Function at 0x40ad40
Capabilities:
Create process on windows
Delete file
Get common file path
Move file
Read .ini file

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x445276
push eax
mov eax, 0x8684
mov dword fs:[0], esp
call fcn.0042d040
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0xc8]
test eax, eax
jne 0x40b0b7
lea eax, [esi + 0x100]
mov ebx, 1
push eax
lea ecx, [esp + 0x14]
mov dword [esi + 0xc8], ebx
call fcn.0043bc97
add esi, 0x104
lea ecx, [esp + 0x14]
push esi
mov dword [esp + 0x86a0], 0
call fcn.0043bc97
lea ecx, [esp + 0x10]
mov byte [esp + 0x869c], bl
push ecx
call fcn.00411690
lea edx, [esp + 0x18]
push edx
call fcn.00411690
lea eax, [esp + 0x1c]
push eax
call fcn.00410a10
mov eax, dword [esp + 0x86b0]
add esp, 0xc
test eax, eax
je 0x40af25
call fcn.00410630
test ah, 0xff
je 0x40ae0b
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 4
push 0
push ecx
call esi
mov edx, dword [esp + 0x14]
push 4
push 0
push edx
call esi
jmp 0x40b092
lea eax, [esp + 0x8c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x8c]
push str.wininit.ini
push ecx
call ebp
mov ecx, 0x1fff
xor eax, eax
lea edi, [esp + 0x694]
mov edx, dword [str.rename]
rep stosd dword es:[edi], eax
mov cl, byte [0x45279a]
mov dword [esp + 0x18], edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x452798]
lea edx, [esp + 0x8c]
mov word [esp + 0x1c], ax
mov byte [esp + 0x1e], cl
push edx
lea eax, [esp + 0x698]
push 0x7fff
lea ecx, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov al, byte [esp + 0x694]
lea esi, [esp + 0x694]
test al, al
je 0x40aea3
mov dl, byte [esi]
inc esi
test dl, dl
jne 0x40ae97
cmp byte [esi], 0
jne 0x40ae97
push str.NUL
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x10]
push eax
push esi
call ebp
push 0x452788
push esi
call ebp
push str.DIRNUL
push esi
call ebp
mov ecx, dword [esp + 0x14]
push ecx
push esi
call ebp
push 0x452788
push esi
call ebp
push 0x456b00
push esi
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [esp + 0x8c]
push edx
push 0
push 0
push 0
call esi
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x694]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea eax, [esp + 0x8c]
push eax
push 0
push 0
push 0
call esi
jmp 0x40b092
lea ecx, [esp + 0x8c]
push ecx
push 0xf6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40b092
lea edx, [esp + 0x190]
lea eax, [esp + 0x8c]
push edx
push 0
push str._mdel
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x40b092
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x190]
push 0x80
push ecx
push edx
call fcn.00410e80
add esp, 0xc
lea eax, [esp + 0x190]
push 0
push 0x4000000
push 3
push 0
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40b092
mov ecx, 5
mov esi, str._MInst_Remove_Event_
lea edi, [esp + 0x30]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push ecx
push 0
push ebx
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ebx, eax
test ebx, ebx
jne 0x40afd9
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b092
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x30]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [esp + 0x1a0]
push str.__remove
push edx
lea eax, [esp + 0x2ac]
push str.__s___s__lu___s____s____s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x68]
add esp, 0x20
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x24], ecx
push edx
mov dword [esp + 0x2c], ecx
push eax
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x94]
push ecx
push 0
push 0x200
push 0
push 0
lea edx, [esp + 0x2b0]
push 0
push edx
push 0
mov dword [esp + 0x70], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40b08c
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x20]
push eax
call esi
mov ecx, dword [esp + 0x24]
push ecx
call esi
push ebx
call esi
push ebp
call esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x869c], 0
call fcn.0043bf22
lea ecx, [esp + 0x10]
mov dword [esp + 0x869c], 0xffffffff
call fcn.0043bf22
mov ecx, dword [esp + 0x8694]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x8690
ret 4