Function at 0x4014e7
Capabilities:
Get common file path
Read file on windows
Reference http user-agent string

Disassembly:
mov eax, 0x45004d
call fcn.0044f20c
sub esp, 0xee4
push ebx
call fcn.00406268
xor ebx, ebx
push 0x9ff
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0xeef]
push ebx
push eax
mov byte [ebp - 0xef0], bl
call fcn.0043c7f0
add esp, 0xc
call fcn.00401290
mov dword [ebp - 0x10], eax
cmp eax, ebx
jne 0x401553
push 0x100010
push 0x45eba4
push 0x45ebb0
push dword [0x464bf8]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
jmp 0x40189a
push esi
push edi
xor eax, eax
push 0x40e
mov word [ebp - 0x4f0], ax
lea eax, [ebp - 0x4ee]
push ebx
push eax
call fcn.0043c7f0
add esp, 0xc
lea eax, [ebp - 0x4f0]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x4f0]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x40], ebx
call fcn.00402ad9
mov eax, str._wp_content_Helper_GetESETConfig.php
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], ebx
call fcn.004027e3
mov edi, eax
mov eax, str.araznod.ir
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 1
call fcn.004027e3
mov esi, eax
mov eax, str.https:__
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.004027e3
mov ecx, eax
mov eax, esi
lea esi, [ebp - 0xe0]
mov byte [ebp - 4], 3
call fcn.004033f6
mov ecx, eax
mov eax, edi
lea esi, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.004033f6
push 1
xor edi, edi
lea esi, [ebp - 0xe0]
call fcn.00402a08
push 1
lea esi, [ebp - 0xc4]
call fcn.00402a08
push 1
lea esi, [ebp - 0x8c]
call fcn.00402a08
push 1
lea esi, [ebp - 0xa8]
mov byte [ebp - 4], 9
call fcn.00402a08
mov eax, str.version
lea ecx, [ebp - 0x34]
call fcn.004027e3
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff8
mov byte [ebp - 4], 0xa
cmp eax, 9
ja case.default.0x40165f
jmp dword [eax*4 + 0x401963]
push str.confESS8.xml
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ec90
lea eax, [ebp - 0x34]
push eax
call fcn.00402872
push str.Username
lea eax, [ebp - 0x34]
push eax
call fcn.00402872
push 0x464c00
jmp 0x401732
push str.confESS9.xml
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ecbc
jmp 0x401716
push str.confESS10.xml
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ece8
jmp 0x401716
push 0x45ecec
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ed08
jmp 0x401716
push 0x45ed0c
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ed28
jmp 0x401716
push 0x45ed2c
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ed48
jmp 0x401716
push 0x45ed4c
lea eax, [ebp - 0x50]
push eax
call fcn.00402976
push 0x45ed68
lea eax, [ebp - 0x34]
push eax
call fcn.00402872
push str.License
lea eax, [ebp - 0x34]
push eax
call fcn.00402872
push 0x464e10
lea eax, [ebp - 0x34]
push eax
call fcn.00402872
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x50]
mov edi, 0x463818
call fcn.00402a43
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x401757
lea eax, [ebp - 0x50]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call edi
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
je 0x401876
mov esi, dword [ebp - 0x14]
cmp esi, ebx
je 0x401952
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x70]
jae 0x401798
lea eax, [ebp - 0x70]
push eax
push 0x2712
push esi
call fcn.004061a6
push 0x19
push 0xd
push esi
call fcn.004061a6
push 1
push 0x2d
push esi
call fcn.004061a6
push ebx
push 0x51
push esi
call fcn.004061a6
push ebx
push pe_nt_image_headers32
push esi
call fcn.004061a6
push ebx
push 0x40
push esi
call fcn.004061a6
add esp, 0x48
push 1
push 0x34
push esi
call fcn.004061a6
lea eax, [ebp - 0xef0]
push eax
push 0x271a
push esi
call fcn.004061a6
push dword [ebp - 0x10]
push 0x2711
push esi
call fcn.004061a6
push 0x4014c0
push 0x4e2b
push esi
call fcn.004061a6
push str.Mozilla_5.0__Windows_NT_6.1__WOW64__rv:40.0__Gecko_20100101_Firefox_40.1
push 0x2722
push esi
call fcn.004061a6
push dword [ebp - 0x14]
push 0x3c
push esi
call fcn.004061a6
mov eax, dword [ebp - 0x34]
add esp, 0x48
cmp dword [ebp - 0x20], 0x10
jae 0x40183d
lea eax, [ebp - 0x34]
push eax
push 0x271f
push esi
call fcn.004061a6
push 0x80000
push 0x62
push esi
call fcn.004061a6
add esp, 0x18
mov dword [ebp - 0x14], ebx
push esi
call fcn.0040641b
pop ecx
test eax, eax
je 0x401870
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x40185c
cmp dword [ebp - 0x14], 2
jle 0x4018a7
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00402a08
push 1
lea esi, [ebp - 0x70]
call fcn.00402a08
push 1
lea esi, [ebp - 0x50]
call fcn.00402b66
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
cmp dword [ebp - 0x10], ebx
je 0x4018b5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x3c], 8
mov eax, dword [ebp - 0x50]
jae 0x4018c1
lea eax, [ebp - 0x50]
push ebx
push 0x80
push 4
push ebx
push ebx
push bind
push eax
call edi
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x4018ff
push 1
xor edi, edi
lea esi, [ebp - 0x34]
call fcn.00402a08
push 1
lea esi, [ebp - 0x70]
call fcn.00402a08
push 1
lea esi, [ebp - 0x50]
call fcn.00402b66
mov eax, ebx
jmp 0x401898
xor eax, eax
push ebx
mov byte [ebp - 0x18], bl
lea edi, [ebp - 0x17]
stosw word es:[edi], ax
lea eax, [ebp - 0x54]
push eax
push 3
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x54], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040642d
push 3
lea eax, [ebp - 0x18]
push 0x45edbc
push eax
call fcn.0043b711
add esp, 0x10
test eax, eax
jne 0x40194d
mov ebx, 0x194
jmp 0x4018db
xor ebx, ebx
inc ebx
jmp 0x4018db
cmp eax, ebx
je 0x4018db
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4018db