Function at 0x4131a0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a068
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc8
mov eax, dword [0x546330]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x533a54
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x413238
lea ecx, [ebp - 0x94]
push ecx
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0x98]
push ecx
call eax
cmp dword [ebp - 0x90], 0x55f0
jbe 0x41322b
mov dword [ebp - 0x98], 0xb
movzx eax, word [ebp - 0x94]
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x98], 6
jne 0x4136e0
lea edi, [esi + 0x34]
push str.global_sign.cer
mov edx, edi
lea ecx, [ebp - 0x8c]
call fcn.00414420
add esp, 4
mov dword [ebp - 4], 0
mov esi, SysReAllocString
cmp dword [ebp - 0x7c], 0
je 0x41345f
cmp dword [ebp - 0x78], 8
lea eax, [ebp - 0x8c]
cmovae eax, dword [ebp - 0x8c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41345f
mov ecx, dword [ebp - 0x7c]
mov eax, esi
sub eax, ecx
cmp eax, 0x13
jb 0x413700
cmp dword [ebp - 0x78], 8
lea eax, [ebp - 0x8c]
push ecx
cmovae eax, dword [ebp - 0x8c]
push eax
push 0x13
push str.__addstore__ROOT___
push ecx
push dword [ebp - 0x90]
lea ecx, [ebp - 0x5c]
call fcn.00414940
push 0x53465c
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x74]
call fcn.00413f40
add esp, 4
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x413321
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413317
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413705
push ecx
push edx
call fcn.004bd6ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
push 0x20
xorps xmm0, xmm0
mov dword [ebp - 0x48], 7
push str.C:Windows_system32certutil.exe
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x5c], ax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00405590
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0xbc], 0
cmovae eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x60], 8
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xd4]
push eax
movlpd qword [ebp - 0xcc], xmm0
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xac], xmm0
movlpd qword [ebp - 0xa4], xmm0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xd4], 0x3c
mov dword [ebp - 0xd0], 0x40
mov dword [ebp - 0xb8], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4133e7
push 0xffffffffffffffff
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x413421
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413417
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41370a
push ecx
push edx
call fcn.004bd6ef
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x60]
cmp ecx, 8
jb 0x41345f
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413455
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41370f
push ecx
push edx
call fcn.004bd6ef
add esp, 8
push str.global_sign_csr.cer
mov edx, edi
lea ecx, [ebp - 0x44]
call fcn.00414420
add esp, 4
mov byte [ebp - 4], 4
cmp dword [ebp - 0x34], 0
je 0x413659
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x413659
mov ecx, dword [ebp - 0x34]
sub esi, ecx
cmp esi, 0x13
jb 0x413714
cmp dword [ebp - 0x30], 8
lea eax, [ebp - 0x44]
push ecx
cmovae eax, dword [ebp - 0x44]
push eax
push 0x13
push str.__addstore__ROOT___
push ecx
push dword [ebp - 0x90]
lea ecx, [ebp - 0x5c]
call fcn.00414940
push 0x53465c
lea edx, [ebp - 0x5c]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x74]
call fcn.00413f40
add esp, 4
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x48]
cmp ecx, 8
jb 0x41351f
mov edx, dword [ebp - 0x5c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413515
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413719
push ecx
push edx
call fcn.004bd6ef
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
push 0x20
xorps xmm0, xmm0
mov dword [ebp - 0x48], 7
push str.C:Windows_system32certutil.exe
lea ecx, [ebp - 0x2c]
mov word [ebp - 0x5c], ax
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call fcn.00405590
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
mov dword [ebp - 0xbc], 0
cmovae eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x60], 8
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0x74]
cmovae eax, dword [ebp - 0x74]
mov dword [ebp - 0xc0], eax
lea eax, [ebp - 0xd4]
push eax
movlpd qword [ebp - 0xcc], xmm0
movlpd qword [ebp - 0xb4], xmm0
movlpd qword [ebp - 0xac], xmm0
movlpd qword [ebp - 0xa4], xmm0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xd4], 0x3c
mov dword [ebp - 0xd0], 0x40
mov dword [ebp - 0xb8], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4135e5
push 0xffffffffffffffff
push dword [ebp - 0x9c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x18]
cmp ecx, 8
jb 0x41361f
mov edx, dword [ebp - 0x2c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413615
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41371e
push ecx
push edx
call fcn.004bd6ef
add esp, 8
mov ecx, dword [ebp - 0x60]
cmp ecx, 8
jb 0x413659
mov edx, dword [ebp - 0x74]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x41364f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413723
push ecx
push edx
call fcn.004bd6ef
add esp, 8
mov ecx, dword [ebp - 0x30]
cmp ecx, 8
jb 0x413693
mov edx, dword [ebp - 0x44]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x413689
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413728
push ecx
push edx
call fcn.004bd6ef
add esp, 8
mov ecx, dword [ebp - 0x78]
xor eax, eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
cmp ecx, 8
jb 0x4136e0
mov edx, dword [ebp - 0x8c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4136d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x413728
push ecx
push edx
call fcn.004bd6ef
add esp, 8
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004bd6ac
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00404850
call fcn.004e61e1
call fcn.004e61e1
call fcn.004e61e1
call fcn.00404850
call fcn.004e61e1
call fcn.004e61e1
call fcn.004e61e1
call fcn.004e61e1
int3