Function at 0x40c110
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x461edc
mov eax, dword fs:[0]
push eax
sub esp, 0x2a8
mov eax, dword [0x488480]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x2b4], esi
mov dword [ebp - 0x27c], esi
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb0a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov ebx, str.SoftwareLife_Racing
mov dword [ebp - 4], 0
shr ebx, 0x10
mov eax, str.SoftwareLife_Racing
movzx edi, ax
mov ecx, esi
test ebx, ebx
jne 0x40c196
push edi
call fcn.0040a210
jmp 0x40c1a2
push 0x14
push str.SoftwareLife_Racing
call fcn.00404510
add esi, 4
mov dword [ebp - 4], 1
mov dword [ebp - 0x27c], esi
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb14
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov byte [ebp - 4], 2
mov ecx, esi
test ebx, ebx
jne 0x40c1dd
push edi
call fcn.0040a210
jmp 0x40c1e9
push 0x14
push str.SoftwareLife_Racing
call fcn.00404510
mov esi, dword [ebp - 0x298]
lea eax, [ebp - 0x29c]
push 0x466664
push esi
push eax
mov byte [ebp - 4], 3
call fcn.00405340
push str.LifeUninstall
lea ecx, [esi + 8]
mov byte [ebp - 4], 4
push eax
push ecx
mov dword [ebp - 0x27c], ecx
call fcn.00405340
add esp, 0x18
mov edx, dword [ebp - 0x29c]
or eax, 0xffffffff
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c243
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0
push 0x1c
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40cae8
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb1e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x40c29d
movzx eax, ax
lea ecx, [ebp - 0x268]
push eax
call fcn.0040a210
jmp 0x40c2c2
lea ecx, [ebp - 0x114]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c2a6
sub ecx, edx
lea eax, [ebp - 0x114]
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00404510
mov eax, dword [ebp - 0x268]
mov ecx, str.Life_RacingLifeUninstallRegistryBackups_
sub ecx, eax
mov byte [ebp - 4], 8
push 0x2b
push str.Life_RacingLifeUninstallRegistryBackups_
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0x280], ecx
call fcn.004409f4
mov edi, eax
add esp, 8
mov eax, 0x7fffffff
sub eax, edi
cmp eax, ebx
jl 0x40cb5a
lea esi, [edi + ebx]
test esi, esi
js 0x40cb5a
mov eax, dword [ebp - 0x268]
mov edx, 1
mov ecx, dword [eax - 8]
sub edx, dword [eax - 4]
sub ecx, esi
or ecx, edx
jge 0x40c330
push esi
lea ecx, [ebp - 0x268]
call fcn.00404340
mov eax, dword [ebp - 0x268]
mov ecx, dword [ebp - 0x280]
lea edx, [ecx + eax]
cmp ecx, ebx
jbe 0x40c342
mov edx, str.Life_RacingLifeUninstallRegistryBackups_
lea ecx, [ebx + eax]
test edi, edi
je 0x40c37f
test ecx, ecx
je 0x40c369
push edi
test edx, edx
je 0x40c35e
push edx
push ecx
call fcn.0043b6d0
add esp, 0xc
jmp 0x40c379
push 0
push ecx
call fcn.0043bc50
add esp, 0xc
call fcn.0043f6ad
mov dword [eax], 0x16
call fcn.0043f5af
mov eax, dword [ebp - 0x268]
cmp esi, dword [eax - 8]
jg 0x40cb5a
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x268]
mov byte [esi + eax], 0
lea eax, [ebp - 0x268]
push eax
call fcn.00405d80
add esp, 4
test al, al
je 0x40cac6
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x2b0]
xor esi, esi
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x28c], esi
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb28
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x280], eax
mov byte [ebp - 4], 9
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb32
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x290], eax
mov byte [ebp - 4], 0xa
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb3c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x270], edi
mov byte [ebp - 4], 0xb
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb46
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x274], eax
push dword [ebp - 0x268]
lea eax, [ebp - 0x290]
mov byte [ebp - 4], 0xc
push str._sLifeUninstall..reg
push eax
call fcn.004063c0
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x290]
call fcn.00407c20
add esp, 0x14
mov dword [ebp - 0x2a8], eax
cmp eax, 0xffffffff
je 0x40ca0b
lea eax, [ebp - 0x238]
shr eax, 0x10
or ebx, 0xffffffff
mov dword [ebp - 0x2a0], eax
mov esi, eax
mov edx, dword [ebp - 0x25c]
mov eax, dword [ebp - 0x260]
mov dword [ebp - 0x294], esi
cmp edx, dword [ebp - 0x288]
ja 0x40c4f2
mov ecx, dword [ebp - 0x284]
jb 0x40c4e6
cmp eax, ecx
jae 0x40c4f2
sub ecx, eax
mov eax, dword [ebp - 0x288]
sbb eax, edx
jmp 0x40c50e
mov esi, dword [ebp - 0x2a0]
mov ecx, eax
sub ecx, dword [ebp - 0x284]
mov eax, edx
mov dword [ebp - 0x294], esi
sbb eax, dword [ebp - 0x288]
cmp eax, 0x1792
jb 0x40c5fa
ja 0x40c527
cmp ecx, 0xf8648000
jbe 0x40c5fa
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb0a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0xd
test esi, esi
jne 0x40c563
lea eax, [ebp - 0x238]
movzx eax, ax
lea ecx, [ebp - 0x26c]
push eax
call fcn.0040a210
jmp 0x40c58c
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c570
sub ecx, edx
lea eax, [ebp - 0x238]
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.00404510
lea eax, [ebp - 0x26c]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.004051d0
push dword [eax]
mov byte [ebp - 4], 0xf
call fcn.00407b50
mov edx, dword [ebp - 0x2a4]
add esp, 0x10
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c5d9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x26c]
mov eax, ebx
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40c5fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00404210
mov ecx, eax
test ecx, ecx
je 0x40cb0a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0x10
test esi, esi
jne 0x40c636
lea eax, [ebp - 0x238]
movzx eax, ax
lea ecx, [ebp - 0x26c]
push eax
call fcn.0040a210
jmp 0x40c65c
lea ecx, [ebp - 0x238]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c640
sub ecx, edx
lea eax, [ebp - 0x238]
push ecx
push eax
lea ecx, [ebp - 0x26c]
call fcn.00404510
mov eax, dword [ebp - 0x26c]
lea ebx, [edi - 0x10]
mov byte [ebp - 4], 0x11
lea esi, [eax - 0x10]
cmp esi, ebx
je 0x40c6c8
cmp dword [ebx + 0xc], 0
lea edi, [ebx + 0xc]
jl 0x40c6b3
mov ecx, dword [esi]
cmp ecx, dword [ebx]
jne 0x40c6b3
push esi
call fcn.00405bf0
mov dword [ebp - 0x278], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40c6a2
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x278]
add edi, 0x10
mov dword [ebp - 0x270], edi
jmp 0x40c6c8
push dword [eax - 0xc]
lea ecx, [ebp - 0x270]
push eax
call fcn.00404510
mov edi, dword [ebp - 0x270]
mov byte [ebp - 4], 0xc
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c6e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi - 0xc]
xor ebx, ebx
lea eax, [ecx - 4]
test eax, eax
cmovns ebx, eax
cmp ebx, ecx
jl 0x40c709
lea eax, [edi - 0x10]
push eax
call fcn.00405bf0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
jmp 0x40c772
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x40c71b
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x40c731
call fcn.00404210
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x40cb0a
mov eax, dword [ecx]
push 1
push ebx
call dword [eax]
test eax, eax
je 0x40cb64
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
mov eax, esi
test ebx, ebx
js 0x40cb5a
cmp ebx, dword [esi - 8]
jg 0x40cb5a
mov dword [esi - 0xc], ebx
mov byte [ebx + esi], 0
test ebx, ebx
je 0x40c774
push ebx
push edi
push eax
call fcn.0043b6d0
add esp, 0xc
mov eax, esi
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0x12
lea ebx, [edi - 0x10]
cmp edx, ebx
je 0x40c7da
cmp dword [ebx + 0xc], 0
lea edi, [ebx + 0xc]
jl 0x40c7c5
mov ecx, dword [edx]
cmp ecx, dword [ebx]
jne 0x40c7c5
push edx
call fcn.00405bf0
mov dword [ebp - 0x26c], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40c7b4
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x26c]
add edi, 0x10
mov dword [ebp - 0x270], edi
jmp 0x40c7da
push dword [eax - 0xc]
lea ecx, [ebp - 0x270]
push eax
call fcn.00404510
mov edi, dword [ebp - 0x270]
or ebx, 0xffffffff
mov byte [ebp - 4], 0xc
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c7f8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2e
push edi
call fcn.0044114f
mov ecx, eax
add esp, 8
sub ecx, edi
test eax, eax
cmove ecx, ebx
mov ebx, dword [edi - 0xc]
xor esi, esi
lea eax, [ecx + 1]
test eax, eax
lea edx, [ebx - 1]
cmovns esi, eax
xor ecx, ecx
test edx, edx
mov eax, 0x7fffffff
cmovns ecx, edx
sub eax, esi
cmp eax, ecx
jl 0x40cb50
lea eax, [ecx + esi]
cmp eax, ebx
jle 0x40c83d
mov ecx, ebx
sub ecx, esi
mov edx, dword [edi - 0xc]
xor ebx, ebx
cmp esi, edx
cmovle ebx, ecx
test esi, esi
jne 0x40c86c
lea eax, [ebx + esi]
cmp eax, edx
jne 0x40c86c
lea eax, [edi - 0x10]
push eax
call fcn.00405bf0
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
jmp 0x40c91c
mov ecx, dword [edi - 0x10]
test ecx, ecx
je 0x40c889
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
je 0x40c889
lea eax, [esi + edi]
mov dword [ebp - 0x26c], eax
jmp 0x40c8a8
call fcn.00404210
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
lea eax, [esi + edi]
mov dword [ebp - 0x26c], eax
test ecx, ecx
je 0x40cb0a
test eax, eax
jne 0x40c8b4
test ebx, ebx
jne 0x40cb5a
mov eax, dword [ecx]
push 1
push ebx
call dword [eax]
test eax, eax
je 0x40cb64
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
mov eax, esi
test ebx, ebx
js 0x40cb5a
cmp ebx, dword [esi - 8]
jg 0x40cb5a
mov dword [esi - 0xc], ebx
mov byte [esi + ebx], 0
test ebx, ebx
je 0x40c91e
mov ecx, dword [ebp - 0x26c]
push ebx
test ecx, ecx
je 0x40c901
push ecx
push eax
call fcn.0043b6d0
add esp, 0xc
jmp 0x40c91c
push 0
push eax
call fcn.0043bc50
add esp, 0xc
call fcn.0043f6ad
mov dword [eax], 0x16
call fcn.0043f5af
mov eax, esi
mov ebx, dword [ebp - 0x274]
lea edx, [eax - 0x10]
add ebx, 0xfffffff0
mov byte [ebp - 4], 0x13
cmp edx, ebx
je 0x40c984
cmp dword [ebx + 0xc], 0
jl 0x40c975
mov ecx, dword [edx]
cmp ecx, dword [ebx]
jne 0x40c975
push edx
call fcn.00405bf0
mov dword [ebp - 0x26c], eax
lea ecx, [ebx + 0xc]
add esp, 4
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40c964
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x26c]
add eax, 0x10
mov dword [ebp - 0x274], eax
jmp 0x40c984
push dword [eax - 0xc]
lea ecx, [ebp - 0x274]
push eax
call fcn.00404510
or ebx, 0xffffffff
mov byte [ebp - 4], 0xc
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40c9a2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 0xa
push 0
push dword [ebp - 0x274]
call fcn.0044068b
mov ecx, eax
mov esi, dword [ebp - 0x28c]
shr eax, 0x1f
add esp, 0xc
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [eax*8 + 0x469860]
ucomisd xmm0, qword [0x469ce8]
lahf
test ah, 0x44
jnp 0x40c9e9
cmp ecx, esi
cmova esi, ecx
mov dword [ebp - 0x28c], esi
lea eax, [ebp - 0x264]
push eax
push dword [ebp - 0x2a8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40ca0e
mov esi, dword [ebp - 0x294]
jmp 0x40c4c0
or ebx, 0xffffffff
mov eax, dword [ebp - 0x27c]
inc esi
push esi
push dword [ebp - 0x268]
push dword [eax]
lea eax, [ebp - 0x280]
push str.EXPORT__HKCU_s____sLifeUninstall._u.reg___y
push eax
call fcn.004063c0
mov esi, dword [ebp - 0x280]
add esp, 0x14
push 0
push 0
push esi
push str.reg.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, dword [ebp - 0x274]
mov eax, ebx
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ca6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40ca88
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x290]
mov eax, ebx
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40caa9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40cac9
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40cac9
or ebx, 0xffffffff
mov edx, dword [ebp - 0x268]
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x40cae8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x298]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043a0ec
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80004005
call fcn.00404100
push 0x80070216
call fcn.00404100
push 0x80070057
call fcn.00404100
call fcn.00404660
int3