Function at 0x40e290
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x425a4b
mov eax, dword fs:[0]
push eax
sub esp, 0x5b0
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x528], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x524], eax
call ebx
mov cl, byte [ebp - 0x519]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x448]
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x520]
push eax
push 0
push 0
push 1
push 0
push 0
mov dword [ebp - fcn.00407920], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____stdcall___void___unsigned_long_int__void____void___int__struct_std::_Ph_1__const____int__wchar_t__.0
mov dword [ebp - 0x444], esi
mov byte [ebp - 0x440], cl
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x520], 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40e348
xor edi, edi
jmp 0x40e4c7
call ebx
push dword [ebp - 0x520]
mov cl, byte [ebp - 0x519]
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x470]
push 8
mov dword [ebp - fcn.00407920], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____stdcall___void___unsigned_long_int__void____void___int__struct_std::_Ph_1__const____int__wchar_t__.0
mov dword [ebp - 0x46c], esi
mov byte [ebp - 0x468], cl
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x44c], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x44c]
mov esi, eax
mov dword [ebp - 0x47c], 0
test ecx, ecx
je 0x40e3f3
lea eax, [ebp - 0x470]
cmp ecx, eax
jne 0x40e3e5
mov eax, dword [ecx]
lea edx, [ebp - 0x4a0]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x47c], eax
test ecx, ecx
je 0x40e3f3
mov edx, dword [ecx]
lea eax, [ebp - 0x470]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x40e3eb
mov dword [ebp - 0x47c], ecx
xor ecx, ecx
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x478], esi
test ecx, ecx
je 0x40e421
mov edx, dword [ecx]
lea eax, [ebp - 0x470]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov esi, dword [ebp - 0x478]
mov dword [ebp - 0x44c], 0
test esi, esi
jne 0x40e43f
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x4a0]
call fcn.00402550
xor edi, edi
jmp 0x40e4c7
lea eax, [ebp - 0x520]
push eax
push dword [ebp - 0x520]
push esi
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
test eax, eax
je 0x40e46c
mov edi, dword [ebp - 0x478]
xor eax, eax
mov dword [ebp - 0x478], eax
jmp 0x40e474
mov eax, dword [ebp - 0x478]
xor edi, edi
mov dword [ebp - 4], 0
test eax, eax
je 0x40e49f
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x52c], eax
test ecx, ecx
je 0x40e9ad
mov eax, dword [ecx]
lea edx, [ebp - 0x52c]
push edx
call dword [eax + 8]
mov ecx, dword [ebp - 0x47c]
test ecx, ecx
je 0x40e4c7
mov edx, dword [ecx]
lea eax, [ebp - 0x4a0]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov dword [ebp - 0x47c], 0
mov ecx, dword [ebp - 0x424]
xor esi, esi
mov dword [ebp - 0x4ac], esi
test ecx, ecx
je 0x40e52d
lea eax, [ebp - 0x448]
cmp ecx, eax
jne 0x40e51d
mov eax, dword [ecx]
lea edx, [ebp - 0x4d0]
push edx
call dword [eax + 4]
mov ecx, dword [ebp - 0x424]
mov esi, eax
mov dword [ebp - 0x4ac], esi
test ecx, ecx
je 0x40e52d
mov edx, dword [ecx]
lea eax, [ebp - 0x448]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov esi, dword [ebp - 0x4ac]
jmp 0x40e525
mov esi, ecx
mov dword [ebp - 0x4ac], esi
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x4a8], edi
mov dword [ebp - 4], 1
test ecx, ecx
je 0x40e568
mov edx, dword [ecx]
lea eax, [ebp - 0x448]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov edi, dword [ebp - 0x4a8]
mov esi, dword [ebp - 0x4ac]
mov dword [ebp - 0x424], 0
test edi, edi
je 0x40e94a
lea ecx, [ebp - 0x218]
mov ebx, edi
mov eax, ecx
mov edx, 0x104
sub ebx, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e59f
movzx eax, word [ecx + ebx]
test ax, ax
je 0x40e59f
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e581
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
jne 0x40e5be
xor eax, eax
mov word [ebp - 0x218], ax
jmp 0x40e94a
lea ecx, [ebp - 0x420]
mov ebx, edi
mov eax, ecx
mov edx, 0x104
sub ebx, eax
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40e5ee
movzx eax, word [ecx + ebx]
test ax, ax
je 0x40e5ee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x40e5d0
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
jne 0x40e60d
xor eax, eax
mov word [ebp - 0x420], ax
jmp 0x40e94a
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push 0x426490
push eax
call esi
push str.3kvpet.exe
lea eax, [ebp - 0x218]
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x40e6bd
push 0x1c
lea eax, [ebp - 0x578]
push eax
push fcn.0040e290
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp eax, 0x1c
ja 0x40e6bd
push 0x104
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x574]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x420]
push str.kvpet.exe
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x40e6bd
push str.kvpet.exe
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
push 1
lea eax, [ebp - 0x55c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x40e93e
push 0
push 0
push 1
lea eax, [ebp - 0x55c]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x40e93e
push dword [ebp - 0x524]
lea eax, [ebp - 0x4e8]
push eax
call fcn.00410ed0
mov eax, dword [ebp - 0x4d8]
add esp, 8
mov dword [ebp - 0x538], 0xc
mov dword [ebp - 0x530], 1
push 0
lea edi, [eax*2 + 2]
push edi
push 0
lea eax, [ebp - 0x55c]
mov dword [ebp - 0x534], eax
lea eax, [ebp - 0x538]
push 4
push eax
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov dword [ebp - 0x524], ebx
test ebx, ebx
je 0x40e910
push edi
push 0
push 0
push 2
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
jne 0x40e772
xor ebx, ebx
jmp 0x40e901
cmp dword [ebp - 0x4d4], 8
lea eax, [ebp - 0x4e8]
cmovae eax, dword [ebp - 0x4e8]
test edi, edi
je 0x40e7b6
push edi
test eax, eax
je 0x40e79b
push eax
push esi
call fcn.004134a0
add esp, 0xc
jmp 0x40e7b6
push 0
push esi
call fcn.00413a20
add esp, 0xc
call fcn.00415b34
mov dword [eax], 0x16
call fcn.00415a5a
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x448]
push eax
mov dword [ebp - 0x444], ecx
mov cl, byte [ebp - 0x519]
push 0x802
push 8
mov dword [ebp - fcn.00407920], vtable.std::_Func_impl_no_alloc_class_std::_Binder_struct_std::_Unforced__int____stdcall___void___unsigned_long_int__void____void___int__struct_std::_Ph_1__const____int__wchar_t__.0
mov byte [ebp - 0x440], cl
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x424], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 0x518]
call fcn.00401350
lea ecx, [ebp - 0x448]
call fcn.004024f0
mov eax, dword [ebp - 0x4f0]
test eax, eax
je 0x40e8ec
push edi
push ebx
push dword [ebp - 0x528]
lea ecx, [ebp - 0x218]
push ecx
push str._s__s_0x_x__0x_x
push 0x1900
push 0
push 0
push 0x400
push eax
call fcn.00406ab0
add esp, 0x28
test eax, eax
js 0x40e8ec
push 0x40
lea eax, [ebp - 0x5b8]
mov dword [ebp - 0x5bc], 0x44
push 0
push eax
call fcn.00413a20
add esp, 0xc
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push 0x4000000
push 1
push 0
push 0
push dword [ebp - 0x4f0]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40e8f4
push dword [ebp - 0x544]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
test eax, eax
je 0x40e8e0
push dword [ebp - 0x548]
call edi
test eax, eax
je 0x40e8e0
mov ebx, 1
jmp 0x40e8f6
mov dword [0], 0
jmp 0x40e8e0
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor ebx, ebx
lea ecx, [ebp - 0x518]
call fcn.00402550
mov byte [ebp - 4], 9
test esi, esi
je 0x40e910
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x524]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x40e925
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x4e8]
call fcn.0040dc00
mov edi, dword [ebp - 0x4a8]
mov esi, dword [ebp - 0x4ac]
jmp 0x40e94c
mov edi, dword [ebp - 0x4a8]
mov esi, dword [ebp - 0x4ac]
xor ebx, ebx
mov dword [ebp - 4], 0xb
test edi, edi
je 0x40e975
mov dword [ebp - 0x528], edi
test esi, esi
je 0x40e9b2
mov eax, dword [esi]
lea ecx, [ebp - 0x528]
push ecx
mov ecx, esi
call dword [eax + 8]
mov esi, dword [ebp - 0x4ac]
test esi, esi
je 0x40e98f
mov edx, dword [esi]
lea eax, [ebp - 0x4d0]
cmp esi, eax
setne cl
movzx ecx, cl
push ecx
mov ecx, esi
call dword [edx + 0x10]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
call fcn.00411cb0
call fcn.00411cb0
int3