Function at 0x403d00
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x40d181
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x29c
push ebx
push esi
mov ebx, ecx
push edi
push 0x413634
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_3
push 0x413634
lea ecx, [esp + 0x10]
mov dword [esp + 0x2b4], 0
call sub.MFC42.DLL_CString::CString_3
push 0x413634
lea ecx, [esp + 0x18]
mov byte [esp + 0x2b4], 1
call sub.MFC42.DLL_CString::CString_3
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xa3
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b4], 2
stosb byte es:[edi], al
call sub.MFC42.DLL_CString::LoadStringA
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.004038a0
mov eax, dword [ebx + 0xa8]
test eax, eax
je 0x403e90
push 1
call fcn.004086f0
add esp, 4
lea ecx, [esp + 0x10]
test eax, eax
push 0xa0
je 0x403deb
call sub.MFC42.DLL_CString::LoadStringA
push str._64bit_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push 0x9f
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
jmp 0x403e16
call sub.MFC42.DLL_CString::LoadStringA
push str._64bit_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
push 0x9f
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.004038a0
push 0
call fcn.004086f0
add esp, 4
test eax, eax
je 0x403e5a
push 0x9f
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
push 0xa0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
push str._32bit_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
jmp 0x403ee2
push 0xd6
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
push 0xa0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
push str._32bit_
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::operator
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
jmp 0x403eec
push 0
call fcn.004086f0
add esp, 4
test eax, eax
je 0x403ec6
push 0x9f
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
push 0xa0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
jmp 0x403eec
push 0xd6
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
push 0xa0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push ecx
mov ecx, ebx
call fcn.004038a0
mov eax, dword [ebx + 0xa8]
push ebp
test eax, eax
mov dword [esp + 0x1c], 1
je 0x404059
mov ebp, str.Utility.dll
mov edi, str.ctplkcs.dll
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.ctplkcs.dll
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x403f30
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
jne 0x403ff4
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x24], esi
call dword [0x413688]
lea eax, [esp + 0x24]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
movsx ecx, byte [esp + 0x24]
push ecx
lea edx, [esp + 0x12c]
push str._c:WindowsSystem32
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x134]
push ebp
push eax
call fcn.00408b10
add esp, 0x14
test eax, eax
jne 0x403fe7
push 0x40
push ebp
lea ecx, [esp + 0x20]
push str.___s__d_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x10]
push 0xa2
call sub.MFC42.DLL_CString::LoadStringA
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, ebx
call fcn.004038a0
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x20]
push ecx
call dword [0x41368c]
jmp 0x40404a
lea edx, [esp + 0x24]
push edx
push 1
call fcn.00408bd0
lea eax, [esp + 0x2c]
push ebp
push eax
call fcn.00408b10
add esp, 0x10
test eax, eax
jne 0x40404a
push 0x40
push ebp
lea ecx, [esp + 0x20]
push str.___s__d_
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x10]
push 0xa2
call sub.MFC42.DLL_CString::LoadStringA
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, ebx
call fcn.004038a0
mov dword [esp + 0x1c], esi
add ebp, 0x40
cmp ebp, 0x40f3a0
jb 0x403f0f
mov ebp, 0x40eea0
mov edi, str.ctplkcs.dll
or ecx, 0xffffffff
xor eax, eax
mov esi, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.ctplkcs.dll
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40407f
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
jne 0x404187
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x129]
mov byte [esp + 0x128], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x24]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebx + 0xa8], esi
je 0x4040ed
lea edx, [esp + 0x20]
push edx
call dword [0x413688]
movsx eax, byte [esp + 0x24]
push eax
lea ecx, [esp + 0x12c]
push str._c:WindowsSysWOW64
push ecx
jmp 0x4040ff
lea edx, [esp + 0x24]
lea eax, [esp + 0x128]
push edx
push 0x4130a0
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [esp + 0x128]
push ebp
push ecx
call fcn.00408b10
add esp, 8
test eax, eax
jne 0x404172
cmp dword [ebx + 0xa8], esi
je 0x40413c
push 0x20
push ebp
lea edx, [esp + 0x20]
push str.___s__d_
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x40414f
push ebp
lea eax, [esp + 0x1c]
push 0x4130d8
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0xa2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, ebx
call fcn.004038a0
mov dword [esp + 0x1c], esi
cmp dword [ebx + 0xa8], esi
je 0x4041f9
lea eax, [esp + 0x20]
push eax
call dword [0x41368c]
jmp 0x4041f9
lea ecx, [esp + 0x24]
push ecx
push esi
call fcn.00408bd0
lea edx, [esp + 0x2c]
push ebp
push edx
call fcn.00408b10
add esp, 0x10
test eax, eax
jne 0x4041f9
cmp dword [ebx + 0xa8], esi
je 0x4041c3
push 0x20
push ebp
lea eax, [esp + 0x20]
push str.___s__d_
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
jmp 0x4041d6
push ebp
lea ecx, [esp + 0x1c]
push 0x4130d8
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0xa2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, ebx
call fcn.004038a0
mov dword [esp + 0x1c], esi
add ebp, 0x40
cmp ebp, str.Utility.dll
jb 0x40405e
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
jne 0x40424e
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b0], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2b0], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2b0], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x4043ce
lea ecx, [esp + 0x20]
push ecx
push 0
call fcn.00408bd0
push 1
push str.NISEC_Srv.exe
call fcn.00405550
add esp, 0x10
test eax, eax
je 0x404277
push 0xee
jmp 0x40436b
call fcn.00408e10
test eax, eax
jne 0x40428a
push 0xd3
jmp 0x40436b
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x125]
mov byte [esp + 0x124], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [esp + 0x229]
mov byte [esp + 0x228], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x124]
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x24]
push str.NISEC_Srv.exe
push eax
call fcn.004089a0
add esp, 0xc
test eax, eax
je 0x404366
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
lea ecx, [esp + 0x12c]
push 0x4130c4
push ecx
push 0
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call edi
push str.WTKeySrv_Name
lea edx, [esp + 0x22c]
push str.start__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x228]
push 0
push 0
push eax
push 0x4130a4
push 0
push 0
call esi
push 0x7d0
call edi
push 1
push str.NISEC_Srv.exe
call fcn.00405550
add esp, 8
test eax, eax
je 0x40435f
push 0xef
jmp 0x40436b
push 0xf0
jmp 0x40436b
push 0xf1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::LoadStringA
push 0xec
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::LoadStringA
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, ebx
call fcn.004038a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x2b0], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov byte [esp + 0x2b0], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0x2b0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [esp + 0x2a8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2a8
ret