Function at 0x4159b0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x42c
mov eax, dword [0x48e050]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [esp + 0x430]
push ebx
mov ebx, dword [esp + 0x43c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x450]
mov esi, edx
push esi
push str.dwThreadId:__d
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ecx
call fcn.00404c20
add esp, 8
test esi, esi
je 0x415ad8
mov edx, dword [esp + 0x444]
push edx
mov ecx, esi
call fcn.00415890
mov ebp, eax
test ebp, ebp
je 0x415ab8
mov eax, dword [esp + 0x444]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp eax, 0xffffffff
je 0x415ac3
push edi
mov esi, eax
lea ebx, [esp + 0x22c]
mov ecx, ebp
call fcn.004157a0
test eax, eax
je 0x415abf
mov ecx, ebx
push 0x479958
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x415aab
mov edx, ebx
push str.BkavFirewallEngine.dll
push edx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x415aab
mov eax, ebx
push str.BkavSaferunEngine.dll
push eax
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x415aab
mov ecx, ebx
push str.API_MS_Win_Core_Memory_L1_1_0.dll
push ecx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x415aab
mov edx, ebx
push str.KernelBase.dll
push edx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x415ad4
push str.Dang_trong_qua_trinh_create_process
call fcn.00404c20
add esp, 4
xor eax, eax
jmp 0x415b63
mov ebx, dword [esp + 0x18]
push ebx
push 0x104
push edi
call fcn.0043efc3
add esp, 0xc
jmp 0x415ad8
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x44c]
test ebp, ebp
je 0x415b5e
mov esi, dword [esp + 0x1c]
add esi, 0x680
push esi
push str.m_safeBrowserPath:__s
call fcn.00404c20
add esp, 8
mov ecx, 0x457780
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x415b28
test dx, dx
je 0x415b24
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x415b28
add eax, 4
add ecx, 4
test dx, dx
jne 0x415b02
xor eax, eax
jmp 0x415b2d
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x14]
test eax, eax
je 0x415b7e
push esi
push edi
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x415b7e
push esi
push ebx
call fcn.0043ec25
add esp, 8
test eax, eax
je 0x415b7e
push str.Block_safepayment
call fcn.00404c20
add esp, 4
mov eax, 2
mov ecx, dword [esp + 0x434]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043e4c7
add esp, 0x42c
ret 0x18
push edi
push ebx
call fcn.0043ec25
add esp, 8
test eax, eax
jne 0x415b9d
push str.Inject_same_path
call fcn.00404c20
add esp, 4
xor eax, eax
jmp 0x415b63
push ebx
call fcn.00406e10
add esp, 4
test eax, eax
jne 0x415bcb
push edi
call fcn.00406e10
add esp, 4
test eax, eax
je 0x415bcb
push str.Inject_to_file_system
call fcn.00404c20
add esp, 4
mov eax, 1
jmp 0x415b63
push ebp
push str.dwTargetPID:__d
call fcn.00404c20
mov edi, dword [esp + 0x44c]
push edi
push str.dwProcessId:__d
call fcn.00404c20
push ebp
call fcn.00406b40
mov esi, eax
add esp, 0x14
test esi, esi
je 0x415ab8
push esi
push str.dwParentPID:__d
call fcn.00404c20
add esp, 8
cmp esi, edi
jne 0x415b5e
push 0x103
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x415ab8
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415c30
mov edi, dword [esp + 0x14]
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x415c60
push str.Inject_vao_file_trong_thu_muc_WINDOWS
jmp 0x415b56
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x2b
lea edx, [esp + 0x28]
push edx
push 0
call esi
test eax, eax
je 0x415ab8
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415c82
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x24]
push edi
push eax
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x415cae
push str.Inject_vao_file_trong_thu_muc__Program_FilesCommon_
jmp 0x415b56
push 0
push 0x26
lea ecx, [esp + 0x28]
push ecx
push 0
call esi
test eax, eax
je 0x415ab8
push str.Internet_Explorer
lea edx, [esp + 0x24]
push 0x104
push edx
call fcn.0043f083
lea eax, [esp + 0x2c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x415ce1
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x24]
push edi
push eax
call fcn.0043f6d2
add esp, 0xc
test eax, eax
jne 0x415d0d
push str.Inject_vao_file_trong_thu_muc__Program_FilesInternet_Explorer_
jmp 0x415b56
mov esi, dword [esp + 0x454]
push esi
push str.dwSizeInject:__d
call fcn.00404c20
add esp, 8
cmp esi, 0x3e8
jbe 0x415d34
push str.Kich_thuoc_inject_lon
jmp 0x415b56
push str.La_tien_trinh_cha_inject_vao_tien_trinh_con
call fcn.00404c20
add esp, 4
xor eax, eax
jmp 0x415b63