Function at 0x401be0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x1734
call fcn.004062b0
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x641]
mov byte [esp + 0x640], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x29]
mov byte [esp + 0x28], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12d]
mov byte [esp + 0x12c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.CADReader.exe
stosb byte es:[edi], al
call fcn.00401000
lea eax, [esp + 0x14]
lea ecx, [esp + 0x748]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push str.ExcludeFromKnownDlls
xor ebx, ebx
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [esp + 0x34], ebx
call fcn.00401200
add esp, 0x1c
lea edi, [esp + 0x23b]
test eax, eax
jne 0x401d98
mov eax, dword [0x4102c0]
mov ecx, dword [0x4102c4]
mov dword [esp + 0x230], eax
mov ax, word [0x4102c8]
mov dword [esp + 0x234], ecx
mov cl, byte [0x4102ca]
mov word [esp + 0x238], ax
mov byte [esp + 0x23a], cl
mov ecx, 0x3e
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, dword [0x4102b8]
xor edx, edx
stosb byte es:[edi], al
mov eax, dword [str.winmm.dll]
mov dword [esp + 0x338], ecx
mov dword [esp + 0x334], eax
mov ax, word [0x4102bc]
mov word [esp + 0x33c], ax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x33e]
rep stosd dword es:[edi], eax
mov ecx, dword [str.version.dll]
mov dword [esp + 0x14], 7
stosw word es:[edi], ax
mov eax, dword [0x4102ac]
mov dword [esp + 0x438], ecx
mov ecx, dword [0x4102b0]
mov dword [esp + 0x43c], eax
mov dword [esp + 0x440], ecx
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x444]
rep stosd dword es:[edi], eax
lea ebp, [esp + 0x230]
mov ebx, 3
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
lea edi, [esp + edx + 0x744]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, 0x104
dec ebx
lea edx, [edx + ecx + 1]
jne 0x401d44
mov byte [esp + edx + 0x744], al
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 1
jmp 0x401f14
mov ecx, dword [0x4102c0]
mov ax, word [0x4102c8]
mov edx, dword [0x4102c4]
mov dword [esp + 0x230], ecx
mov cl, byte [0x4102ca]
mov word [esp + 0x238], ax
mov byte [esp + 0x23a], cl
mov ecx, 0x3e
xor eax, eax
mov dword [esp + 0x234], edx
rep stosd dword es:[edi], eax
mov cx, word [0x4102bc]
mov edx, dword [str.winmm.dll]
stosb byte es:[edi], al
mov eax, dword [0x4102b8]
mov word [esp + 0x33c], cx
mov dword [esp + 0x338], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x33e]
mov dword [esp + 0x334], edx
mov edx, dword [str.version.dll]
rep stosd dword es:[edi], eax
mov ecx, dword [0x4102b0]
mov dword [esp + 0x1c], ebx
stosw word es:[edi], ax
mov eax, dword [0x4102ac]
mov dword [esp + 0x440], ecx
mov dword [esp + 0x43c], eax
mov ecx, 0x3e
xor eax, eax
lea edi, [esp + 0x444]
mov dword [esp + 0x438], edx
mov dword [esp + 0x20], ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], ebx
cmp eax, ebx
jbe 0x401ea5
xor esi, esi
lea edi, [esp + ebx + 0x744]
lea ebp, [esp + 0x230]
push ebp
push edi
call fcn.004019b0
add esp, 8
test eax, eax
jne 0x401e87
inc esi
add ebp, 0x104
cmp esi, 3
jb 0x401e6b
jmp 0x401e8f
mov dword [esp + esi*4 + 0x1c], 1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
dec ecx
lea ebx, [ebx + ecx + 1]
cmp ebx, eax
jb 0x401e5b
lea edx, [ebx - 1]
xor ebx, ebx
lea ebp, [esp + 0x230]
mov eax, dword [esp + ebx*4 + 0x1c]
test eax, eax
jne 0x401ef3
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
mov eax, ecx
lea edi, [esp + edx + 0x744]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x18], 1
rep movsb byte es:[edi], byte [esi]
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
inc ebx
add ebp, 0x104
cmp ebx, 3
jb 0x401eb1
mov eax, dword [esp + 0x18]
mov byte [esp + edx + 0x744], 0
inc edx
test eax, eax
mov dword [esp + 0x10], edx
je 0x401f3e
push 0xf003f
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x74c]
push ecx
push edx
push str.ExcludeFromKnownDlls
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call fcn.00401180
add esp, 0x1c
push 0
lea eax, [esp + 0x2c]
push 5
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x12c], cl
inc eax
test cl, cl
jne 0x401f51
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
mov esi, str.CADReaderusersession.ini
repne scasb al, byte es:[edi]
dec edi
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x12c]
movsw word es:[edi], word [esi]
push ecx
push 0x410288
push 0x410284
push str.usersession
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push str.InstallLocation
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallDDD659B5_6B07_4F5A_A0D3_9E8D3147E165_is1
push 0x80000002
call fcn.00401200
add esp, 0x18
test eax, eax
je 0x402008
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x27], 0x5c
je 0x402045
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0x27], 0x2f
je 0x402045
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
mov dx, word [0x4100e0]
repne scasb al, byte es:[edi]
mov word [edi - 1], dx
jmp 0x402045
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.CADReader.exe
push 0x4101e4
call fcn.00401340
add esp, 0x10
test eax, eax
je 0x402045
lea edx, [esp + 0x28]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40202e
lea edx, [esp + 0x28]
push edx
call fcn.00401570
add esp, 4
mov al, byte [esp + 0x28]
test al, al
je 0x402268
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x12c], cl
inc eax
test cl, cl
jne 0x402053
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x410320]
repne scasb al, byte es:[edi]
mov eax, dword [str.CADReader.exe]
mov ecx, dword [0x41031c]
dec edi
mov dword [edi], eax
mov ax, word [0x410324]
mov dword [edi + 4], ecx
lea ecx, [esp + 0x14]
push ecx
mov dword [edi + 8], edx
lea edx, [esp + 0x130]
push edx
mov word [edi + 0xc], ax
call fcn.004010e0
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x53c], cl
inc eax
test cl, cl
jne 0x4020ac
lea edi, [esp + 0x53c]
or ecx, 0xffffffff
xor eax, eax
mov dx, word [0x4102c8]
repne scasb al, byte es:[edi]
mov eax, dword [0x4102c0]
mov ecx, dword [0x4102c4]
dec edi
push 0x69
mov dword [edi], eax
mov al, byte [0x4102ca]
mov dword [edi + 4], ecx
lea ecx, [esp + 0x540]
push ecx
mov word [edi + 8], dx
mov byte [edi + 0xa], al
call fcn.004014b0
add esp, 8
xor eax, eax
mov cl, byte [esp + eax + 0x28]
mov byte [esp + eax + 0x53c], cl
inc eax
test cl, cl
jne 0x402102
lea edi, [esp + 0x53c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.GlodonGLD.dll]
repne scasb al, byte es:[edi]
mov eax, dword [0x4101d8]
mov ecx, dword [0x4101dc]
dec edi
push 0x67
mov dword [edi], edx
mov dx, word [0x4101e0]
mov dword [edi + 4], eax
lea eax, [esp + 0x540]
push eax
mov dword [edi + 8], ecx
mov word [edi + 0xc], dx
call fcn.004014b0
add esp, 8
lea ecx, [esp + 0x12c]
xor ebp, ebp
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [str.driversetchosts]
repne scasb al, byte es:[edi]
mov eax, dword [0x4101c4]
mov ecx, dword [0x4101c8]
dec edi
push 0x4100a0
mov dword [edi], edx
mov edx, dword [0x4101cc]
mov dword [edi + 4], eax
mov ax, word [0x4101d0]
mov dword [edi + 8], ecx
mov cl, byte [0x4101d2]
mov dword [edi + 0xc], edx
lea edx, [esp + 0x130]
push edx
mov word [edi + 0x10], ax
mov byte [edi + 0x12], cl
call fcn.00405824
mov esi, eax
add esp, 8
test esi, esi
je 0x402262
mov eax, dword [esi + 0x10]
push eax
call fcn.00406230
mov ebx, eax
push ebx
call fcn.0040562c
push esi
mov edi, eax
push ebx
push 1
push edi
call fcn.0040571c
push esi
call fcn.0040563a
push str.cad.kuaicad.com
push edi
call fcn.004019b0
add esp, 0x24
test eax, eax
jne 0x40223a
cmp byte [edi + ebx - 1], 0xa
je 0x402220
lea ecx, [esp + 0x12c]
push 0x4101ac
push ecx
call fcn.00401300
add esp, 8
lea edx, [esp + 0x12c]
push str.127.0.0.1_cad.kuaicad.com_n
push edx
call fcn.00401300
add esp, 8
mov ebp, 1
push edi
call fcn.00403552
add esp, 4
test ebp, ebp
je 0x402262
push 0
push 0
push str._C_ipconfig__flushdns
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
inc dword [0x413d88]
mov eax, dword [0x413d88]
test eax, eax
je 0x402281
push eax
lea eax, [esp + 0x644]
push str.Patch_successfully___d_modifieds__
push eax
jmp 0x402290
push 0
lea ecx, [esp + 0x644]
push str.Patch_unsuccessfully_or_already_
push ecx
call fcn.004058f0
mov esi, dword [sym.imp.USER32.dll_MessageBoxA]
add esp, 0xc
lea edx, [esp + 0x640]
push 0
push 0x410118
push edx
push 0
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4022c9
push 0
push 0x410118
push 0x4100e4
push 0
call esi
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1734
ret