Function at 0x667f4918
Capabilities:
Check if file exists
Create process on windows
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x6680448c]
push ebx
push esi
push edi
mov esi, 0x667f1584
lea edi, [ebp - 0x210]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
movsw word es:[edi], word [esi]
push 0x7e
xor eax, eax
pop ecx
lea edi, [ebp - 0x1fe]
xor edx, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
test eax, eax
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x438], edx
mov ebx, 0x80000001
je 0x667f4a0b
push ebx
push 0x667f2658
lea ecx, [ebp - 0x448]
call fcn.667f2eeb
xor esi, esi
cmp dword [ebp - 0x444], esi
lea ecx, [ebp - 0x448]
jne 0x667f4a06
push esi
push 0x667f2688
call fcn.667f3015
test eax, eax
lea ecx, [ebp - 0x448]
jne 0x667f49ba
mov dword [ebp - 0x438], esi
jmp 0x667f4a06
call fcn.667f2f19
push 0x80000002
push 0x667f2238
lea ecx, [ebp - 0x434]
call fcn.667f2eeb
cmp dword [ebp - 0x430], esi
lea ecx, [ebp - 0x434]
jne 0x667f4a06
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0x667f22bc
call fcn.667f2fc7
test eax, eax
jne 0x667f4a81
lea ecx, [ebp - 0x434]
call fcn.667f2f19
and word [ebp - 0x210], 0
call fcn.667f412f
test eax, eax
je 0x667f4a26
mov dword [ebp - 0x420], 1
or dword [ebp - 0x420], 2
push ebx
mov esi, 0x667f2530
push esi
lea ecx, [ebp - 0x434]
call fcn.667f2eeb
mov eax, dword [ebp - 0x430]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x428], eax
lea ecx, [ebp - 0x434]
jne 0x667f4a77
push edi
push 0x667f258c
call fcn.667f3015
test eax, eax
lea ecx, [ebp - 0x434]
je 0x667f4b12
or dword [ebp - 0x420], 4
call fcn.667f2f19
jmp 0x667f4cf9
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x434]
mov esi, eax
call fcn.667f2f19
mov edi, dword [sym.imp.USER32.dll_CharPrevW]
lea eax, [ebp + esi*2 - 0x210]
push eax
lea eax, [ebp - 0x210]
push eax
call edi
mov esi, eax
mov ax, word [esi]
cmp ax, 0x5c
je 0x667f4ad8
cmp ax, 0x3b
jne 0x667f4ae1
push esi
lea eax, [ebp - 0x210]
push eax
call edi
cmp word [eax], 0x5c
je 0x667f4ae1
mov word [esi], 0x5c
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 0x667f26b0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x667f4a0b
mov dword [ebp - 0x438], 1
jmp 0x667f4a13
call fcn.667f2f19
test byte [ebp - 0x420], 1
je 0x667f4ca2
test byte [ebp + 9], 1
je 0x667f4ca2
test byte [ebp + 9], 4
je 0x667f4bf9
push ebx
push esi
lea ecx, [ebp - 0x434]
call fcn.667f2eeb
mov eax, dword [ebp - 0x430]
cmp eax, edi
mov dword [ebp - 0x428], eax
jne 0x667f4bee
xor eax, eax
mov ecx, 0x82
lea edi, [ebp - 0x41c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x20a
lea eax, [ebp - 0x41c]
push eax
push 0x667f25a0
lea ecx, [ebp - 0x434]
call fcn.667f2fc7
test eax, eax
je 0x667f4bec
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x667f26d4
call edi
push 0x667f24c8
mov dword [ebp - 0x424], eax
call edi
mov ecx, dword [ebp - 0x424]
add ecx, eax
lea eax, [ecx + ecx + 0x20c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0x424], ecx
je 0x667f4bec
push 0x667f24c8
xor eax, eax
mov edi, ecx
push ecx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
xor edi, edi
lea ecx, [ebp - 0x434]
call fcn.667f2f19
cmp dword [ebp - 0x438], edi
jne 0x667f4c66
test byte [ebp + 9], 8
je 0x667f4c56
call sym.INETCFG.dll_IsSmartStart
test eax, eax
jne 0x667f4c56
push ebx
push esi
lea ecx, [ebp - 0x434]
call fcn.667f2eeb
mov eax, dword [ebp - 0x430]
cmp eax, edi
mov dword [ebp - 0x428], eax
jne 0x667f4c3f
push 1
push 0x667f258c
lea ecx, [ebp - 0x434]
call fcn.667f2f6b
or dword [ebp - 0x420], 4
lea ecx, [ebp - 0x434]
call fcn.667f2f19
jmp 0x667f4ce5
push 1
push edi
push dword [ebp - 0x424]
push 0x667f26f0
jmp 0x667f4c75
push 1
push edi
lea eax, [ebp - 0x210]
push eax
push 0x667f2724
push edi
push edi
call sub.SHELL32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x667f4c99
cmp eax, edi
jne 0x667f4c91
mov dword [ebp - 0x428], 0xe
jmp 0x667f4ce5
mov dword [ebp - 0x428], eax
jmp 0x667f4ce5
or byte [ebp - 0x41f], 1
jmp 0x667f4ce5
test byte [ebp - 0x420], 2
je 0x667f4cf9
test byte [ebp + 9], 3
je 0x667f4cf9
push 1
push edi
push edi
push 0x667f270c
push edi
push edi
call sub.SHELL32.dll_ShellExecuteW
cmp eax, 0x20
ja 0x667f4cde
cmp eax, edi
jne 0x667f4cd6
mov dword [ebp - 0x428], 0xe
jmp 0x667f4cf9
mov dword [ebp - 0x428], eax
jmp 0x667f4cf9
or byte [ebp - 0x41f], 2
cmp dword [ebp - 0x424], edi
je 0x667f4cf9
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x43c]
mov ecx, dword [ebp - 0x420]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x428]
pop esi
pop ebx
call fcn.6680214e
leave
ret 8