Function at 0x425ff0
Capabilities:
Check if file exists
Check mutex on windows
Create directory
Create thread
Delete file
Get common file path

Disassembly:
sub esp, 0x50
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
push str.c:zv_npav4dbg.log
call ebp
test eax, eax
je 0x42600f
mov byte [0x46fec5], 1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:zv_npav4.log
call esi
push str.npav4_started
call fcn.004073f0
call fcn.00409060
mov eax, dword [esp + 0x68]
push 0x190
xor ebx, ebx
push ebx
push 0x4693b8
mov dword [0x469cc4], eax
call fcn.0042eb30
add esp, 0x10
xor eax, eax
push 1
lea ecx, [esp + 0x50]
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
push ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x48], 0xc
mov dword [esp + 0x50], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea edx, [esp + 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.Global__t3_mutx__123_
push 0x100001
lea ecx, [esp + 0x48]
lea eax, [esp + 0x54]
push ecx
mov dword [esp + 0x50], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4260b8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.004310ac
mov dword [0x470144], ebx
call fcn.00409ed0
cmp eax, 1
jne 0x4260cd
mov dword [0x470144], eax
mov dword [0x47015c], ebx
call fcn.004075f0
call fcn.0040e170
call fcn.0040e030
call fcn.0040e240
call fcn.0040e350
call fcn.0040e460
mov eax, dword [0x470180]
mov dword [0x46f944], ebx
cmp eax, ebx
je 0x426119
call eax
test eax, eax
je 0x426119
push str.NPAV_IS_EXPIRED
call fcn.004073f0
add esp, 4
push ebx
call fcn.004310ac
push 0x5000
push ebx
push 0x46a1e8
call fcn.0042eb30
add esp, 0xc
push str.c:zvxPajPid.ini
call esi
call fcn.004077c0
call fcn.004076c0
call fcn.00407710
call fcn.00408830
call fcn.00407280
call fcn.00407890
push 0x104
push ebx
push 0x46f630
call fcn.0042eb30
add esp, 0xc
push 0x104
push 0x46f630
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x46f630
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x426180
mov edx, dword [str.NPDP]
mov cx, word [0x45ece4]
mov dword [eax], edx
push 0x46f630
mov word [eax + 4], cx
call ebp
test eax, eax
jne 0x4261b2
push ebx
push 0x46f630
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, 0x46f630
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4261b8
mov edx, dword [str.ZVMNSrvr.Log]
mov ecx, dword [0x45ecd4]
mov dword [eax], edx
mov edx, dword [0x45ecd8]
mov dword [eax + 4], ecx
mov cx, word [0x45ecdc]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
mov eax, 0x46f630
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4261f0
sub eax, edx
jne 0x426205
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x50
ret 0x10
push 0x104
push ebx
push 0x470018
call fcn.0042eb30
push 0x470018
call fcn.00407530
add esp, 0x10
mov ecx, 0x45b5a5
mov eax, 0x470018
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x426250
cmp dl, bl
je 0x42624c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x426250
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x426230
xor eax, eax
jmp 0x426255
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4262a6
push ebx
push 0x23
push 0x470018
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, 0x470018
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x426270
mov edx, dword [str.Net_Protector]
mov ecx, dword [0x45bcac]
mov dword [eax], edx
mov edx, dword [0x45bcb0]
mov dword [eax + 4], ecx
mov cx, word [0x45bcb4]
mov dword [eax + 8], edx
mov dl, byte [0x45bcb6]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
mov eax, 0x470018
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x4262b0
mov ecx, dword [str._npav4schedule.ini]
mov edx, dword [0x45ecc0]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax], ecx
mov ecx, dword [0x45ecc4]
mov dword [eax + 4], edx
mov edx, dword [0x45ecc8]
mov dword [eax + 8], ecx
mov cx, word [0x45eccc]
mov dword [eax + 0xc], edx
mov dl, byte [0x45ecce]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x40ee30
push ebx
push ebx
call esi
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x40c060
push ebx
push ebx
call esi
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push 0x40bbf0
push ebx
push ebx
call esi
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x40b740
push ebx
push ebx
call esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push 0x40ba80
push ebx
push ebx
call esi
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push 0x40bbc0
push ebx
push ebx
call esi
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push 0x40cfa0
push ebx
push ebx
call esi
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x40d170
push ebx
push ebx
call esi
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push 0x425fd0
push ebx
push ebx
call esi
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x40d490
push ebx
push ebx
call esi
lea ecx, [esp + 0x38]
push ecx
push ebx
push ebx
push 0x40d560
push ebx
push ebx
call esi
push 0x470018
call ebp
test eax, eax
jne 0x4263d0
lea edx, [esp + 0x64]
push edx
push ebx
push ebx
push 0x409ec0
push ebx
push ebx
call esi
lea eax, [esp + 0x3c]
push eax
push ebx
push ebx
push 0x409330
push ebx
push ebx
call esi
push ebx
xor esi, esi
call fcn.0041e5b0
add esp, 4
mov ecx, 0x470380
call fcn.00406980
test eax, eax
jne 0x4263ec
lea esi, [eax + 1]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x470128], ebx
mov dword [0x470124], ebx
mov dword [0x470120], ebx
push ebx
cmp esi, ebx
je 0x42641a
call fcn.0041e5b0
add esp, 4
push 0x3e8
call edi
jmp 0x426422
call fcn.0041f480
add esp, 4
mov ebp, 1
cmp dword [0x470124], ebp
jne 0x426466
mov dword [0x47014c], ebp
push ebx
cmp esi, ebx
je 0x426450
call fcn.0041e5b0
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x426473
call fcn.0041f480
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x426473
cmp dword [0x470128], ebp
jne 0x426473
call fcn.00407ba0
cmp dword [0x470130], 0x1e
jg 0x426482
add dword [0x470130], ebp
cmp dword [0x470138], 0x12c
jg 0x426499
add dword [0x470138], ebp
jmp 0x4263f2
cmp dword [0x47014c], ebp
jne 0x4263f2
call fcn.00408a30
mov dword [0x47014c], ebx
mov dword [0x470138], ebx
jmp 0x4263f2