Function at 0x413ed0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f63fb
mov eax, dword fs:[0]
push eax
sub esp, 0xa7c
mov eax, dword [0x5365f0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x7fe
xor esi, esi
lea ecx, [ebp - 0xa1e]
xor eax, eax
push esi
push ecx
mov word [ebp - 0xa20], ax
call fcn.004da450
add esp, 0xc
lea ebx, [ebp - 0xa3c]
call fcn.004329e0
mov dword [ebp - 4], esi
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x413f38
mov eax, dword [eax]
push eax
lea edx, [ebp - 0xa20]
push 0x400
push edx
call fcn.004d72e3
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xa28], edi
jb 0x413f6b
mov eax, dword [ebp - 0xa3c]
push eax
call fcn.004d5559
add esp, 4
xor ecx, ecx
lea eax, [ebp - 0xa20]
mov dword [ebp - 0xa28], 7
mov dword [ebp - 0xa2c], esi
mov word [ebp - 0xa3c], cx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x413f90
sub eax, edx
sar eax, 1
cmp eax, esi
je 0x413fc0
lea eax, [ebp + eax*2 - 0xa22]
cmp eax, esi
je 0x413fc0
push 0x504a74
push eax
call fcn.004d5750
add esp, 8
test eax, eax
je 0x413fd9
push 0x504a74
lea edx, [ebp - 0xa20]
push 0x400
push edx
call fcn.004d65c3
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x21e]
xor eax, eax
push esi
push ecx
mov word [ebp - 0x220], ax
call fcn.004da450
add esp, 0xc
push 0x104
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x800
call fcn.004d4853
mov ebx, eax
add esp, 4
cmp ebx, esi
je 0x41415b
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
mov edi, ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x220]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, si
jne 0x414041
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x414053
mov ecx, 0xa
mov esi, str.wbemmofcomp.exe__
lea eax, [ebp - 0xa20]
rep movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414073
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x414083
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4140a2
mov ecx, 9
mov esi, str.AEWMIProvider.mof
rep movsd dword es:[edi], dword [esi]
lea edi, [ebx - 2]
lea ecx, [ecx]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4140c0
mov edx, dword [0x5052e4]
push 0x44
lea eax, [ebp - 0xa88]
push 0
push eax
mov dword [edi], edx
call fcn.004da450
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0xa30]
push ecx
lea edx, [ebp - 0xa88]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push eax
mov dword [ebp - 0xa88], 0x44
mov dword [ebp - 0xa30], eax
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa24], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x414152
mov eax, dword [ebp - 0xa30]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xa30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0xa2c]
push edx
call esi
push ebx
call fcn.004d632b
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d5564
mov esp, ebp
pop ebp
ret