Function at 0x401660
Capabilities:
Create process on windows
Delete file
Read .ini file

Disassembly:
sub esp, 0x928
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x731]
mov byte [esp + 0x730], bl
mov byte [esp + 0x320], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x321]
mov byte [esp + 0x528], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x529]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x62c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x62d]
mov byte [esp + 0x21c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x424], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x425]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x940]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x324]
push eax
push ecx
call fcn.00401b10
lea edx, [esp + 0x320]
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x14]
push str.ColorPhoto.ini
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
push ebx
push str.FILEFROM
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, eax
cmp edi, ebx
je 0x4017b5
lea eax, [esp + 0x14]
lea ecx, [esp + 0x424]
push eax
push 0x104
push ecx
push 0x40a8f0
push str.CUSTSVRURL
jmp 0x4017d1
lea edx, [esp + 0x14]
lea eax, [esp + 0x424]
push edx
push 0x104
push eax
push 0x40a8f0
push str.SVRURL
push str.WEBINFO
call esi
lea ecx, [esp + 0x424]
push ecx
call fcn.00401b80
add esp, 4
test eax, eax
jne 0x401816
lea edx, [esp + 0x14]
push edx
push 0x408100
push str.RESULT
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x928
ret 0x10
lea eax, [esp + 0x320]
push eax
call sub.KRNLAPI.dll_Ordinal_1
test eax, eax
jne 0x401850
lea ecx, [esp + 0x14]
push ecx
push 0x4080f4
push str.RESULT
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x928
ret 0x10
lea edx, [esp + 0x14]
lea eax, [esp + 0x118]
push edx
push 0x104
push eax
push 0x40a8f0
push str.PHOTODIR
push str.WEBINFO
call esi
cmp edi, ebx
je 0x401895
lea ecx, [esp + 0x14]
lea edx, [esp + 0x62c]
push ecx
push 0x104
push edx
push 0x40a8f0
push str.PHOTOFROMWEB
jmp 0x4018b1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x62c]
push eax
push 0x104
push ecx
push 0x40a8f0
push str.PHOTONAME
push str.WEBINFO
call esi
lea edx, [esp + 0x320]
lea eax, [esp + 0x21c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x118]
lea edx, [esp + 0x21c]
push ecx
push edx
call ebp
lea eax, [esp + 0x62c]
lea ecx, [esp + 0x21c]
push eax
push ecx
call ebp
lea edx, [esp + 0x118]
lea eax, [esp + 0x320]
push edx
push eax
lea ecx, [esp + 0x530]
push str._s_sWebPhoto.jpg
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push ebx
push str.BEINFO
push str.MOBLIEINFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0x80
push 0x80
mov dword [esp + 0x18], eax
lea eax, [esp + 0x530]
lea ecx, [esp + 0x224]
push eax
push ecx
call fcn.00401000
test eax, eax
jne 0x4019ae
cmp dword [esp + 0x10], ebx
je 0x40196d
push ebx
push 0x40a8f0
push 0x408094
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call sub.KRNLAPI.dll_Ordinal_2
lea edx, [esp + 0x14]
push edx
push 0x4080f4
push str.RESULT
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp edi, ebx
je 0x40199e
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x928
ret 0x10
lea ecx, [esp + 0x14]
push ecx
push str.WEBINFO
push str.TYPE
push str.COMMON
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [esp + 0x424]
push str._sfile:____s
push edx
call ebp
cmp edi, ebx
je 0x4019f9
lea eax, [esp + 0x14]
lea ecx, [esp + 0x118]
push eax
push 0x104
push ecx
push 0x40a8f0
push str.CUSTWEBURL
jmp 0x401a15
lea edx, [esp + 0x14]
lea eax, [esp + 0x118]
push edx
push 0x104
push eax
push 0x40a8f0
push str.WEBURL
push str.WEBINFO
call esi
lea ecx, [esp + 0x528]
push ecx
call fcn.00401ae0
lea edx, [esp + 0x52c]
lea eax, [esp + 0x11c]
push edx
lea ecx, [esp + 0x42c]
push eax
lea edx, [esp + 0x73c]
push ecx
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push ebx
push str.OPENIE
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x401a86
push 1
push ebx
lea ecx, [esp + 0x738]
push ebx
push ecx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x401aa3
lea edx, [esp + 0x14]
lea eax, [esp + 0x730]
push edx
push eax
push str.SENDFILENAME
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x14]
push ecx
push 0x40803c
push str.RESULT
push str.WEBINFO
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
call sub.KRNLAPI.dll_Ordinal_2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x928
ret 0x10