Function at 0x408410
Capabilities:
Check if file exists
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x595e6d
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x60dfd4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4a0], ecx
mov eax, dword [ebp + 0xc]
push 0x20a
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.0056eeb0
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x4088cc
cmp eax, 0x105
jae 0x4088cc
push str.Temp
lea eax, [ebp - 0x21c]
push 0x105
push eax
call fcn.00575aeb
add esp, 0xc
lea ecx, [ebp - 0x21c]
call fcn.0040cae0
test al, al
je 0x4088cc
call fcn.00421571
mov edi, eax
test edi, edi
je 0x4088ef
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
lea esi, [eax + 0x10]
mov dword [ebp - 0x430], esi
push 0x20a
lea eax, [ebp - 0x428]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.0056eeb0
add esp, 0xc
lea ecx, [ebp - 0x428]
call fcn.0040c480
or ebx, 0xffffffff
test al, al
jne 0x408516
mov ebx, 9
jmp 0x40889a
push dword [ebp + 8]
lea ecx, [ebp - 0x454]
call fcn.00406ae0
mov byte [ebp - 4], 1
call fcn.00421571
mov edi, eax
test edi, edi
je 0x4088f9
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
test eax, 0xffff0000
jne 0x40857e
movzx esi, ax
push esi
call fcn.0042e288
test eax, eax
je 0x4085a9
push esi
push eax
lea ecx, [ebp - 0x49c]
call fcn.004103f0
jmp 0x4085a9
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408587
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x49c]
call fcn.004050e0
mov byte [ebp - 4], 3
call fcn.00421571
mov edi, eax
test edi, edi
je 0x408903
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
add eax, 0x10
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x428]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x408603
movzx esi, ax
push esi
call fcn.0042e288
test eax, eax
je 0x408632
push esi
push eax
lea ecx, [ebp - 0x498]
call fcn.004103f0
jmp 0x408632
lea ecx, [ebp - 0x428]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408610
sub ecx, edx
lea eax, [ebp - 0x428]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x498]
call fcn.004050e0
xor ecx, ecx
mov byte [ebp - 4], 5
cmp byte [ebp - 0x444], cl
lea eax, [ebp - 0x440]
cmove eax, ecx
lea ecx, [ebp - 0x430]
push ecx
mov ecx, dword [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x498]
push eax
call fcn.00407040
test al, al
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x498]
mov eax, ebx
sete byte [ebp - 0x491]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4086a1
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0x49c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4086d1
lfence
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
cmp byte [ebp - 0x491], 0
mov esi, dword [ebp - 0x430]
je 0x4086ea
mov ebx, 9
jmp 0x408856
mov eax, dword [ebp - 0x42c]
xorps xmm0, xmm0
push 8
mov dword [ebp - 0x488], 0
movlpd qword [ebp - 0x470], xmm0
mov eax, dword [eax]
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x21c]
movlpd qword [ebp - 0x468], xmm0
movlpd qword [ebp - 0x460], xmm0
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x490], 0x3c
mov dword [ebp - 0x484], str.RunAs
mov dword [ebp - 0x480], esi
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], 9
mov dword [ebp - 0x48c], 0x40
mov dword [ebp - 0x434], 9
call fcn.0041d1b5
add esp, 4
mov dword [ebp - 0x42c], eax
test eax, eax
je 0x40878b
push esi
mov ecx, eax
call fcn.00406d00
mov edi, eax
jmp 0x40878d
xor edi, edi
mov dword [ebp - 0x42c], edi
mov byte [ebp - 4], 6
cmp byte [edi + 4], 0
je 0x4087f6
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x4087e2
mov eax, dword [ebp - 0x458]
test eax, eax
je 0x4087e2
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x458]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4087f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Setup___ShellExec_is_failed_with__d
call fcn.0041c4c0
add esp, 8
mov eax, dword [edi]
mov dword [ebp - 0x42c], 0
cmp eax, 0xffffffff
je 0x40880e
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 8
push edi
call fcn.0056a733
add esp, 8
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x408850
mov ecx, dword [ebp - 0x4a0]
lea eax, [ebp - 0x21c]
push eax
call fcn.004081a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Deleted_directory
call fcn.0041c4c0
add esp, 8
mov ebx, dword [ebp - 0x434]
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x408867
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x408878
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x408889
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x40889a
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4088c8
lfence
mov edi, dword [esi]
push esi
mov edx, dword [edi]
mov esi, dword [edx + 4]
mov ecx, esi
call dword [0x5a72d4]
mov ecx, edi
call esi
mov eax, ebx
jmp 0x4088d1
mov eax, 9
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0056a6fa
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00403ba0
push 0x80004005
call fcn.00403ba0
push 0x80004005
call fcn.00403ba0
int3