Function at 0x40b41b
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2060
call fcn.0040d080
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, 3
push edi
jne 0x40b43a
xor eax, eax
jmp 0x40b659
test esi, 0x20000
je 0x40b455
push dword [0x415034]
mov edi, 0x421b7c
call fcn.00407ef2
pop ecx
jmp 0x40b45c
xor eax, eax
call fcn.00407ea9
test si, 0x200
je 0x40b468
call fcn.00402af3
mov dword [ebp - 0xc], esi
and dword [ebp - 0xc], 8
push 0
pop edi
mov esi, 0x421b90
je 0x40b4f1
cmp dword [0x415038], 0x174
jle 0x40b4f1
cmp dword [0x4219e0], edi
jne 0x40b4f1
mov ebx, 0x1000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b4a8
mov edx, esi
call fcn.00407458
jmp 0x40b4b0
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x205c]
push eax
mov edx, esi
call fcn.00405a2e
pop ecx
mov ecx, str._netprotdrvss.exe
lea eax, [ebp - 0x205c]
call fcn.00405a0a
push edi
push edi
push 1
push dword [0x4219e4]
push edi
push eax
push dword [0x425168]
call fcn.004029b8
add esp, 0x1c
test eax, eax
jne 0x40b433
test word [ebp + 8], 0x100
je 0x40b508
push 5
push str.begun.ru
call dword [sym.imp.WININET.dll_InternetSetPerSiteCookieDecisionW]
jmp 0x40b50e
call dword [sym.imp.WININET.dll_InternetClearAllPerSiteCookieDecisions]
call fcn.004038fc
test eax, eax
jne 0x40b52a
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xa
call fcn.0040aa55
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 8], 1
mov dword [ebp + 8], 0x41a90c
mov eax, dword [ebp + 8]
cmp dword [eax], edi
je 0x40b55f
mov ecx, dword [ebp - 8]
push edi
push edi
lea eax, [ebp + ebx*4 - 0x5c]
push eax
push fcn.0040b3a8
push edi
push edi
mov dword [eax], ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + ebx*4 - 0x34], eax
inc ebx
inc dword [ebp - 8]
add dword [ebp + 8], 0x144
cmp dword [ebp + 8], 0x41b470
jl 0x40b53a
cmp dword [0x41a7c8], edi
jne 0x40b57e
cmp ebx, edi
je 0x40b5b2
push 4
push edi
push 0xc
call fcn.0040aa55
add esp, 0xc
cmp dword [0x41a7c8], edi
je 0x40b59f
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], edi
call fcn.0040b3a8
cmp ebx, edi
je 0x40b5b2
push 0xffffffffffffffff
push 1
lea eax, [ebp - 0x34]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
cmp ebx, edi
mov dword [ebp + 8], edi
jle 0x40b5ce
mov eax, dword [ebp + 8]
push dword [ebp + eax*4 - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x40b5b9
call fcn.0040a998
call dword [sym.imp.WININET.dll_InternetClearAllPerSiteCookieDecisions]
cmp dword [ebp - 0xc], edi
je 0x40b656
cmp dword [0x415038], 0x174
jle 0x40b656
cmp dword [0x4219e0], edi
je 0x40b656
mov ebx, 0x1000
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40b60d
mov edx, esi
call fcn.00407458
jmp 0x40b615
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x205c]
push eax
mov edx, esi
call fcn.00405a2e
pop ecx
mov ecx, str._netprotdrvss.exe
lea eax, [ebp - 0x205c]
call fcn.00405a0a
push edi
push edi
push 1
push dword [0x4219e4]
push edi
push eax
push dword [0x425168]
call fcn.004029b8
add esp, 0x1c
test eax, eax
jne 0x40b433
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret