Function at 0x40d9a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x1038
call fcn.0043a050
mov eax, dword [0x4677a0]
xor eax, esp
mov dword [esp + 0x1034], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0xc30]
push eax
push 0
push 0
push 0x8010
mov esi, ecx
push 0
mov dword [esp + 0x20], esi
call edi
lea eax, [esp + 0xc30]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40d9e6
sub eax, edx
sar eax, 1
mov ebx, 0x5c
cmp word [esp + eax*2 + 0xc2e], bx
je 0x40da43
mov ecx, 0x104
lea eax, [esp + 0xc30]
cmp word [eax], 0
je 0x40da20
add eax, 2
sub ecx, 1
jne 0x40da10
jmp 0x40da43
test ecx, ecx
je 0x40da43
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0xc30]
mov eax, 0x457ff4
call fcn.00407450
lea ecx, [esp + 0xa28]
push ecx
push 0
push 0
push 0x8017
push 0
call edi
lea eax, [esp + 0xa28]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40da62
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0xa26], bx
je 0x40daba
mov ecx, 0x104
lea eax, [esp + 0xa28]
cmp word [eax], 0
je 0x40da97
add eax, 2
sub ecx, 1
jne 0x40da87
jmp 0x40daba
test ecx, ecx
je 0x40daba
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [esp + eax*2 + 0xa28]
mov eax, 0x457ff4
call fcn.00407450
lea ecx, [esp + 0xe38]
mov edi, 0x46bee4
call fcn.0040fbd0
test dword [esi + 0xe0c], 0x19e0
je 0x40dec9
push ebp
lea ebp, [esi + 0x8c]
push ebp
lea edx, [esp + 0xa30]
push edx
push str._s_s_
mov ecx, 0x104
lea ebx, [esp + 0x428]
call fcn.00402d10
call fcn.00409760
lea edi, [esi + 0x3bb4]
push edi
push str._sconfig.exe
mov ecx, 0x104
lea ebx, [esp + 0x638]
call fcn.00402d10
add esp, 0x14
test byte [esi + 0xe0c], 0x80
je 0x40dba7
push ebp
push 0x45cb68
mov ecx, 0x100
lea ebx, [esp + 0x1c]
call fcn.00402d10
push ebp
lea eax, [esp + 0x428]
push eax
push 0x45c030
mov ecx, 0x104
lea ebx, [esp + 0x228]
call fcn.00402d10
add esi, 0x3340
push esi
push str._n__s
mov ecx, 0x100
lea ebx, [esp + 0x848]
call fcn.00402d10
mov ecx, ebx
push ecx
push edi
lea edx, [esp + 0x238]
push edx
lea eax, [esp + 0x3c]
push eax
xor ebx, ebx
xor esi, esi
lea edi, [esp + 0x650]
call fcn.0040b9a0
mov esi, dword [esp + 0x3c]
add esp, 0x2c
lea edi, [esi + 0x3bb4]
push edi
push 0x458488
mov ecx, 0x104
lea ebx, [esp + 0x62c]
call fcn.00402d10
add esp, 8
test byte [esi + 0xe0c], 0x20
je 0x40dc4b
push ebp
push 0x45cb90
mov ecx, 0x100
lea ebx, [esp + 0x1c]
call fcn.00402d10
push ebp
lea ecx, [esp + 0x428]
push ecx
push 0x45c048
mov ecx, 0x104
lea ebx, [esp + 0x228]
call fcn.00402d10
add esi, 0x3340
push esi
push str._n__s__g
mov ecx, 0x100
lea ebx, [esp + 0x848]
call fcn.00402d10
mov edx, ebx
push edx
push edi
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ebx, 3
xor esi, esi
lea edi, [esp + 0x650]
call fcn.0040b9a0
mov esi, dword [esp + 0x3c]
add esp, 0x2c
lea edi, [esi + 0x3bb4]
push edi
push 0x458488
mov ecx, 0x104
lea ebx, [esp + 0x62c]
call fcn.00402d10
add esp, 8
test dword [esi + 0xe0c], 0x1000
je 0x40dcf2
push ebp
push 0x45cbc4
mov ecx, 0x100
lea ebx, [esp + 0x1c]
call fcn.00402d10
push ebp
lea edx, [esp + 0x428]
push edx
push 0x45c060
mov ecx, 0x104
lea ebx, [esp + 0x228]
call fcn.00402d10
add esi, 0x3340
push esi
push str._n__s__r
mov ecx, 0x100
lea ebx, [esp + 0x848]
call fcn.00402d10
mov eax, ebx
push eax
push edi
lea ecx, [esp + 0x238]
push ecx
lea edx, [esp + 0x3c]
push edx
mov ebx, 1
xor esi, esi
lea edi, [esp + 0x650]
call fcn.0040b9a0
mov esi, dword [esp + 0x3c]
add esp, 0x2c
test dword [esi + 0xe0c], 0x800
je 0x40dd83
push ebp
push 0x45cbf4
mov ecx, 0x100
lea ebx, [esp + 0x1c]
call fcn.00402d10
push ebp
lea eax, [esp + 0x428]
push eax
push 0x45c078
mov ecx, 0x104
lea ebx, [esp + 0x228]
call fcn.00402d10
lea ecx, [esi + 0x3340]
push ecx
push str._n__s__u
mov ecx, 0x100
lea ebx, [esp + 0x848]
call fcn.00402d10
mov edx, ebx
push edx
add esi, 0x3bb4
push esi
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ebx, 2
xor esi, esi
lea edi, [esp + 0x650]
call fcn.0040b9a0
mov esi, dword [esp + 0x3c]
add esp, 0x2c
test byte [esi + 0xe0c], 0x40
je 0x40de01
add esi, 0x3bb4
push esi
push str._smain.chm
mov ecx, 0x104
lea ebx, [esp + 0x62c]
call fcn.00402d10
push ebp
push 0x45cc18
mov ecx, 0x100
lea ebx, [esp + 0x24]
call fcn.00402d10
push ebp
lea edx, [esp + 0x430]
push edx
push 0x45c0b0
mov ecx, 0x104
lea ebx, [esp + 0x230]
call fcn.00402d10
push 0
push esi
mov eax, ebx
push eax
lea ecx, [esp + 0x3c]
push ecx
xor ebx, ebx
mov esi, 0x456818
lea edi, [esp + 0x650]
call fcn.0040b9a0
mov esi, dword [esp + 0x3c]
add esp, 0x2c
test dword [esi + 0xe0c], 0x100
je 0x40deae
lea edi, [esi + 0x3bb4]
push edi
push str._sconfig.exe
mov ecx, 0x104
lea ebx, [esp + 0x62c]
call fcn.00402d10
push ebp
push 0x45cc34
mov ecx, 0x100
lea ebx, [esp + 0x24]
call fcn.00402d10
push ebp
lea edx, [esp + 0x430]
push edx
push 0x45c090
mov ecx, 0x104
lea ebx, [esp + 0x230]
call fcn.00402d10
add esi, 0x3340
push esi
push str._n__s__do_anjianshezhi
mov ecx, 0x100
lea ebx, [esp + 0x850]
call fcn.00402d10
mov eax, ebx
push eax
push edi
lea ecx, [esp + 0x240]
push ecx
lea edx, [esp + 0x44]
push edx
mov ebx, 0x10
lea esi, [esp + 0xe70]
lea edi, [esp + 0x658]
call fcn.0040b9a0
mov esi, dword [esp + 0x44]
add esp, 0x34
push 0
lea eax, [esp + 0x420]
push eax
push 0x1005
push SysReAllocString
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop ebp
cmp word [esi + 0x9ae], 0
lea eax, [esi + 0x9ae]
je 0x40df2d
push eax
add esi, 0x3bb4
push esi
push 0x45c9f8
mov ecx, 0x104
lea ebx, [esp + 0x424]
call fcn.00402d10
mov ecx, ebx
push 0x45cc80
push ecx
call fcn.0043588c
add esp, 0x14
test eax, eax
je 0x40df13
xor edx, edx
mov word [eax], dx
add eax, 2
push 5
push 0
push eax
lea eax, [esp + 0x424]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1040]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00435010
add esp, 0x1038
ret