Function at 0x401cde
Capabilities:
Check mutex on windows
Create process on windows
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x5e4
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 0x6c]
push ebx
push esi
push edi
mov dword [ebp + 0x64], eax
call fcn.00401044
xor edi, edi
mov ebx, eax
cmp ebx, edi
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x50], edi
je 0x401d9c
call fcn.00401088
test eax, eax
mov eax, str.GlobalShadowLaunchMutex
jne 0x401d24
mov eax, str.ShadowLaunchMutex
push eax
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, edi
mov dword [ebp + 0x54], eax
jne 0x401d45
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.Failed_to_acquire_mutex.__Error_code:__d
jmp 0x401d69
push str.ShadowLaunchEvent
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, edi
mov dword [ebp + 0x50], eax
jne 0x401d85
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.Failed_to_create_event.__Error_code:__d
mov esi, 0x40cc40
push esi
call fcn.004025e1
add esp, 0xc
push esi
call fcn.00401165
pop ecx
mov eax, edi
jmp 0x4023c3
push 0x409b7d
call fcn.00401165
mov dword [esp], str.ShadowLaunch_started
call fcn.00401165
pop ecx
push str.mscoree.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
je 0x4022d7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x57c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jbe 0x4022be
lea eax, [ebp - 0x57c]
push eax
push edi
push 0x40a1b8
lea eax, [ebp - 0x57c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jbe 0x4022be
cmp ebx, edi
mov esi, 0x40cc40
je 0x401e16
lea eax, [ebp - 0x57c]
push eax
push str.Extracting_embedded_exe_to__s
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
lea eax, [ebp - 0x57c]
push eax
call fcn.00401b00
cmp eax, edi
pop ecx
mov dword [ebp + 0x60], eax
jne 0x401fac
push dword [ebp + 0x78]
call fcn.00402640
mov ebx, eax
lea eax, [ebp - 0x57c]
push eax
call fcn.00402640
lea eax, [ebx + eax + 2]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004027d0
lea eax, [ebp - 0x57c]
mov ebx, esp
push eax
push ebx
call fcn.004026d0
push 0x40a194
push ebx
call fcn.004026e0
push dword [ebp + 0x78]
push ebx
call fcn.004026e0
add esp, 0x18
mov dword [ebp + 0x78], ebx
call fcn.00401000
test eax, eax
jne 0x401e96
call fcn.004013aa
xor ecx, ecx
inc ecx
cmp eax, ecx
mov dword [ebp + 0x58], ecx
je 0x401e99
mov dword [ebp + 0x58], edi
push 0x5c
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.00402810
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 0xc
cmp dword [ebp + 0x58], edi
je 0x401f2f
push 1
call fcn.00401275
pop ecx
push 0x104
lea eax, [ebp - 0x374]
push eax
call ebx
lea eax, [ebp - 0x374]
push 0x5c
push eax
call fcn.004023de
push dword [edi + 0x40c040]
push eax
call fcn.004026d0
add esp, 0x10
push 0
push 0x80
push 3
push 0
push 7
push 0x80000000
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea ecx, [ebp - 0x374]
push ecx
push eax
push str.handle:_0x_08X_locked_file:__s
push esi
mov dword [ebp + edi - 0x68], eax
call fcn.004025e1
push esi
call fcn.00401165
add edi, 4
add esp, 0x14
cmp edi, 0x5c
jb 0x401ebb
xor edi, edi
cmp dword [ebp + 0x5c], edi
je 0x401fe0
push 0x104
lea eax, [ebp - 0x16c]
push eax
call ebx
push str.Microsoft.NETFramework_
lea eax, [ebp - 0x16c]
push 0x5c
push eax
call fcn.004023de
pop ecx
pop ecx
push eax
call fcn.004026d0
push dword [0x40c09c]
lea eax, [ebp - 0x16c]
push eax
call fcn.004026e0
lea eax, [ebp - 0x16c]
push 0x40a154
push eax
call fcn.004026e0
push str.User_is_NT_admin__preparing_to_shadow_launch_the_process.
call fcn.00401165
push 0x4015e2
push 0xa
mov edi, 0x40c0a4
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.004014be
add esp, 0x2c
jmp 0x401fe5
cmp eax, 2
jne 0x401fc9
cmp ebx, edi
je 0x401e7e
push str.No_embedded_exe_found.__Using_command_line.
call fcn.00401165
pop ecx
jmp 0x401e7e
push eax
push str.Failed_to_extract_embedded_exe.__Error_code:__d
push esi
call fcn.004025e1
push esi
call fcn.00401165
jmp 0x402235
mov edi, 0x40c0a4
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00402810
push 0x10
lea eax, [ebp + 0x38]
push 0
push eax
mov dword [ebp - 0xc], ebx
call fcn.00402810
add esp, 0x18
cmp dword [ebp + 0x5c], 0
mov ebx, 0x409b7d
je 0x402035
push ebx
call fcn.00401165
push dword [ebp + 0x78]
push str.Executing:__s
push esi
call fcn.004025e1
push esi
call fcn.00401165
push ebx
call fcn.00401165
add esp, 0x18
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0xc]
push eax
xor eax, eax
push eax
push eax
push 0x8000000
push 1
push eax
push eax
push dword [ebp + 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x402240
cmp dword [ebp + 0x5c], 0
mov eax, dword [ebp + 0x38]
mov dword [ebp + 0x78], eax
je 0x402105
mov ebx, dword [ebp + 0x50]
push 0x1388
mov dword [ebp + 0x48], eax
push 0
lea eax, [ebp + 0x48]
push eax
push 2
mov dword [ebp + 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
sub eax, 0
je 0x4020c7
dec eax
je 0x4020c0
sub eax, 0x7f
je 0x4020b9
sub eax, 0x82
je 0x4020b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Failed_to_wait_on_process_signal.__Error_code:__d
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
jmp 0x4020d2
push str.Timed_out_wating_for_signal_from_created_process__continuing.
jmp 0x4020cc
push str.Received_signal_from_created_process__continuing.
jmp 0x4020cc
push str.Process_exited_without_signaling__continuing.
call fcn.00401165
pop ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
push 0x4017f0
push 0xa
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.004014be
add esp, 0x10
push dword [ebp + 0x54]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp + 0x54]
call ebx
mov ebx, 0x409b7d
push 0xffffffffffffffff
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
jne 0x402144
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
cmp dword [ebp + 0x5c], edi
mov dword [ebp + 0x60], eax
je 0x402146
push ebx
call fcn.00401165
push dword [ebp + 0x60]
push str.Failed_to_wait_on_process:_error__d
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x14
jmp 0x402146
xor edi, edi
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40216c
cmp dword [ebp + 0x5c], edi
je 0x40219d
push ebx
call fcn.00401165
push dword [ebp + 0x60]
push str.Process_returned:__d
jmp 0x402188
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp + 0x5c], edi
mov dword [ebp + 0x60], eax
je 0x40219d
push ebx
call fcn.00401165
push dword [ebp + 0x60]
push str.Could_not_get_process_exit_code:_error__d
push esi
call fcn.004025e1
push esi
call fcn.00401165
push ebx
call fcn.00401165
add esp, 0x18
cmp dword [ebp + 0x58], edi
je 0x4021b6
push edi
call fcn.00401275
lea eax, [ebp - 0x68]
push 0x17
push eax
call fcn.00401250
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x57c]
push eax
call ebx
push 0x64
pop edi
test eax, eax
jne 0x402217
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x57c]
push eax
call ebx
add edi, 0x64
cmp edi, 0x3e8
jle 0x4021c8
test eax, eax
jne 0x402217
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x57c]
push eax
push str.Could_not_delete_temporary_file__s:_error__d
push esi
call fcn.004025e1
push 0x409b7d
call fcn.00401165
push esi
call fcn.00401165
add esp, 0x18
cmp dword [ebp + 0x5c], 0
je 0x402238
push 0x401a01
push 0xa
lea eax, [ebp - 0x16c]
push 0x40c0a4
push eax
call fcn.004014be
add esp, 0x10
mov eax, dword [ebp + 0x60]
jmp 0x4023c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 0x78]
mov dword [ebp + 0x60], eax
push eax
push str.Failed_to_create_process.__Error_code:__d.__Command_line:__s
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x14
lea eax, [ebp - 0x57c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
cmp dword [ebp + 0x5c], esi
je 0x4022a0
push 0x4017f0
push 0xa
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.004014be
push 0x401a01
push 0xa
lea eax, [ebp - 0x16c]
push edi
push eax
call fcn.004014be
add esp, 0x20
cmp dword [ebp + 0x58], esi
je 0x402238
lea eax, [ebp - 0x68]
push 0x17
push eax
call fcn.00401250
push esi
call fcn.00401275
add esp, 0xc
jmp 0x402238
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebp + 0x60], eax
push str.Failed_to_get_temp_filename.__Error_code:__d
mov esi, 0x40cc40
jmp 0x401fcf
push 0x66a
push str..NET_Framework_is_not_present.__Returning_error__d
mov esi, 0x40cc40
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
push edi
mov ebx, 0x208
push ebx
push esi
push edi
push 0x66a
push edi
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jbe 0x4023be
push esi
call fcn.00401165
pop ecx
push ebx
lea eax, [ebp - 0x374]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x402378
lea eax, [ebp - 0x374]
push eax
call fcn.00402640
pop ecx
jmp 0x40234b
cmp byte [ebp + eax - 0x374], 0x5c
je 0x402351
dec eax
cmp eax, edi
jg 0x402340
jmp 0x40237f
lea eax, [ebp + eax - 0x373]
mov cl, byte [eax]
test cl, cl
mov byte [ebp - 0x374], cl
je 0x40237f
lea ecx, [ebp - 0x374]
mov edx, eax
inc edx
mov al, byte [edx]
inc ecx
test al, al
mov byte [ecx], al
jne 0x40236c
jmp 0x40237f
and byte [ebp - 0x374], 0
cmp byte [0x40cc40], 0
je 0x4023ad
mov ebx, esi
mov edi, 0x40cc41
mov al, byte [ebx]
cmp al, 0xd
je 0x402399
cmp al, 0xa
jne 0x4023a4
push edi
push ebx
call fcn.004026d0
pop ecx
dec edi
pop ecx
dec ebx
inc edi
inc ebx
cmp byte [ebx], 0
jne 0x40238f
xor edi, edi
push 0x30
lea eax, [ebp - 0x374]
push eax
push esi
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x66a
lea esp, [ebp - 0x588]
mov ecx, dword [ebp + 0x64]
xor ecx, dword [ebp + 0x6c]
call fcn.004025c0
pop edi
pop esi
pop ebx
add ebp, 0x68
leave
ret 0x10