Function at 0x402da5
Capabilities:
Create thread
Get common file path
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
push 0xd
pop ecx
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x38]
mov dword [ebp - 0x3c], ebx
push ebx
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, 0x104
push esi
mov dword [0x4062e8], eax
call fcn.0040393d
push esi
mov dword [0x4062d4], eax
call fcn.0040393d
push esi
mov dword [0x4062d8], eax
call fcn.0040393d
add esp, 0xc
push esi
push dword [0x4062d8]
mov dword [0x4062ec], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebx
push ebx
push esi
push 0x4062d4
push dword [0x4062d8]
call fcn.00401d13
add esp, 0x14
call fcn.00402572
test al, al
je 0x402e26
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
call fcn.0040393d
push esi
mov dword [0x40631c], eax
call fcn.0040393d
push esi
mov dword [0x4062e0], eax
call fcn.0040393d
push esi
mov dword [0x4062c8], eax
call fcn.0040393d
push esi
mov dword [0x406310], eax
call fcn.0040393d
push esi
mov dword [0x4062d0], eax
call fcn.0040393d
push esi
mov dword [0x406314], eax
call fcn.0040393d
push esi
mov dword [0x406300], eax
call fcn.0040393d
push dword [0x4062d8]
mov dword [0x4062f0], eax
push dword [0x4062d4]
call fcn.00401ebf
push esi
call fcn.0040393d
push esi
mov dword [0x406308], eax
call fcn.0040393d
push eax
push dword [0x406308]
mov dword [0x4062cc], eax
push dword [0x4062d8]
call fcn.00401b2e
add esp, 0x3c
test al, al
jne 0x402ee1
push 0x4016d8
push dword [0x406308]
call fcn.004030f6
push 0x4016cc
push dword [0x4062cc]
call fcn.004030f6
add esp, 0x10
push dword [0x4062ec]
push esi
call fcn.004018ed
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
pop ecx
call edi
push eax
push 0x4016bc
push esi
push dword [0x40631c]
call fcn.004038c7
add esp, 0x10
call edi
add eax, 0x3e7
push eax
push 0x4016ac
push esi
push dword [0x4062d0]
call fcn.004038c7
push esi
call fcn.0040393d
push esi
mov dword [0x4062f8], eax
call fcn.0040393d
push dword [0x4062f8]
mov dword [0x406300], eax
call fcn.004018c5
push dword [0x40631c]
push dword [0x4062f8]
call fcn.004030a5
mov edi, 0x401160
push edi
push dword [0x4062f8]
call fcn.004030a5
push dword [0x406300]
call fcn.004018c5
push dword [0x4062d0]
push dword [0x406300]
call fcn.004030a5
push edi
push dword [0x406300]
call fcn.004030a5
add esp, 0x40
push dword [0x40631c]
mov edi, 0x401694
push dword [0x4062f8]
push edi
push esi
push dword [0x4062e0]
call fcn.004038c7
push dword [0x40631c]
push dword [0x4062f8]
push 0x40167c
push esi
push dword [0x4062c8]
call fcn.004038c7
push dword [0x4062d0]
push dword [0x406300]
push edi
push esi
push dword [0x406314]
call fcn.004038c7
add esp, 0x3c
push dword [0x4062f0]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [0x4062d8]
call fcn.00402cd2
mov eax, dword [0x4062f8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x40631c]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4062e0]
mov dword [ebp - 0x24], eax
mov eax, dword [0x4062c8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x4062cc]
mov byte [ebp - 0xb], 1
mov byte [ebp - 0xa], 1
mov byte [ebp - 9], 1
mov dword [ebp - 0x34], eax
mov eax, dword [0x406308]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x10], 0x406323
call fcn.0040266f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 4
push ebx
push 0x4029e0
push 0x1000
push ebx
mov byte [0x406323], 1
mov byte [0x406322], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40307d