Function at 0x40fd90
Capabilities:
Create process on windows
Get common file path
Print debug messages

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4593d6
push eax
mov dword fs:[0], esp
sub esp, 0x360
lea eax, [esp + 0x5c]
push ebx
push ebp
push esi
push edi
push eax
mov ebp, ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x6c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x6b], 0x5c
je 0x40fe04
mov edi, 0x4710f4
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x6c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x10]
push eax
call fcn.0043f002
xor ebx, ebx
push 0x5c
lea ecx, [esp + 0x14]
mov dword [esp + 0x37c], ebx
call fcn.0043c42b
cmp eax, ebx
jle 0x40fe5c
push eax
lea ecx, [esp + 0x18]
push ebx
push ecx
lea ecx, [esp + 0x1c]
call fcn.0043c24b
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x37c], 1
call fcn.0043f0cd
lea ecx, [esp + 0x14]
mov byte [esp + 0x378], bl
call fcn.0043ef94
push str.ChinaVnet
lea ecx, [esp + 0x14]
call fcn.0043f370
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x171]
mov byte [esp + 0x170], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x174]
push str._sSetup.exe
push eax
call fcn.0041dd35
mov edx, dword [0x476ee0]
add esp, 0xc
cmp edx, ebx
je 0x40ff13
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40ff13
mov edi, 0x473b20
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [esp + 0x170]
mov esi, edi
mov edi, ebx
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea ebx, [esp + 0x170]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor ebx, ebx
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x28]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea eax, [esp + 0x28]
mov dword [esp + 0x18], ecx
push edx
mov dword [esp + 0x20], ecx
push eax
push ebx
mov dword [esp + 0x2c], ecx
push ebx
push 0x20
mov dword [esp + 0x38], ecx
push ebx
push ebx
lea ecx, [esp + 0x18c]
push ebx
push ecx
push ebx
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40ff87
lea ecx, [esp + 0x10]
mov dword [esp + 0x378], 0xffffffff
call fcn.0043ef94
mov eax, 0xfffffffa
jmp 0x40ffbd
mov ecx, dword [ebp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push ebx
push 0x64
push 0x65
push ecx
mov dword [ebp + 0x5c], edx
mov dword [ebp + 0xd8], eax
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [esp + 0x10]
mov dword [esp + 0x378], 0xffffffff
call fcn.0043ef94
xor eax, eax
mov ecx, dword [esp + 0x370]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x36c
ret