Function at 0x41a4a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x4b93f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x5b8], 2
jne 0x41a686
push 0x2f
push dword [0x4c10fc]
call fcn.0044c2da
mov esi, eax
add esp, 8
test esi, esi
jne 0x41a4e0
or esi, 0xffffffff
jmp 0x41a4e8
sub esi, dword [0x4c10fc]
sar esi, 1
lea eax, [ebp - 0x218]
mov ecx, ebx
push eax
call fcn.0041de40
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x41ac7e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp - 0x218]
add eax, 0x10
mov dword [ebp - 0x210], eax
cmp dword [edi - 0xc], 0
jne 0x41a553
mov eax, dword [0x4c10fc]
mov ecx, 0x4c10fc
mov eax, dword [eax - 0xc]
sub eax, esi
dec eax
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0042e970
push eax
lea ecx, [ebp - 0x210]
call fcn.00409a20
mov edx, dword [ebp - 0x21c]
or esi, 0xffffffff
jmp 0x41a5b5
push str..exe
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push str.pcmastersetup_
push eax
call fcn.0040a220
add esp, 0xc
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.0040a190
add esp, 0xc
lea ecx, [ebp - 0x210]
push eax
call fcn.00409a20
mov edx, dword [ebp - 0x21c]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a5af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x220]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a5cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x41ac88
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [ebp - 0x210]
add eax, 0x10
push dword [ebx + 0x594]
mov dword [ebp - 0x218], eax
lea eax, [ebp - 0x218]
push str._supgrade_s
push eax
call fcn.0041ad10
mov esi, dword [ebp - 0x218]
add esp, 0x10
push 5
push 0
push 0x4a1628
push esi
push str.open
push dword [ebx + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0
push 0x10
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41a650
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x210]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a66d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41ac6d
mov ecx, dword [edi]
push edi
jmp 0x41ac68
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x41ac92
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x210], eax
call fcn.00402250
mov ecx, eax
test ecx, ecx
je 0x41ac9c
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [ebx + 0x5b8], 1
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x211], 0
jne 0x41ac35
mov edi, dword [0x4c10bc]
xor esi, esi
mov edx, dword [0x4c10b8]
mov ecx, edi
sub ecx, edx
sar ecx, 2
test ecx, ecx
je 0x41a71f
nop word [eax + eax]
mov eax, dword [edx + esi*4]
cmp byte [eax + 0x24], 0
je 0x41a713
cmp byte [eax + 0x29], 0
je 0x41a713
push eax
mov ecx, ebx
call fcn.0040e7e0
mov edi, dword [0x4c10bc]
mov edx, dword [0x4c10b8]
mov eax, edi
inc esi
sub eax, edx
sar eax, 2
cmp esi, eax
jb 0x41a6f0
sub edi, edx
xor esi, esi
sar edi, 2
test edi, edi
je 0x41a7a6
nop word [eax + eax]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x4c10b8]
mov eax, dword [eax + esi*4]
cmp byte [eax + 0x24], 0
je 0x41a793
cmp byte [eax + 0x29], 0
je 0x41a793
push eax
mov ecx, ebx
call fcn.0040d4c0
mov eax, dword [0x4c10b8]
push str.winguard
mov eax, dword [eax + esi*4]
push dword [eax + 8]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x41a78c
mov eax, dword [0x4c10b8]
push str.winguard_x64
mov eax, dword [eax + esi*4]
push dword [eax + 8]
call fcn.0046b1da
add esp, 8
test eax, eax
jne 0x41a793
mov byte [ebp - 0x211], 1
mov eax, dword [0x4c10bc]
inc esi
sub eax, dword [0x4c10b8]
sar eax, 2
cmp esi, eax
jb 0x41a730
call fcn.0041ca70
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
mov dword [ebp - 0x220], eax
mov eax, 0x2aaaaaab
mov dword [ebp - 0x218], ecx
mov ecx, dword [ebx + 0x13c]
sub ecx, dword [ebx + 0x138]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x41ab5d
xor edi, edi
mov eax, dword [ebx + 0x138]
cmp byte [eax + edi + 8], 0
jne 0x41ab2c
push dword [eax + edi]
lea eax, [ebp - 0x210]
push dword [ebx + 0x594]
push 0x4a656c
push eax
call fcn.0041ad10
mov eax, dword [ebx + 0x138]
push str.tempmon
push dword [eax + edi]
call fcn.0046b1da
add esp, 0x18
test eax, eax
je 0x41ab14
mov eax, dword [ebx + 0x138]
push str.netmaster
push dword [eax + edi]
call fcn.0046b1da
add esp, 8
test eax, eax
je 0x41ab14
mov esi, dword [ebx + 0x138]
mov eax, dword [esi + edi]
cmp dword [eax - 0xc], 0
jl 0x41a872
push str.winguard
push eax
call fcn.0044b974
add esp, 8
test eax, eax
je 0x41a872
sub eax, dword [esi + edi]
sar eax, 1
jns 0x41a89a
mov esi, dword [ebx + 0x138]
mov eax, dword [esi + edi]
cmp dword [eax - 0xc], 0
jl 0x41a8e8
push str.winguard_x64
push eax
call fcn.0044b974
add esp, 8
test eax, eax
je 0x41a8e8
sub eax, dword [esi + edi]
sar eax, 1
js 0x41a8e8
mov eax, dword [ebx + 0x138]
push dword [eax + edi]
lea eax, [ebp - 0x210]
push dword [ebx + 0x594]
push 0x4a656c
push eax
call fcn.0041ad10
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x10
push 5
push 0
push str._fromrmup
push dword [ebp - 0x210]
push str.open
push dword [ebx + 4]
call esi
mov byte [ebp - 0x211], 0
jmp 0x41ab2c
mov ecx, dword [ebx + 0x138]
add ecx, edi
cmp byte [ecx + 9], 0
je 0x41aa9d
cmp dword [ebp - 0x220], 0x13
jl 0x41aa9d
lea ecx, [ebp - 0x250]
call fcn.00408110
push ecx
mov ecx, esp
push str.explorer.exe
call fcn.00403710
push ecx
mov esi, esp
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.0044c180
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x20c]
mov ecx, esi
push eax
call fcn.00403710
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x254]
call fcn.0042b620
lea eax, [ebp - 0x210]
push eax
push 0x4a4a84
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0040a190
add esp, 0xc
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.0040a120
mov edx, dword [ebp - 0x224]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a9ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x234], eax
call fcn.00403380
add eax, 0x10
lea ecx, [ebp - 0x254]
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x22c]
push eax
call fcn.0041cfd0
push dword [eax]
mov eax, dword [ebp - 0x228]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
mov dword [ebp - 0x230], eax
call fcn.00403380
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.0043d150
mov edx, dword [ebp - 0x22c]
or esi, 0xffffffff
add esp, 8
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x230]
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa50
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x234]
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa6a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x240]
call fcn.00402130
mov edx, dword [ebp - 0x240]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41aa92
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x41ab2c
call fcn.00426380
mov ecx, str.pcmaster
mov eax, dword [eax]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41aad6
test dx, dx
je 0x41aad2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41aad6
add eax, 4
add ecx, 4
test dx, dx
jne 0x41aab0
xor eax, eax
jmp 0x41aadb
sbb eax, eax
or eax, 1
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0
test eax, eax
jne 0x41aaff
cmp byte [ebx + 0x5dd], al
jne 0x41aaf8
push str._fromrmup__hide
jmp 0x41ab1d
push str._fromrmup
jmp 0x41ab1d
push str._fromrmup
push dword [ebp - 0x210]
push str.open
push dword [ebx + 4]
jmp 0x41ab2a
push 5
push 0
push str.__tray
push dword [ebp - 0x210]
push str.open
push 0
call esi
mov ecx, dword [ebx + 0x13c]
mov eax, 0x2aaaaaab
sub ecx, dword [ebx + 0x138]
add edi, 0xc
inc dword [ebp - 0x218]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [ebp - 0x218], eax
jb 0x41a7e3
cmp byte [ebp - 0x211], 0
je 0x41ab99
push dword [ebx + 0x594]
lea eax, [ebp - 0x210]
push 0x4a6a60
push eax
call fcn.0041ad10
add esp, 0xc
push 5
push 0
push str._copyfile
push dword [ebp - 0x210]
push str.open
push dword [ebx + 4]
call esi
push 0
push str._TweakCube3
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x41ac35
mov ecx, dword [0x4c10a4]
mov edx, str.pcmaster
nop dword [eax + eax]
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x41abe6
test ax, ax
je 0x41abe2
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x41abe6
add ecx, 4
add edx, 4
test ax, ax
jne 0x41abc0
xor eax, eax
jmp 0x41abeb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x41ac35
push eax
push eax
push 0x10
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebx + 0x594]
lea eax, [ebp - 0x210]
push str._spcmaster.exe
push eax
call fcn.0041ad10
add esp, 0xc
push 5
push 0
push str._fromrmup
push dword [ebp - 0x210]
push str.open
push dword [ebx + 4]
call esi
mov edx, dword [ebp - 0x238]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ac52
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x210]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41ac6d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004495f3
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
push 0x80004005
call fcn.00402080
int3