Function at 0x4014c0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4109a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1f4
mov eax, dword [0x41900c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 0x5c
push dword [edi]
call fcn.00405360
push 0
mov byte [eax], 0
call fcn.00407a9f
push eax
call fcn.00407a0e
call fcn.004079ed
push 0xa
push 0x14
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00407bb5
add esp, 0x20
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x41691c
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push 0xb5
push str.__enable_features_dns_over_https_DoHTrial____force_fieldtrials_DoHTrial_Group1____force_fieldtrial_params_DoHTrial.Group1:server_https_3A_2F_2F223.5.5.5_2Fdns_query_method_POST_
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x144], 0xf
mov esi, eax
mov dword [ebp - 0x148], 0
mov byte [ebp - 0x158], 0
call fcn.00402180
mov dword [ebp - 4], 0
test esi, esi
je 0x4018f3
cmp byte [ebp - 0x128], 0
mov dword [ebp - 0x15c], 0xf
mov dword [ebp - 0x160], 0
mov byte [ebp - 0x170], 0
jne 0x4015ab
xor ecx, ecx
jmp 0x4015bd
lea ecx, [ebp - 0x128]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4015b4
sub ecx, edx
push ecx
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x170]
call fcn.00402180
push 0xa
push str.YunQueMU_
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 1
call fcn.004024a0
push 0
push 0x4168d8
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x12c], 0xf
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x140], 0
call fcn.00402180
mov esi, 1
mov byte [ebp - 4], 2
cmp esi, 0x64
je 0x401920
mov edx, esi
lea ecx, [ebp - 0x1d0]
call fcn.00401370
push eax
lea edx, [ebp - 0x170]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b8]
call fcn.004031a0
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a0]
call fcn.004031d0
add esp, 4
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x1a4]
cmp eax, 0x10
jb 0x4016ac
mov ecx, dword [ebp - 0x1b8]
inc eax
cmp eax, 0x1000
jb 0x4016a3
test cl, 0x1f
jne 0x401852
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x401852
sub ecx, eax
cmp ecx, 4
jb 0x401852
cmp ecx, 0x23
ja 0x401852
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov dword [ebp - 0x1a4], 0xf
mov dword [ebp - 0x1a8], 0
mov byte [ebp - 0x1b8], 0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x1bc]
cmp eax, 0x10
jb 0x401717
mov ecx, dword [ebp - 0x1d0]
inc eax
cmp eax, 0x1000
jb 0x40170e
test cl, 0x1f
jne 0x401852
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x401852
sub ecx, eax
cmp ecx, 4
jb 0x401852
cmp ecx, 0x23
ja 0x401852
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
cmp dword [ebp - 0x18c], 0x10
lea eax, [ebp - 0x1a0]
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1bc], 0xf
cmovae eax, dword [ebp - 0x1a0]
push eax
mov dword [ebp - 0x1c0], 0
mov byte [ebp - 0x1d0], 0
call fcn.00403200
lea ecx, [ebp - 0x1e8]
call fcn.00401390
test al, al
mov eax, dword [ebp - 0x1d4]
sete bl
cmp eax, 8
jb 0x401780
inc eax
lea ecx, [ebp - 0x1e8]
push eax
push dword [ebp - 0x1e8]
call fcn.00402700
test bl, bl
jne 0x40179f
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 2
call fcn.00401c40
inc esi
cmp esi, 0x64
jl 0x401625
jmp 0x4017f6
mov edx, esi
lea ecx, [ebp - 0x200]
call fcn.00401370
push eax
lea edx, [ebp - 0x170]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1e8]
call fcn.004031a0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
call fcn.00401cb0
lea ecx, [ebp - 0x1e8]
call fcn.00401c40
lea ecx, [ebp - 0x200]
call fcn.00401c40
lea ecx, [ebp - 0x1a0]
mov byte [ebp - 4], 2
call fcn.00401c40
push 0x11
push str.__user_data_dir_
lea ecx, [ebp - 0x158]
call fcn.004024a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x158]
call fcn.00402590
push 1
push 0x416a28
lea ecx, [ebp - 0x158]
call fcn.004024a0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x401884
mov ecx, dword [ebp - 0x140]
inc eax
cmp eax, 0x1000
jb 0x40187b
test cl, 0x1f
je 0x401857
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x401863
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x40186f
call fcn.0040799d
cmp ecx, 0x23
jbe 0x401879
call fcn.0040799d
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x12c], 0xf
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x140], 0
cmp eax, 0x10
jb 0x4018f3
mov ecx, dword [ebp - 0x170]
inc eax
cmp eax, 0x1000
jb 0x4018ea
test cl, 0x1f
je 0x4018c6
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4018d2
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x4018de
call fcn.0040799d
cmp ecx, 0x23
jbe 0x4018e8
call fcn.0040799d
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov edx, dword [edi]
mov dword [ebp - 0x174], 0xf
mov dword [ebp - 0x178], 0
mov byte [ebp - 0x188], 0
cmp byte [edx], 0
jne 0x401a5b
xor ecx, ecx
jmp 0x401a69
push 1
push 0x4168d8
push 0x4169f4
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x401984
mov ecx, dword [ebp - 0x140]
inc eax
cmp eax, 0x1000
jb 0x40197b
test cl, 0x1f
je 0x401957
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x401963
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x40196f
call fcn.0040799d
cmp ecx, 0x23
jbe 0x401979
call fcn.0040799d
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x12c], 0xf
mov dword [ebp - 0x130], 0
mov byte [ebp - 0x140], 0
cmp eax, 0x10
jb 0x4019ef
mov ecx, dword [ebp - 0x170]
inc eax
cmp eax, 0x1000
jb 0x4019e6
test cl, 0x1f
je 0x4019c2
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x4019ce
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x4019da
call fcn.0040799d
cmp ecx, 0x23
jbe 0x4019e4
call fcn.0040799d
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov dword [ebp - 0x15c], 0xf
mov dword [ebp - 0x160], 0
mov byte [ebp - 0x170], 0
mov eax, dword [ebp - 0x144]
cmp eax, 0x10
jb 0x401b48
mov ecx, dword [ebp - 0x158]
inc eax
cmp eax, 0x1000
jb 0x401b3f
test cl, 0x1f
je 0x401a35
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x401a41
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x401a4d
call fcn.0040799d
cmp ecx, 0x23
jbe 0x401b3d
call fcn.0040799d
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a60
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x188]
call fcn.00402180
push 0x10
push 0x416a2c
lea ecx, [ebp - 0x188]
mov byte [ebp - 4], 9
call fcn.004024a0
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x158]
push eax
lea ecx, [ebp - 0x188]
call fcn.00402590
cmp dword [ebp - 0x144], 0x10
lea eax, [ebp - 0x158]
push 1
push dword [edi]
cmovae eax, dword [ebp - 0x158]
push eax
push str.yunque_run.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x174]
cmp eax, 0x10
jb 0x401b1d
mov ecx, dword [ebp - 0x188]
inc eax
cmp eax, 0x1000
jb 0x401b14
test cl, 0x1f
je 0x401af0
call fcn.0040799d
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x401afc
call fcn.0040799d
sub ecx, eax
cmp ecx, 4
jae 0x401b08
call fcn.0040799d
cmp ecx, 0x23
jbe 0x401b12
call fcn.0040799d
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
mov dword [ebp - 0x174], 0xf
mov dword [ebp - 0x178], 0
mov byte [ebp - 0x188], 0
jmp 0x401a0a
mov ecx, eax
push ecx
call fcn.004038b6
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00403864
mov esp, ebp
pop ebp
ret