Function at 0x40e240
Capabilities:
Create process on windows
Delete file
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x435dd0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a8
mov eax, dword [0x4472e0]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x43a37c
lea ecx, [esi + 0xf4]
mov dword [esp + 0x4b8], eax
mov dword [esi + 0x170], 2
call fcn.0042b74f
lea ecx, [esp + 0x68]
call fcn.0040e0a0
mov dword [esp + 0x4c0], 0
call fcn.004276cb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4c0], 1
call fcn.004276cb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x4c0], 2
call fcn.004276cb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
mov byte [esp + 0x4c4], 3
call fcn.0040b850
push str.update_
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x4cc], 4
call fcn.00401bf0
add esp, 0xc
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 6
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e339
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.ecpver.xml
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00401bf0
add esp, 0xc
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.00411b68
push 3
push 0x43a364
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c8], 8
call fcn.00404330
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x2b0]
push 0x43a0f0
push eax
call fcn.0041a23c
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0040b850
push 0
lea edx, [esp + 0x2b0]
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0x4c8], 9
call fcn.00411bfb
test eax, eax
mov ebp, dword [esp + 0x24]
je 0x40e635
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea esp, [esp]
lea ecx, [esp + 0x38]
call fcn.00411a5f
lea ecx, [esp + 0x38]
mov dword [esp + 0x34], eax
call fcn.00411b2f
test eax, eax
jne 0x40e629
mov eax, dword [esp + 0x38]
push 0x10
lea ecx, [esp + 0x3c]
call dword [eax + 0x38]
test eax, eax
je 0x40e629
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00411cf3
mov eax, dword [eax]
push 0x43a164
push eax
call fcn.0041a6e2
mov ebx, eax
mov eax, dword [esp + 0x18]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40e447
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
lea ecx, [esp + 0x38]
je 0x40e475
lea eax, [esp + 0x60]
push eax
call fcn.00411d84
mov eax, dword [eax]
push ebp
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xa
call fcn.0040d680
mov eax, dword [esp + 0x60]
jmp 0x40e607
lea eax, [esp + 0x58]
push eax
call fcn.00411cf3
mov eax, dword [eax]
push str.system32
push eax
call fcn.0041a6e2
mov ebx, eax
mov eax, dword [esp + 0x60]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e4b5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x40e4fa
push 1
push 0x25
lea eax, [esp + 0xac]
push eax
push 0
call edi
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00411d84
mov eax, dword [eax]
lea edx, [esp + 0xa4]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xb
call fcn.0040d680
mov eax, dword [esp + 0x50]
jmp 0x40e607
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
call fcn.00411cf3
mov eax, dword [eax]
push str.My_Documents
push eax
call fcn.0041a6e2
mov ebx, eax
mov eax, dword [esp + 0x5c]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e53e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x40e583
push 1
push 5
lea eax, [esp + 0x1b0]
push eax
push 0
call edi
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00411d84
mov eax, dword [eax]
lea edx, [esp + 0x1a8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xc
call fcn.0040d680
mov eax, dword [esp + 0x64]
jmp 0x40e607
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
call fcn.00411cf3
mov eax, dword [eax]
push str.WINDOWS
push eax
call fcn.0041a6e2
mov ebx, eax
mov eax, dword [esp + 0x30]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e5c7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x40e629
push 1
push 0x24
lea eax, [esp + 0x3b8]
push eax
push 0
call edi
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00411d84
mov eax, dword [eax]
lea edx, [esp + 0x3b0]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xd
call fcn.0040d680
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e629
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x40e3d0
mov edi, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x6c]
call fcn.004053d0
test al, al
jne 0x40e69c
push 0
push 0x437690
push 0x43a354
mov ecx, esi
call fcn.00428f30
mov ecx, esi
call fcn.0040d450
lea eax, [ebp - 0x10]
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e683
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.00411b8c
lea eax, [edi - 0x10]
jmp 0x40e8b1
push 0x43a164
lea ecx, [esp + 0x6c]
call fcn.00403f60
test al, al
je 0x40ea74
lea ecx, [esp + 0x68]
call fcn.00403560
push str.ModuleList
lea ecx, [esp + 0x6c]
call fcn.00403f60
test al, al
je 0x40ea6b
lea ecx, [esp + 0x68]
call fcn.00403560
push str.Module
lea ecx, [esp + 0x6c]
call fcn.00403f60
test al, al
je 0x40ea62
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esp, [esp]
push str.ModuleName
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x70]
call fcn.0040afc0
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c4], 0xe
call fcn.00401b80
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e74b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.RelativeDirectory
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x70]
call fcn.0040afc0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c4], 0xf
call fcn.00401b80
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e796
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.Type
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x70]
call fcn.0040afc0
mov eax, dword [eax]
push eax
call fcn.0041a31c
mov edi, eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e7d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0040b290
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0040c2d0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0040b410
add esp, 0xc
lea eax, [edi - 1]
cmp eax, 3
mov byte [esp + 0x4c0], 0x10
ja case.default.0x40e819
jmp dword [eax*4 + 0x40eba0]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0040b5f0
test eax, eax
jne case.default.0x40e819
push eax
push 0x437690
push 0x43a308
mov ecx, esi
call fcn.00428f30
mov ecx, esi
call fcn.0040d450
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e873
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e899
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.00411b8c
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e8d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e8f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e91c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e942
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40e968
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x68]
mov dword [esp + 0x4c0], 0xffffffff
call fcn.0040e150
xor eax, eax
jmp 0x40eb7a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push ecx
push str.open
push eax
call ebx
jmp case.default.0x40e819
lea edx, [esp + 0x10]
push edx
call fcn.0040fc70
add esp, 4
test eax, eax
je case.default.0x40e819
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push ecx
push str.open
push eax
call ebx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0040c060
cmp eax, 0xffffffff
je 0x40e9fb
push eax
push 0
push 0x1f0fff
call ebp
mov edi, eax
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x40e9fb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
jmp 0x40ea18
lea ecx, [esp + 0x10]
push ecx
call fcn.0040fc70
add esp, 4
test eax, eax
je case.default.0x40e819
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ea44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.Module
lea ecx, [esp + 0x6c]
call fcn.00403f60
test al, al
jne 0x40e700
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
lea ecx, [esp + 0x68]
call fcn.00403c40
lea ecx, [esp + 0x68]
call fcn.00403c40
lea eax, [ebp - 0x10]
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ea96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.00411b8c
lea eax, [edi - 0x10]
mov byte [esp + 0x4c0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eac9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eaef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eb15
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eb3b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40eb61
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x68]
mov dword [esp + 0x4c0], 0xffffffff
call fcn.0040e150
mov eax, 1
mov ecx, dword [esp + 0x4b8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4a8]
pop ebx
call fcn.00419e6b
add esp, 0x4b4
ret