Function at 0x401e95
Capabilities:
Create process on windows
Get common file path
Read file on windows

Disassembly:
mov eax, 0x41aba8
call fcn.0040f3e4
sub esp, 0x70c
lea eax, [ebp - 0x14]
push ebx
push esi
push edi
push eax
xor eax, eax
push eax
push eax
push 0x1c
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
test eax, eax
lea eax, [ebp - 0x308]
jne 0x401ef0
push eax
push dword [ebp - 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 0x308]
push str.Microsoft_
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
jmp 0x401ef8
push 0x41e688
push eax
call ebx
pop ecx
pop ecx
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x510]
push eax
call ebx
lea eax, [ebp - 0x510]
push str.MSYMDCOM2.dat
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea eax, [ebp - 0x510]
push 0x41e6ac
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x10], esi
test esi, esi
je 0x402022
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
mov edi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
lea ecx, [edi + 1]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push dword [ebp - 0x10]
mov esi, eax
push edi
push 1
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x2c
lea ecx, [ebp - 0x8c]
call fcn.0040165c
push edi
push esi
lea ecx, [ebp - 0x8c]
call fcn.00402128
push esi
mov byte [esi + edi], 0
call dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
pop ecx
test eax, eax
je 0x402022
push 0
lea esi, [eax + 0x1e28500]
call 0x40388e
pop ecx
cmp eax, esi
jl 0x402022
cmp dword [0x42db70], 0
jne 0x402062
xor ebx, ebx
mov ecx, 0x451c90
push ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push str.Your_1_year_Pro_License_has_expired._Please_buy_a_new_one._We_will_open_the_renew_page_for_you_in_browser.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push str._renew.html
lea eax, [ebp - 0x10]
push 0x451b44
push eax
call fcn.00401b32
add esp, 0xc
xor esi, esi
inc esi
mov ecx, eax
push esi
push ebx
push ebx
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov dword [0x42db70], esi
jmp 0x402062
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x718]
push eax
call ebx
lea eax, [ebp - 0x718]
push str.MSYMDCOM.dat
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea eax, [ebp - 0x718]
push 0x41e6ac
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
mov esi, eax
add esp, 0x18
mov dword [ebp - 0x10], esi
test esi, esi
jne 0x402069
xor eax, eax
jmp 0x402103
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
mov ebx, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_rewind]
lea ecx, [ebx + 1]
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push esi
push ebx
mov edi, eax
push 1
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 0x2c
cmp esi, ebx
je 0x4020b7
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
jmp 0x402062
lea ecx, [ebp - 0x100]
call fcn.0040165c
push ebx
push edi
lea ecx, [ebp - 0x100]
call fcn.00402128
lea eax, [ebp - 0x18]
mov byte [edi + ebx], 0
push eax
call fcn.00403765
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push edi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_char_StrTraitMFC_DLL_char_ATL::ChTraitsCRT_char__3]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
lea eax, [esi + 1]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret