Function at 0x401000
Capabilities:
Create process on windows
Set current directory

Disassembly:
sub esp, 0x10
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
push ebx
push ebp
push esi
push edi
mov edi, str.C:_Users_WALKER_unpack_L2farm2.exe
xor esi, esi
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx - 1]
cmp eax, 0xffffffff
jle 0x401051
mov cl, byte [eax + str.C:_Users_WALKER_unpack_L2farm2.exe]
cmp cl, 0x2f
jne 0x401034
mov edx, 1
test edx, edx
jne 0x40103f
mov byte [ebp + 0x406198], cl
inc ebp
cmp edx, 1
jne 0x40104b
mov byte [eax + str.PYT_P__WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW], cl
inc esi
dec eax
cmp eax, 0xffffffff
jg 0x401024
test esi, esi
je 0x40133d
mov edi, 0x406198
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp + 0x406198], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
mov byte [esi + 0x4060ff], 0
lea eax, [ecx - 1]
cmp eax, 0xffffffff
jle 0x401093
mov cl, byte [eax + 0x406198]
mov byte [edx + str.EXE__WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW], cl
inc edx
dec eax
cmp eax, 0xffffffff
jg 0x401080
mov byte [edx + str.EXE__WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00401750
mov ecx, 8
xor eax, eax
mov edi, 0x408a80
add esp, 4
rep stosd dword es:[edi], eax
xor esi, esi
mov edi, 0x408a80
call fcn.00401760
cdq
mov ecx, 0x1e
idiv ecx
cmp edx, 0xb
jge 0x4010e2
call fcn.00401760
cdq
mov ecx, 0x16
idiv ecx
add edx, 0x41
jmp 0x40110e
cmp edx, 0x15
jge 0x4010f9
call fcn.00401760
cdq
mov ecx, 5
idiv ecx
add edx, 0x31
jmp 0x40110e
cmp edx, 0x1f
jge 0x401116
call fcn.00401760
cdq
mov ecx, 0x16
idiv ecx
add edx, 0x61
mov byte [esi + 0x408a70], dl
mov byte [edi], dl
add edi, 2
inc esi
cmp esi, 0x10
jl 0x4010be
push 1
push 0x2faf080
call fcn.004016b0
add esp, 8
mov ebx, eax
mov ecx, 0xbebc20
xor eax, eax
mov edi, ebx
push 0x406210
rep stosd dword es:[edi], eax
push str.C:_Users_WALKER_unpack_L2farm2.exe
call fcn.00401690
add esp, 8
mov esi, eax
push esi
push 1
push 1
push ebx
call fcn.00401520
mov al, byte [esi + 0xc]
add esp, 0x10
test al, 0x10
mov ebp, 1
jne 0x401183
lea edi, [ebx + 1]
push esi
push 1
push 1
push edi
call fcn.00401520
mov al, byte [esi + 0xc]
add esp, 0x10
inc ebp
inc edi
test al, 0x10
je 0x40116c
dec ebp
push esi
mov dword [esp + 0x18], ebp
call fcn.004014a0
mov ecx, 5
lea eax, [ebp - 0x82]
add esp, 4
cmp eax, ecx
mov dword [esp + 0x1c], eax
jle 0x4012a1
mov edi, 0x10
mov eax, 0x20
sub edi, ebx
sub eax, ebx
mov dword [esp + 0x18], eax
xor eax, eax
lea ebp, [ebx + ecx]
movsx esi, byte [eax + 0x406030]
xor edx, edx
mov dl, byte [eax + ebp]
cmp edx, esi
jne 0x401258
inc eax
cmp eax, 0x10
jl 0x4011bf
add eax, ebx
add eax, ecx
cmp byte [eax + 2], 0x2d
jne 0x40123c
cmp byte [eax + 3], 0x2b
jne 0x40123c
cmp byte [eax + 4], 0x43
jne 0x40123c
cmp byte [eax + 5], 0x4c
jne 0x40123c
cmp byte [eax + 6], 0x41
jne 0x40123c
mov dl, 0x53
cmp byte [eax + 7], dl
jne 0x40123c
cmp byte [eax + 8], dl
jne 0x40123c
cmp byte [eax + 9], 0x2d
jne 0x40123c
cmp byte [eax + 0xa], 0x44
jne 0x40123c
mov dl, 0x4f
cmp byte [eax + 0xb], dl
jne 0x40123c
cmp byte [eax + 0xc], 0x4e
jne 0x40123c
cmp byte [eax + 0xd], dl
jne 0x40123c
cmp byte [eax + 0xe], 0x52
jne 0x40123c
cmp byte [eax + 0xf], 0x2b
jne 0x40123c
cmp byte [eax + 0x10], 0x2d
jne 0x40123c
mov byte [eax], 0x30
jmp 0x401258
lea esi, [edi + ebp]
mov eax, ecx
cmp ecx, esi
jge 0x401258
mov edx, eax
sub edx, ecx
inc eax
cmp eax, esi
mov dl, byte [edx + 0x408a70]
mov byte [eax + ebx - 1], dl
jl 0x401245
xor eax, eax
movsx esi, byte [eax + str.1426825_58240233]
xor edx, edx
mov dl, byte [eax + ebp]
cmp edx, esi
jne 0x401290
inc eax
cmp eax, 0x20
jl 0x40125a
mov edx, dword [esp + 0x18]
mov eax, ecx
lea esi, [edx + ebp]
cmp ecx, esi
jge 0x401290
mov edx, eax
sub edx, ecx
inc eax
cmp eax, esi
mov dl, byte [edx + 0x408a80]
mov byte [eax + ebx - 1], dl
jl 0x40127d
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
jl 0x4011ba
mov ebp, dword [esp + 0x14]
push 0x40620c
push str.C:_Users_WALKER_unpack_L2farm2.exe
xor edi, edi
call fcn.00401690
mov esi, eax
add esp, 8
test esi, esi
jne 0x4012ea
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, 0x1f4
jge 0x40133d
push 0xa
inc edi
call ebp
push 0x40620c
push str.C:_Users_WALKER_unpack_L2farm2.exe
call fcn.00401690
mov esi, eax
add esp, 8
test esi, esi
je 0x4012c1
mov ebp, dword [esp + 0x14]
xor edi, edi
test ebp, ebp
jle 0x40130e
mov al, byte [ebx + edi]
push esi
push 1
lea ecx, [esp + 0x1b]
push 1
push ecx
mov byte [esp + 0x23], al
call fcn.00401350
add esp, 0x10
inc edi
cmp edi, ebp
jl 0x4012f0
push esi
call fcn.004014a0
add esp, 4
push str.PYT_P__WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 1
push 0x408aa0
push 0
push str.EXE__WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
push str.Open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0x10