Function at 0x403400
Capabilities:
Create mailslot
Create process on windows
Get common file path

Disassembly:
mov eax, 0x1184
call fcn.00404100
mov eax, dword [str..mailslot_]
mov ecx, dword [0x40a468]
mov edx, dword [0x40a46c]
push ebx
mov dword [esp + 0x1c], eax
mov ax, word [0x40a470]
push ebp
push esi
push edi
mov dword [esp + 0x2c], ecx
mov word [esp + 0x34], ax
mov ecx, 0x15
xor eax, eax
lea edi, [esp + 0x36]
mov dword [esp + 0x30], edx
push 0x105
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xd4]
mov ebp, 0x3e8
push ecx
mov dword [esp + 0x18], 0x64
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x403691
lea edx, [esp + 0xd0]
push str.winplcman.exe
push edx
lea eax, [esp + 0xd8]
push str._s_s
push eax
call fcn.00403fa0
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x9c]
xor ebx, ebx
rep stosd dword es:[edi], eax
mov eax, dword [0x40b794]
xor ecx, ecx
mov dword [esp + 0x28], ecx
add esp, 0x10
mov dword [esp + 0x1c], ecx
cmp eax, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x8c], 0x44
mov dword [esp + 0x24], ecx
jne 0x4034f1
lea edx, [esp + 0x18]
lea eax, [esp + 0x8c]
push edx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0xf0]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403691
mov edi, dword [esp + 0x1198]
or ecx, 0xffffffff
xor eax, eax
mov dword [0x40b794], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x40a448]
mov ecx, edx
and ecx, 3
cmp eax, 0xffffffff
rep movsb byte es:[edi], byte [esi]
jne 0x403555
push ebx
push ebx
lea eax, [esp + 0x30]
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
cmp eax, 0xffffffff
mov dword [0x40a448], eax
je 0x403691
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1f7]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x28]
mov byte [esp + 0x1f6], cl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x1f4], 0x81
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0x1f5], bl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [0x40a030], ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1f6]
lea ecx, [esp + 0x1f4]
and eax, 0xff
add eax, 3
push eax
push ecx
call fcn.00403df0
add esp, 8
test eax, eax
je 0x403691
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x10], ebx
jle 0x403691
mov edx, dword [0x40c0bc]
push ebx
push ebx
push 0x405
push 0x3fa
push edx
call esi
lea eax, [esp + 0x14]
lea ecx, [esp + 0x9c4]
push eax
push ecx
call fcn.00403f10
add esp, 8
test eax, eax
jne 0x403627
push 0x64
call edi
dec ebp
cmp ebp, ebx
jg 0x4035d9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1184
ret
mov eax, dword [esp + 0x14]
mov ebp, 0x3e8
cmp eax, 4
jne 0x403648
cmp byte [esp + 0x9c4], 0x82
jne 0x403648
cmp byte [esp + 0x9c5], bl
je 0x40364e
dec dword [esp + 0x10]
jmp 0x4035d9
cmp byte [esp + 0x9c6], 1
jne 0x40368b
mov dl, byte [esp + 0x9c7]
pop edi
mov eax, 1
pop esi
mov dword [0x40b9e4], ebx
mov dword [0x40c0b4], ebx
pop ebp
mov byte [0x40c0b0], dl
mov dword [0x40b78c], eax
mov dword [0x40a030], eax
pop ebx
add esp, 0x1184
ret
mov dword [0x40b78c], ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1184
ret