Function at 0x425f10
Capabilities:
Check if file exists
Check mutex on windows
Create directory
Create thread
Delete file
Get common file path

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
push str.c:zv_npav4dbg.log
call ebp
test eax, eax
je 0x425f2f
mov byte [0x46fec5], 1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:zv_npav4.log
call esi
push str.npav4_started
call fcn.004073f0
call fcn.00409060
mov eax, dword [esp + 0x68]
push 0x190
xor ebx, ebx
push ebx
push 0x4693b8
mov dword [0x469cc4], eax
call fcn.0042ea40
add esp, 0x10
xor eax, eax
push 1
lea ecx, [esp + 0x50]
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0xc
mov dword [esp + 0x50], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.Global__t3_mutx__123_
push 0x100001
lea ecx, [esp + 0x48]
lea eax, [esp + 0x54]
push ecx
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x425fd8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.00430fbc
mov dword [0x470144], ebx
call fcn.00409ed0
cmp eax, 1
jne 0x425fed
mov dword [0x470144], eax
mov dword [0x47015c], ebx
call fcn.004075f0
call fcn.0040e150
call fcn.0040e010
call fcn.0040e220
call fcn.0040e330
call fcn.0040e440
mov eax, dword [0x470180]
mov dword [0x46f944], ebx
cmp eax, ebx
je 0x426039
call eax
test eax, eax
je 0x426039
push str.NPAV_IS_EXPIRED
call fcn.004073f0
add esp, 4
push ebx
call fcn.00430fbc
push 0x5000
push ebx
push 0x46a1e8
call fcn.0042ea40
add esp, 0xc
push str.c:zvxPajPid.ini
call esi
call fcn.004077c0
call fcn.004076c0
call fcn.00407710
call fcn.00408830
call fcn.00407280
call fcn.00407890
push 0x104
push ebx
push 0x46f630
call fcn.0042ea40
add esp, 0xc
push 0x104
push 0x46f630
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x46f630
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4260a0
mov edx, dword [str.NPDP]
mov cx, word [0x45ec98]
mov dword [eax], edx
push 0x46f630
mov word [eax + 4], cx
call ebp
test eax, eax
jne 0x4260d2
push ebx
push 0x46f630
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, 0x46f630
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4260d8
mov edx, dword [str.ZVMNSrvr.Log]
mov ecx, dword [0x45ec88]
mov dword [eax], edx
mov edx, dword [0x45ec8c]
mov dword [eax + 4], ecx
mov cx, word [0x45ec90]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
mov eax, 0x46f630
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x426110
sub eax, edx
jne 0x426125
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
push 0x104
push ebx
push 0x470018
call fcn.0042ea40
push 0x470018
call fcn.00407530
add esp, 0x10
mov ecx, 0x45b5a5
mov eax, 0x470018
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426170
cmp dl, bl
je 0x42616c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426170
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x426150
xor eax, eax
jmp 0x426175
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4261c6
push ebx
push 0x23
push 0x470018
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, 0x470018
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x426190
mov edx, dword [str.Net_Protector]
mov ecx, dword [0x45bcac]
mov dword [eax], edx
mov edx, dword [0x45bcb0]
mov dword [eax + 4], ecx
mov cx, word [0x45bcb4]
mov dword [eax + 8], edx
mov dl, byte [0x45bcb6]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
mov eax, 0x470018
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4261d0
mov ecx, dword [str._npav4schedule.ini]
mov edx, dword [0x45ec74]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax], ecx
mov ecx, dword [0x45ec78]
mov dword [eax + 4], edx
mov edx, dword [0x45ec7c]
mov dword [eax + 8], ecx
mov cx, word [0x45ec80]
mov dword [eax + 0xc], edx
mov dl, byte [0x45ec82]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x40ee10
push ebx
push ebx
call esi
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x40c060
push ebx
push ebx
call esi
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push 0x40bbf0
push ebx
push ebx
call esi
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x40b740
push ebx
push ebx
call esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push 0x40ba80
push ebx
push ebx
call esi
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push 0x40bbc0
push ebx
push ebx
call esi
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push 0x40cfa0
push ebx
push ebx
call esi
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x40d170
push ebx
push ebx
call esi
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push 0x425ef0
push ebx
push ebx
call esi
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x40d490
push ebx
push ebx
call esi
lea ecx, [esp + 0x38]
push ecx
push ebx
push ebx
push 0x40d560
push ebx
push ebx
call esi
push 0x470018
call ebp
test eax, eax
jne 0x4262f0
lea edx, [esp + 0x64]
push edx
push ebx
push ebx
push 0x409ec0
push ebx
push ebx
call esi
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push 0x409330
push ebx
push ebx
call esi
push ebx
xor esi, esi
call fcn.0041e590
add esp, 4
mov ecx, 0x470380
call fcn.00406980
test eax, eax
jne 0x42630c
lea esi, [eax + 1]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x470128], ebx
mov dword [0x470124], ebx
mov dword [0x470120], ebx
push ebx
cmp esi, ebx
je 0x42633a
call fcn.0041e590
add esp, 4
push 0x3e8
call edi
jmp 0x426342
call fcn.0041f460
add esp, 4
mov ebp, 1
cmp dword [0x470124], ebp
jne 0x426386
mov dword [0x47014c], ebp
push ebx
cmp esi, ebx
je 0x426370
call fcn.0041e590
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x426393
call fcn.0041f460
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x426393
cmp dword [0x470128], ebp
jne 0x426393
call fcn.00407ba0
cmp dword [0x470130], 0x1e
jg 0x4263a2
add dword [0x470130], ebp
cmp dword [0x470138], 0x12c
jg 0x4263b9
add dword [0x470138], ebp
jmp 0x426312
cmp dword [0x47014c], ebp
jne 0x426312
call fcn.00408a30
mov dword [0x47014c], ebx
mov dword [0x470138], ebx
jmp 0x426312