4]
pop edx
call fcn.00405000
push dword [0x40cca4]
push 0x400
call sub.KERNEL32.dll_GetTempPathA
push 0x400
call fcn.004065a0
mov dword [0x40ccb0], eax
push dword [0x40cca4]
push dword [0x40ccb0]
call fcn.004065c0
push 0x40ccfc
push dword [0x40ccb0]
push 0
call sub.SHELL32.dll_ExtractAssociatedIconA
mov dword [0x40cca8], eax
push dword [0x40ccb0]
call fcn.004065f0
mov eax, dword [0x40ce00]
push eax
push eax
push 0x400
call fcn.004057e0
lea ecx, [0x40ccb4]
pop edx
call fcn.00405000
mov dword [0x40ccb8], 0x400
push 0x40ccb8
mov eax, dword [0x40ccb4]
push eax
call sub.ADVAPI32.dll_GetUserNameA
push dword [0x40ce00]
push 0x10
call fcn.004037ea
lea ecx, [0x40ccbc]
pop edx
call fcn.00405000
push dword [0x40ce00]
push 2
call fcn.004037ea
lea ecx, [0x40ccc0]
pop edx
call fcn.00405000
push dword [0x40ce00]
push 5
call fcn.004037ea
lea ecx, [0x40ccc4]
pop edx
call fcn.00405000
push dword [0x40ce00]
push 0x1c
call fcn.004037ea
lea ecx, [0x40ccc8]
pop edx
call fcn.00405000
push dword [0x40ce00]
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccb4]
call fcn.00407f70
mov edx, 0x40c049
call fcn.00407f70
lea ecx, [0x40cccc]
pop edx
call fcn.00405000
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccbc]
call fcn.00407f70
mov edx, 0x40c049
call fcn.00407f70
lea ecx, [0x40cccc]
pop edx
call fcn.00405000
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccc0]
call fcn.00407f70
mov edx, 0x40c049
call fcn.00407f70
lea ecx, [0x40cccc]
pop edx
call fcn.00405000
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccc4]
call fcn.00407f70
mov edx, 0x40c049
call fcn.00407f70
lea ecx, [0x40cccc]
pop edx
call fcn.00405000
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccc8]
call fcn.00407f70
mov edx, 0x40c049
call fcn.00407f70
lea ecx, [0x40cccc]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
push 0x3e8
call fcn.004057e0
lea ecx, [0x40ccd0]
pop edx
call fcn.00405000
push 0x3e8
mov eax, dword [0x40ccd0]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
mov edx, dword [0x40ccd0]
push dword [0x40ce00]
call fcn.00407f70
lea ecx, [0x40ccd4]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
push dword [0x40ccd4]
call fcn.00406427
lea ecx, [0x40ccd8]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
push 0x3e8
call fcn.004057e0
lea ecx, [0x40ccdc]
pop edx
call fcn.00405000
push dword [0x40ccdc]
push 0x3e8
call sub.KERNEL32.dll_GetTempPathA
mov edx, dword [0x40ccdc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, str.yovosetup_
call fcn.00407f70
lea ecx, [0x40ccdc]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
call fcn.004061b9
lea ecx, [0x40cce0]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
call fcn.004061b9
lea ecx, [0x40cce4]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
call fcn.004061b9
lea ecx, [0x40cce8]
pop edx
call fcn.00405000
mov edx, dword [0x40cce8]
xor ecx, ecx
call fcn.00407fd0
jne 0x4013fe
push dword [0x40ce00]
mov edx, str.___.
call fcn.00407f70
mov edx, dword [0x40cce8]
call fcn.00407f70
lea ecx, [0x40cce8]
pop edx
call fcn.00405000
push dword [0x40cce0]
mov edx, str._killsetup
pop ecx
call fcn.00407fd0
je 0x40147a
push 0x3e8
call sub.KERNEL32.dll_Sleep
push 3
push 0x40c00c
push dword [0x40ccdc]
call fcn.00406ab2
mov ebx, eax
and ebx, ebx
jne 0x401463
push dword [0x40ccdc]
call fcn.00406c52
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xfffffffe
jne 0x40144f
cmp edi, 0xffffffff
je 0x401453
xor eax, eax
jmp 0x401458
mov eax, 1
or eax, eax
je 0x401463
mov eax, 1
jmp 0x401465
xor eax, eax
and eax, eax
je 0x401475
push 0xa
call sub.KERNEL32.dll_Sleep
jmp 0x40141b
jmp 0x401872
push 0
push 0
push dword [0x40ccd4]
call fcn.00403ab4
push dword [0x40ccdc]
call fcn.004032e6
mov edx, str.Setup.exe
lea ecx, [0x40ccec]
call fcn.00405018
push dword [0x40ce00]
mov edx, dword [0x40ccd8]
push dword [0x40ce00]
call fcn.00407f70
mov edx, str.yovosetup.ini
call fcn.00407f70
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
call fcn.00406c52
pop dword [0x40ce00]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4014f9
jl 0x4014f5
cmp ebx, 0
ja 0x4014f9
xor eax, eax
jmp 0x4014fe
mov eax, 1
or eax, eax
je 0x4016e3
push dword [0x40ce00]
mov edx, dword [0x40ccdc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, str.yovosetup.ini
call fcn.00407f70
inc dword [0x40ce00]
mov edx, dword [0x40ccd8]
push dword [0x40ce00]
call fcn.00407f70
mov edx, str.yovosetup.ini
call fcn.00407f70
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
mov edx, dword [0x40c0f8]
add dword [esp + 4], edx
call fcn.00406d6d
pop dword [0x40ce00]
push dword [0x40ce00]
mov edx, dword [0x40ccd8]
push dword [0x40ce00]
call fcn.00407f70
mov edx, str.yovosetup.ini
call fcn.00407f70
inc dword [0x40ce00]
push 0
mov edx, dword [0x40c0f8]
add dword [esp + 4], edx
call fcn.00407260
pop dword [0x40ce00]
and eax, eax
je 0x4016e3
mov eax, dword [0x40ce00]
push eax
push eax
mov eax, dword [0x40ce00]
push eax
push eax
mov eax, dword [0x40ce00]
push eax
push eax
push 0
call fcn.00407280
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
call fcn.00405820
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
call fcn.004058d0
lea ecx, [0x40ccf0]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
mov eax, dword [0x40ce00]
push eax
push eax
push 0x40c037
push 1
push dword [0x40ccf0]
call fcn.00405c20
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
call fcn.00405820
lea ecx, [0x40ccf4]
pop edx
call fcn.00405000
mov eax, dword [0x40ce00]
push eax
push eax
mov eax, dword [0x40ce00]
push eax
push eax
push 0x40c037
push 2
push dword [0x40ccf0]
call fcn.00405c20
inc dword [0x40ce00]
mov edx, dword [0x40c0f8]
add dword [esp], edx
call fcn.00405820
lea ecx, [0x40ccf8]
pop edx
call fcn.00405000
push dword [0x40ccf4]
mov edx, 0x40c015
mov ecx, dword [esp]
call fcn.00407fd0
je 0x4016c6
push dword [0x40ccf8]
mov edx, 0x40c035
pop ecx
call fcn.00407fd0
je 0x4016c6
mov edx, str.Setupu.exe
lea ecx, [0x40ccec]
call fcn.00405018
pop eax
push 0
call fcn.004073c0
and eax, eax
je 0x4015b5
push 0
call fcn.00407000
mov edx, dword [0x40cce0]
xor ecx, ecx
call fcn.00407fd0
jne 0x401708
mov edx, dword [0x40cce4]
xor ecx, ecx
call fcn.00407fd0
jne 0x401708
mov eax, 1
jmp 0x40170a
xor eax, eax
and eax, eax
je 0x4017df
push dword [0x40ce00]
push 5
push dword [0x40ccdc]
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccd8]
call fcn.00407f70
mov edx, 0x40c060
call fcn.00407f70
mov edx, dword [0x40cce0]
call fcn.00407f70
mov edx, 0x40c060
call fcn.00407f70
mov edx, dword [0x40cce4]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40cce8]
call fcn.00407f70
inc dword [0x40ce00]
mov edx, dword [0x40ccdc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, dword [0x40ccec]
call fcn.00407f70
inc dword [0x40ce00]
mov eax, str.open
push eax
push 0
mov edx, dword [0x40c0f8]
add dword [esp + 8], edx
mov edx, dword [0x40c0f8]
add dword [esp + 0xc], edx
call sub.SHELL32.dll_ShellExecuteA
pop dword [0x40ce00]
jmp 0x401872
push dword [0x40ce00]
push 5
push dword [0x40ccdc]
mov edx, dword [0x40cccc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
mov edx, dword [0x40ccd8]
call fcn.00407f70
mov edx, 0x40c00f
call fcn.00407f70
inc dword [0x40ce00]
mov edx, dword [0x40ccdc]
push dword [0x40ce00]
call fcn.00407f70
mov edx, dword [0x40ccec]
call fcn.00407f70
inc dword [0x40ce00]
mov eax, str.open
push eax
push 0
mov edx, dword [0x40c0f8]
add dword [esp + 8], edx
mov edx, dword [0x40c0f8]
add dword [esp + 0xc], edx
call sub.SHELL32.dll_ShellExecuteA
pop dword [0x40ce00]
push 0
call 0x40188c
push dword [0x40cc94]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.004051c0
call fcn.0040622a
call fcn.00406590
call fcn.00406a68
call fcn.00407060
call fcn.00407a89
ret