Function at 0x402570
Capabilities:
Create process on windows
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4285c0
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
push edi
mov esi, ecx
push str.User32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov dword [esi + 0x1dc], eax
cmp eax, ebx
je 0x402b71
push str.UpdateLayeredWindow
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x1e0], eax
mov byte [esi + 0x68], bl
mov byte [esi + 0x69], bl
mov byte [esi + 0x6b], 1
mov byte [esi + 0x6a], 0xff
mov dword [esi + 0x64], ebx
mov dword [esi + 0x88], 0xa
mov dword [esi + 0x70], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], 0x64
push 0x438834
lea ecx, [esi + 0xa0]
mov dword [esi + 0x8c], ebx
call fcn.00420bb1
push 0x4342cc
lea ecx, [esi + 0x98]
mov dword [esi + 0x17c], ebx
call fcn.00420bb1
push str.adsanguo.exe
lea ecx, [esi + 0x9c]
call fcn.00420bb1
push 0x4342b8
lea ecx, [esi + 0x94]
call fcn.00420bb1
push 0x438834
lea ecx, [esi + 0x5c]
call fcn.00420bb1
lea edi, [esi + 0xa8]
push 0x100
push 0x100
mov ecx, edi
call fcn.00420e31
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00420e80
push 0x4341e4
mov ecx, edi
call fcn.0041bd95
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.0041bcfb
push eax
mov ecx, edi
mov dword [esp + 0x50], ebx
call fcn.00420b61
lea ecx, [esp + 0x20]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00420a28
lea ecx, [esp + 0x28]
call fcn.00405ea8
push str.Program_Filesyxdownyxdownmodule.exe
lea ecx, [esp + 0x24]
push edi
push ecx
mov dword [esp + 0x58], 1
call fcn.00420cbd
mov eax, dword [eax]
push ebx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 2
call fcn.00405f6b
lea ecx, [esp + 0x20]
mov ebp, eax
mov byte [esp + 0x4c], 1
call fcn.00420a28
cmp ebp, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
je 0x402745
push ebx
mov ecx, esi
call fcn.004039e0
push str.Program_Filesyxdownyxdownmodule.exe
lea edx, [esp + 0x24]
push edi
push edx
call fcn.00420cbd
mov eax, dword [eax]
push 1
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 0x20]
call fcn.00420a28
lea eax, [esp + 0x24]
mov dword [esi + 0x90], 1
push eax
push ebx
push esi
push 0x402110
push ebx
push ebx
call ebp
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [esp + 0x24]
push ecx
push ebx
push ebx
push 0x401fa0
push ebx
push ebx
call ebp
mov dword [esi + 0x70], eax
mov edx, dword [0x434900]
mov dword [esp + 0x10], edx
push 0x100
lea ecx, [esp + 0x14]
mov byte [esp + 0x50], 3
call fcn.00420e31
push eax
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00420e80
mov edi, dword [esp + 0x10]
push 0x100
lea ecx, [esp + 0x14]
call fcn.00420e31
push eax
push ebx
push 0x43428c
push edi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00420e80
push ecx
lea eax, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.0042079d
push 0x434288
push 0x8d
call fcn.00401a20
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push ecx
call dword [sym.imp.USER32.dll_LoadCursorFromFileA]
mov edx, dword [esp + 0x10]
mov dword [esi + 0x74], eax
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esi + 0x18c]
push eax
push 0x434284
push 0x83
call fcn.00401b40
lea eax, [esi + 0x180]
push eax
push 0x434284
push 0x8e
call fcn.00401b40
lea ebp, [esi + 0x188]
push ebp
push 0x434284
push 0x88
call fcn.00401b40
lea edi, [esi + 0x184]
push edi
push 0x434284
push 0x90
call fcn.00401b40
lea ecx, [esi + 0x190]
push ecx
push 0x434284
push 0x91
call fcn.00401b40
mov eax, dword [edi]
add esp, 0x3c
cmp eax, ebx
mov dword [esp + 0x20], eax
je 0x4028b4
mov eax, dword [eax + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x40288b
mov ecx, dword [esp + 0x20]
mov dword [ecx + 8], eax
mov edi, dword [edi]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], edx
mov ecx, dword [edi + 4]
push eax
push ecx
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x4028ae
mov dword [edi + 8], eax
mov eax, dword [esp + 0x18]
jmp 0x4028b8
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 2
push eax
push ecx
push ebx
mov dword [esi + 0x7c], ecx
push ebx
push ebx
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.0042010c
mov eax, dword [esi + 0x7c]
mov edi, 4
mov dword [esi + 0xc0], edi
mov dword [esi + 0xb0], edi
mov edi, dword [ebp]
lea ecx, [eax - 0x1d]
mov dword [esi + 0xbc], ecx
add ecx, 9
mov edx, 0xe
add eax, 0xffffffd3
cmp edi, ebx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xc8], edx
mov dword [esi + 0xac], eax
mov dword [esi + 0xb4], ecx
mov dword [esi + 0xb8], edx
je 0x402980
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x402936
mov dword [edi + 8], eax
mov ebp, dword [ebp]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], ebx
mov edx, dword [ebp + 4]
push edx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x402952
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
add eax, 0xa
add ecx, 0x28
mov dword [esi + 0xec], 0xa
mov dword [esi + 0xf0], 0x28
mov dword [esi + 0xf4], eax
mov dword [esi + 0xf8], ecx
mov edi, dword [esi + 0x18c]
cmp edi, ebx
je 0x402a29
mov eax, dword [edi + 4]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x4029a7
mov dword [edi + 8], eax
mov eax, dword [esi + 0x7c]
mov ecx, dword [esp + 0x18]
mov edi, dword [esi + 0x18c]
mov dword [esi + 0xd0], 0x9b
cdq
sub eax, edx
lea edx, [esp + 0x18]
shr ecx, 1
sar eax, 1
sub eax, ecx
push edx
mov dword [esi + 0xcc], eax
mov eax, dword [edi + 4]
push eax
mov dword [esp + 0x20], ebx
call sub.gdiplus.dll_GdipGetImageWidth
cmp eax, ebx
je 0x4029e6
mov dword [edi + 8], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0xcc]
mov edi, dword [esi + 0x18c]
add ecx, eax
mov dword [esi + 0xd4], ecx
lea edx, [esp + 0x1c]
mov eax, dword [edi + 4]
push edx
push eax
mov dword [esp + 0x24], ebx
call sub.gdiplus.dll_GdipGetImageHeight
cmp eax, ebx
je 0x402a17
mov dword [edi + 8], eax
mov ecx, dword [esi + 0xd0]
mov eax, dword [esp + 0x1c]
add ecx, eax
mov dword [esi + 0xd8], ecx
lea edx, [esi + 0x118]
mov ecx, 0x12a
mov dword [esp + 0x20], edx
lea edx, [esi + 0x114]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ebx
lea eax, [esi + 0x110]
lea edx, [esi + 0x10c]
mov ebp, dword [esp + 0x14]
mov dword [edx], ebx
mov dword [eax], ecx
mov edi, dword [esi + 0x7c]
mov dword [ebp], edi
mov ebp, dword [eax]
mov edi, dword [esp + 0x20]
add ebp, 0x1e
mov dword [edi], ebp
mov ebp, dword [esp + 0x18]
cmp ebp, 2
jne 0x402a8b
mov ebp, dword [esp + 0x14]
add eax, 0x10
add ebp, 0x10
add edx, 0x10
add edi, 0x10
mov dword [esp + 0x14], ebp
add ecx, 0x25
mov ebp, dword [esp + 0x18]
add ecx, 0x1e
inc ebp
add edi, 0x10
mov dword [esp + 0x18], ebp
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x20], edi
mov edi, dword [esp + 0x18]
add eax, 0x10
add edx, 0x10
add ebp, 0x10
cmp edi, 6
mov dword [esp + 0x14], ebp
jl 0x402a52
mov eax, dword [esi + 0x7c]
mov dword [esi + 0xfc], ebx
mov dword [esi + 0x104], eax
mov dword [esi + 0x144], eax
lea ecx, [eax - 0x122]
add eax, 0xfffffff6
mov dword [esi + 0xdc], ecx
mov ecx, esi
mov dword [esi + 0x100], 0x10b
mov dword [esi + 0x108], 0x129
mov dword [esi + 0x13c], ebx
mov dword [esi + 0x140], 0x18b
mov dword [esi + 0x148], 0x1a9
mov dword [esi + 0xe0], 0x23
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], 0x5f
call fcn.00403ee0
lea edx, [esp + 0x24]
push edx
push ebx
push esi
push 0x402110
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esp + 0x10]
mov byte [esp + 0x4c], 1
call fcn.00420a28
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], 0xffffffff
call fcn.00405ee5
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret
push ebx
push ebx
push str.User32.dll_ERROR_
call fcn.00424059
push ebx
call fcn.0040dba8
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push esi
mov esi, ecx
call fcn.0041d943
cmp eax, 0xffffffff
jne 0x402ba3
or eax, eax
pop esi
ret 4
mov ecx, esi
call fcn.00402570
xor eax, eax
pop esi
ret 4