Function at 0x40622f
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x4167cc
call fcn.0040c948
sub esp, 0x1b4
mov eax, dword [0x418718]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
call fcn.004053fa
xor eax, eax
push 0x40
mov byte [ebp - 0x14c], 0
pop ecx
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
je 0x4062af
cmp byte [eax], bl
je 0x4062af
push eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x14c]
push eax
call fcn.004049b1
lea eax, [ebp - 0x14c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40628f
sub eax, edx
cmp byte [ebp + eax - 0x14c], 0x5c
lea eax, [ebp - 0x14c]
je 0x4062ce
push 0x401530
jmp 0x4062d3
mov esi, 0x104
push esi
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
jne 0x406286
push 3
pop eax
jmp 0x40659a
push 0x401524
push esi
push eax
call fcn.00404f02
push 0x401520
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x14e], 1
call fcn.004061d7
mov eax, dword [ebp + 0x10]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x4064bb
cmp byte [eax], 0
je 0x4064bb
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x14d], 0
mov byte [ebp + 0xb], 0
call fcn.004061d7
mov ebx, dword [ebp - 0x28]
xor esi, esi
cmp dword [ebp - 0x14], 0x10
mov byte [ebp - 4], 1
jae 0x40632b
lea ebx, [ebp - 0x28]
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004058d8
cmp ebx, dword [eax]
je 0x4064a1
jmp 0x40634a
mov esi, dword [ebp - 0x154]
inc esi
push esi
push 0x40151c
lea ecx, [ebp - 0x2c]
call fcn.004058f4
cmp eax, 0xffffffff
mov dword [ebp - 0x154], eax
jne 0x406377
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004058d8
mov esi, dword [eax]
jmp 0x406385
cmp dword [ebp - 0x14], 0x10
mov esi, dword [ebp - 0x28]
jae 0x406383
lea esi, [ebp - 0x28]
add esi, eax
mov al, byte [ebx]
cmp al, 0x22
jne 0x40639a
cmp byte [ebp + 0xb], 0
sete al
mov byte [ebp + 0xb], al
jmp 0x406449
cmp byte [ebp + 0xb], 0
jne 0x406449
cmp al, 0x2f
jne 0x406449
lea eax, [ebp - 0x160]
push eax
lea ecx, [ebp - 0x2c]
lea edi, [ebx + 1]
call fcn.004058d8
cmp edi, dword [eax]
je 0x406449
movsx eax, byte [edi]
push eax
call fcn.0040cb96
cmp eax, 0x41
pop ecx
je 0x4063ee
cmp eax, 0x46
je 0x4063ee
cmp eax, 0x48
jle 0x406449
cmp eax, 0x4a
jle 0x4063ee
cmp eax, 0x57
jle 0x406449
cmp eax, 0x5a
jg 0x406449
mov byte [ebp - 0x14d], 1
mov byte [ebp - 0x14e], 0
lea esi, [ebx + 2]
jmp 0x406410
movsx eax, byte [esi]
push eax
call fcn.0040c9a1
test eax, eax
pop ecx
je 0x406423
inc esi
lea eax, [ebp - 0x158]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004058d8
cmp esi, dword [eax]
jne 0x406401
lea eax, [ebp - 0x164]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004058d8
cmp esi, dword [eax]
je 0x406442
mov eax, esi
sub eax, ebx
mov dword [ebp - 0x154], eax
jmp 0x406449
or dword [ebp - 0x154], 0xffffffff
push esi
push ebx
lea ecx, [ebp - 0x48]
call fcn.004061f9
cmp byte [ebp - 0x14d], 0
je 0x406488
push 0x401518
lea ecx, [ebp - 0x48]
call fcn.00406117
push dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
call fcn.00406117
push 0x401514
lea ecx, [ebp - 0x48]
call fcn.00406117
mov byte [ebp - 0x14d], 0
lea eax, [ebp - 0x15c]
push eax
lea ecx, [ebp - 0x2c]
mov ebx, esi
call fcn.004058d8
cmp esi, dword [eax]
jne 0x406344
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.00405917
xor ebx, ebx
cmp byte [ebp - 0x14e], bl
je 0x4064e0
push 0x40150c
lea ecx, [ebp - 0x48]
call fcn.00406117
push dword [ebp + 0xc]
lea ecx, [ebp - 0x48]
call fcn.00406117
push 0x401514
lea ecx, [ebp - 0x48]
call fcn.00406117
cmp dword [ebp + 0x14], ebx
je 0x4064f2
push 0x4014f8
lea ecx, [ebp - 0x48]
call fcn.00406117
push 0x11
xor eax, eax
cmp dword [ebp - 0x30], 0x10
pop ecx
lea edi, [ebp - 0x1c0]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c0], 0x44
mov dword [ebp - 0x194], 1
mov word [ebp - 0x190], 5
jae 0x406528
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x174]
push ecx
lea ecx, [ebp - 0x1c0]
push ecx
push ebx
push ebx
push 0x4000000
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40655c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x406581
push dword [ebp - 0x174]
call fcn.00404c8c
cmp eax, ebx
pop ecx
jne 0x406558
lea eax, [ebp - 0x178]
push eax
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor esi, esi
push dword [ebp - 0x174]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00405917
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0040b9d1
leave
ret