Function at 0x41c7a0
Capabilities:
Create process on windows
Enumerate processes
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53c766
mov eax, dword fs:[0]
push eax
sub esp, 0xaa0
mov eax, dword [0x596334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x830]
mov esi, dword [ebp + 0x10]
push 0x208
push 0
push eax
mov dword [ebp - 0xaa8], ebx
mov dword [ebp - 0xaa0], esi
mov dword [0x59ad64], ebx
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x830]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x830]
push eax
push str.WorkPath__s
call fcn.0042be60
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004b0810
add esp, 0x14
lea eax, [ebp - 0x628]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.004e52bb
add esp, 8
test eax, eax
je 0x41c882
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x628]
push eax
push str.set_WorkPath__s
call fcn.0042be60
add esp, 8
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 0xa98]
mov dword [ebp - 0xa98], 8
push eax
mov dword [ebp - 0xa94], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0x553ed4
push 0
call fcn.004e5760
add esp, 8
mov ecx, 0x59ae2c
push 0
push ebx
push 0
call fcn.004128d0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x553ed8
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00407e20
mov ecx, eax
test ecx, ecx
je 0x41d19c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0xa90]
call fcn.0040a050
test al, al
jne 0x41c978
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c956
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa90]
call fcn.0040b260
lea eax, [ebp - 0xa90]
mov dword [ebp - 4], 1
push eax
mov ecx, 0x59d9f8
call fcn.0042ba20
mov edx, dword [ebp - 0xa90]
or ebx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41c9b7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
call fcn.00414770
mov ecx, eax
call fcn.0040ff20
call fcn.00414770
mov ecx, eax
call fcn.0040ff70
test eax, eax
je 0x41c9e6
push str.mini_exit
call fcn.0042be60
add esp, 4
jmp 0x41d17e
lea ecx, [ebp - 0xaac]
call fcn.00406190
mov dword [ebp - 4], 2
call fcn.0041abf0
mov ecx, eax
call fcn.004546c0
mov eax, dword [0x59ae94]
test al, 1
jne 0x41ca34
or eax, 1
mov dword [0x59ae94], eax
mov ecx, 0x59ae90
mov byte [ebp - 4], 3
call fcn.0041aba0
push 0x54c600
call fcn.00455d05
add esp, 4
mov byte [ebp - 4], 2
mov ecx, 0x59ae90
call fcn.0041ac80
push str.uninst
call fcn.00414800
mov ecx, eax
call fcn.0040b390
lea eax, [ebp - 0xa94]
push eax
call fcn.00422c60
add esp, 4
push eax
mov byte [ebp - 4], 4
call fcn.00414800
mov ecx, eax
call fcn.0040b1f0
mov edx, dword [ebp - 0xa94]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ca90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x228
mov edi, eax
lea eax, [ebp - 0xa88]
push 0
push eax
call fcn.004b0810
add esp, 0xc
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0x22c
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
lea eax, [ebp - 0xa8c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x41cb07
nop
cmp dword [ebp - 0xa84], edi
je 0x41cafb
lea eax, [ebp - 0xa8c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41cae0
jmp 0x41cb07
mov eax, dword [ebp - 0xa74]
mov dword [ebp - 0xa90], eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xa90]
lea eax, [ebp - 0x848]
push esi
push eax
call fcn.00428d90
cmp dword [ebp - 0x834], 8
lea eax, [ebp - 0x848]
mov byte [ebp - 4], 5
cmovae eax, dword [ebp - 0x848]
push eax
push esi
push edi
push str.cur_pid:_u__ppid:_u__file:_s
call fcn.0042be60
add esp, 0x18
mov dword [ebp - 0x850], 0
cmp dword [ebp - 0x834], 8
lea edx, [ebp - 0x848]
mov dword [ebp - 0x84c], 7
cmovae edx, dword [ebp - 0x848]
xor eax, eax
mov ecx, edx
mov word [ebp - 0x860], ax
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cb80
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x860]
call fcn.00419030
mov edx, dword [ebp - 0x834]
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x41cbe0
mov ecx, dword [ebp - 0x848]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41cbd6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41d1a6
push edx
push ecx
call fcn.0045590a
add esp, 8
xor eax, eax
mov dword [ebp - 0x838], 0
mov dword [ebp - 0x834], 7
mov word [ebp - 0x848], ax
cmp dword [ebp - 0x84c], 8
lea eax, [ebp - 0x860]
mov byte [ebp - 4], 6
cmovae eax, dword [ebp - 0x860]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0xaa4]
call fcn.00409d40
mov byte [ebp - 4], 7
call fcn.00407e20
mov ecx, eax
test ecx, ecx
je 0x41d1ab
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa9c], eax
push dword [ebp - 0xaa4]
lea eax, [ebp - 0xa9c]
mov byte [ebp - 4], 8
push str._father:_:_s
push eax
call fcn.0040bd20
add esp, 0xc
call fcn.00407e20
mov ecx, eax
test ecx, ecx
je 0x41d1b5
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa90], eax
lea eax, [ebp - 0xa9c]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0xa94]
push eax
call fcn.00423050
push dword [eax]
lea eax, [ebp - 0xa90]
mov byte [ebp - 4], 0xa
push str.ex1_s
push eax
call fcn.0040bd20
mov edx, dword [ebp - 0xa94]
add esp, 0x14
mov byte [ebp - 4], 9
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ccd6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.SendStatAction_run
call fcn.0042be60
sub esp, 0x24
mov eax, esp
mov dword [ebp - 0xa94], esp
mov dword [eax + 0x24], 0
mov esi, dword [ebp - 0xa90]
push 0
push esi
push 0x553f5c
mov byte [ebp - 4], 0xb
call fcn.00414800
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.0040ae50
call fcn.00414770
mov ecx, eax
call fcn.0040ffb0
push eax
call fcn.0041a540
mov ecx, 0x59ae68
call fcn.00406700
test eax, eax
jne 0x41cd54
push str.CheckSingleInstance_failed__exit
call fcn.0042be60
add esp, 4
push 0
push 0x553fac
push 0
call fcn.0041a550
jmp 0x41cf7f
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b0810
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x59ad64]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.00420a30
lea edx, [ebp - 0x420]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0x550a34
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call fcn.00414800
mov ecx, eax
call fcn.0040b160
call fcn.00420a30
mov edi, eax
push edi
mov ecx, dword [edi]
call dword [ecx]
mov dword [ebp - 0xa94], eax
test eax, eax
je 0x41ceaa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [ebp - 0xa94]
push eax
push edi
push str.pre_init_check_failed__ret___d__last_err:_u
call fcn.0042be60
lea eax, [ebp - 0xa94]
push edi
push eax
call fcn.0041c320
add esp, 0x14
push 0
push dword [eax]
mov byte [ebp - 4], 0x13
push 0
call fcn.0041a550
mov edx, dword [ebp - 0xa94]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ce38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00407e20
mov ecx, eax
test ecx, ecx
je 0x41d1bf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa94], eax
push edi
push str.720260B5_154E_483f_A485_0B46C3D6C50D
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x14
push str._sPreInitCheck:_d
push eax
call fcn.0040bd20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
push 0xbb8
call edi
mov edx, dword [ebp - 0xa94]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41cf85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41cf85
mov eax, dword [edi]
push str.PCStore.ldsprj
push str.SETUPCONFIG
push 0xd1
push dword [ebp - 0xaa8]
push edi
call dword [eax + 4]
test eax, eax
jne 0x41cf6e
push str.init_config_failed__exit
call fcn.0042be60
add esp, 4
push 0
push 0x553df0
push 0
call fcn.0041a550
cmp eax, 1
jne 0x41cf04
push eax
push 0
push 0
push str.www.ludashi.com
push 0x553e44
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
call fcn.00407e20
mov ecx, eax
test ecx, ecx
je 0x41d1c9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa94], eax
push str.720260B5_154E_483f_A485_0B46C3D6C50D
lea eax, [ebp - 0xa94]
mov byte [ebp - 4], 0x15
push str._sInitConfigFaile
push eax
call fcn.0040bd20
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push 0xbb8
call edi
mov edx, dword [ebp - 0xa94]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41cf85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x41cf85
push dword [ebp + 0x14]
push dword [ebp - 0xaa0]
call fcn.0041e7d0
add esp, 8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
mov ecx, 0x59ae68
call fcn.00406920
mov eax, dword [0x59ae94]
test al, 1
jne 0x41cfc6
or eax, 1
mov dword [0x59ae94], eax
mov ecx, 0x59ae90
mov byte [ebp - 4], 0x16
call fcn.0041aba0
push 0x54c600
call fcn.00455d05
add esp, 4
mov byte [ebp - 4], 9
mov ecx, 0x59ae90
call fcn.0041afe0
call fcn.0041abf0
mov ecx, eax
call fcn.00454830
mov eax, dword [0x59ad60]
add eax, 0x10
push eax
mov dword [ebp - 0xaa0], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [0x59ae64]
test edi, edi
je 0x41d043
cmp dword [edi + 4], 0
jle 0x41d011
mov eax, dword [edi]
push dword [eax]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [0x59ae64]
test edi, edi
je 0x41d043
mov eax, dword [edi]
test eax, eax
je 0x41d02a
push eax
call fcn.004e20ad
add esp, 4
mov dword [edi], 0
push 0xc
push edi
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.0045590a
add esp, 8
push dword [ebp - 0xaa0]
mov dword [0x59ae64], 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, dword [0x59ae60]
test edi, edi
je 0x41d0a1
mov eax, dword [edi]
test eax, eax
je 0x41d078
push eax
call fcn.004e20ad
add esp, 4
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x41d08f
push eax
call fcn.004e20ad
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
mov dword [edi + 8], 0
call fcn.0045590a
add esp, 8
mov edi, dword [0x59ae58]
test edi, edi
je 0x41d0d3
cmp dword [edi], 0
je 0x41d0d3
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x41d0bd
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [edi + 0x20]
push 0
mov dword [edi + 0x10], 0
call eax
add edi, 0x24
cmp dword [edi], 0
jne 0x41d0b0
mov edi, dword [0x593d88]
mov ecx, dword [0x593d8c]
cmp edi, ecx
jae 0x41d0fd
mov eax, dword [edi]
test eax, eax
je 0x41d0f6
mov eax, dword [eax + 0x1c]
push 0
call eax
mov ecx, dword [0x593d8c]
add edi, 4
cmp edi, ecx
jb 0x41d0e3
mov ecx, 0x59ae2c
call fcn.0041ef00
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 8
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41d128
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xa9c]
mov eax, ebx
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41d149
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xaa4]
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41d168
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x860]
call fcn.00413940
lea ecx, [ebp - 0xaac]
call fcn.004061d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00455d1a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404c40
call fcn.004ba344
push 0x80004005
call fcn.00404c40
push 0x80004005
call fcn.00404c40
push 0x80004005
call fcn.00404c40
push 0x80004005
call fcn.00404c40
int3