Function at 0x401250
Capabilities:
Create directory
Create process on windows
Delete file
Enumerate files on windows
Enumerate gui resources
Get common file path
Move file
Set current directory

Disassembly:
sub esp, 0x4a4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x4a0], eax
push ebx
push esi
push 0x103
lea eax, [esp + 0x2a9]
push 0
push eax
mov byte [esp + 0x2b0], 0
call fcn.004019e0
push 0x103
lea ecx, [esp + 0x1b1]
push 0
push ecx
mov byte [esp + 0x1b8], 0
call fcn.004019e0
mov edx, dword [str.VIPTunnel.exe]
mov eax, dword [0x40828c]
mov ecx, dword [0x408290]
push 0xf2
mov dword [esp + 0x3c8], eax
mov dword [esp + 0x3c4], edx
mov dx, word [0x408294]
lea eax, [esp + 0x3d2]
push 0
push eax
mov dword [esp + 0x3d4], ecx
mov word [esp + 0x3d8], dx
call fcn.004019e0
push str..exe
push str.VIPTunnelMonitor.exe_VIPTunnel.exe__aphelponmypc__startupclient__port5910__survey__udpwww.helponmypc.com__webserverwww.amobian.com
call fcn.00401940
add esp, 0x2c
test eax, eax
je 0x40134f
lea ecx, [ecx]
mov esi, eax
add eax, 1
push str..exe
push eax
call fcn.00401940
add esp, 8
test eax, eax
jne 0x401300
test esi, esi
je 0x40134f
mov bl, byte [esi + 4]
push 0x20
push str.VIPTunnelMonitor.exe_VIPTunnel.exe__aphelponmypc__startupclient__port5910__survey__udpwww.helponmypc.com__webserverwww.amobian.com
mov byte [esi + 4], al
call fcn.00401910
add eax, 1
lea edx, [esp + 0x3b0]
add esp, 8
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401340
mov byte [esi + 4], bl
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x3ac]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4016f2
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x2a4]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
jmp 0x401390
mov cl, byte [esp + eax + 0x2a4]
mov byte [esp + eax + 0x1a0], cl
add eax, 1
test cl, cl
jne 0x401390
lea ecx, [esp + 0x1a0]
push 0x5c
push ecx
call fcn.00401910
add esp, 8
test eax, eax
je 0x4016f2
mov edx, dword [str.VIPTunnel]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [eax + 1], edx
mov ecx, dword [0x408278]
mov dword [eax + 5], ecx
mov dx, word [0x40827c]
mov word [eax + 9], dx
push 0
lea eax, [esp + 0x1a4]
push eax
call ebx
push str._ap
push str.VIPTunnelMonitor.exe_VIPTunnel.exe__aphelponmypc__startupclient__port5910__survey__udpwww.helponmypc.com__webserverwww.amobian.com
call fcn.00401940
mov esi, eax
add esp, 8
test esi, esi
je 0x4016f2
push ebp
push 0x3a
push esi
call fcn.00401850
push 0x20
push esi
mov ebp, eax
call fcn.00401850
add esp, 0x10
test eax, eax
je 0x4016f1
test ebp, ebp
je 0x401430
cmp eax, ebp
jae 0x401432
mov ebp, eax
mov dl, byte [ebp]
push edi
lea edi, [esp + 0x1a8]
mov byte [ebp], 0
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x401444
mov cx, word [0x408268]
lea eax, [esi + 4]
mov word [edi], cx
mov esi, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401460
lea edi, [esp + 0x1a8]
sub eax, esi
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401475
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [ebp], dl
push 0
lea edx, [esp + 0x1ac]
push edx
call ebx
push str._startup
push str.VIPTunnelMonitor.exe_VIPTunnel.exe__aphelponmypc__startupclient__port5910__survey__udpwww.helponmypc.com__webserverwww.amobian.com
call fcn.00401940
mov esi, eax
add esp, 8
test esi, esi
je 0x401539
push 0x20
push esi
call fcn.00401850
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4016f0
lea edi, [esp + 0x1a8]
mov byte [ebp], 0
add edi, 0xffffffff
jmp 0x4014e0
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x4014e0
mov ax, word [0x408268]
lea ecx, [esi + 9]
mov word [edi], ax
mov edx, ecx
mov al, byte [ecx]
add ecx, 1
test al, al
jne 0x4014f8
sub ecx, edx
lea edi, [esp + 0x1a8]
mov esi, edx
mov edx, ecx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
test cl, cl
jne 0x401511
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea ecx, [esp + 0x1ac]
push ecx
mov byte [ebp], 0x20
call ebx
lea edi, [esp + 0x1a8]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x401543
mov si, word [0x408268]
lea eax, [esp + 0x1a8]
mov word [edi], si
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401561
sub eax, edx
lea edi, [esp + 0x2ac]
mov dword [esp + 0x10], eax
add edi, 0xffffffff
lea ebx, [ebx]
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x401580
lea eax, [esp + 0x2ac]
mov word [edi], si
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401597
sub eax, edx
lea edx, [esp + 0x68]
push edx
push 0x408258
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4016f0
nop
test byte [esp + 0x68], 0x10
jne 0x401648
mov edi, str.VIPTunnelSetup.exe
lea esi, [esp + 0x94]
mov ecx, 0x13
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x401648
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x94]
mov ecx, eax
sub edx, ecx
lea edx, [esp + edx + 0x1a8]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4015f8
lea eax, [esp + 0x94]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea edx, [esp + edx + 0x2ac]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x401618
lea edx, [esp + 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x1a8]
push eax
lea ecx, [esp + 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
lea edx, [esp + 0x68]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4015c0
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x1a8]
push ecx
mov byte [esp + eax + 0x1ab], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 6
push 0x4010f0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x44
lea edx, [esp + 0x28]
push 0
push edx
call fcn.004019e0
add esp, 0xc
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push str.VIPTunnelMonitor.exe_VIPTunnel.exe__aphelponmypc__startupclient__port5910__survey__udpwww.helponmypc.com__webserverwww.amobian.com
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4016f0
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
pop edi
pop ebp
mov ecx, dword [esp + 0x4a8]
pop esi
pop ebx
xor ecx, esp
call fcn.004019c6
add esp, 0x4a4
ret