Function at 0x411580
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4421eb
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x44f6c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x160], ecx
cmp dword [ebp + 8], 0
je 0x411e40
lea ecx, [ebp - 0x70]
call fcn.00410960
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.00412ee0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00410650
push eax
lea ecx, [ebp - 0x2c]
call fcn.00408410
mov byte [ebp - 4], 2
push 0x447d8c
lea ecx, [ebp - 0x2c]
call fcn.0040ba90
lea ecx, [ebp - 0x70]
call fcn.00410210
push eax
lea ecx, [ebp - 0x2c]
call fcn.0040ba90
push 0x447d90
lea ecx, [ebp - 0x2c]
call fcn.0040ba90
push 0x447d94
lea ecx, [ebp - 0x2c]
call fcn.0040ba90
lea ecx, [ebp - 0x2c]
call fcn.00402330
push eax
lea ecx, [ebp - 0xdc]
call fcn.00413140
lea ecx, [ebp - 0xdc]
call fcn.004138f0
push 1
mov eax, dword [ebp + 8]
push eax
push str.dll_path
push str.config
lea ecx, [ebp - 0xdc]
call fcn.00414280
lea ecx, [ebp - 0xdc]
call fcn.00413e80
push 0x400
call fcn.00427a82
add esp, 4
mov dword [ebp - 0x14c], eax
mov ecx, dword [ebp - 0x14c]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x70]
call fcn.00410560
movzx edx, al
cmp edx, 1
jne 0x41193b
push 0x400
push 0
mov eax, dword [ebp - 0x30]
push eax
call fcn.004306a0
add esp, 0xc
mov ecx, dword [ebp - 0x160]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x164], edx
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp - 0x164]
mov dl, byte [ecx]
mov byte [ebp - 0x169], dl
add dword [ebp - 0x164], 1
cmp byte [ebp - 0x169], 0
jne 0x4116d2
mov eax, dword [ebp - 0x164]
sub eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0x168]
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x174], eax
mov edx, dword [ebp - 0x30]
add edx, 0xffffffff
mov dword [ebp - 0x178], edx
mov eax, dword [ebp - 0x178]
mov cl, byte [eax + 1]
mov byte [ebp - 0x179], cl
add dword [ebp - 0x178], 1
cmp byte [ebp - 0x179], 0
jne 0x41171a
mov edi, dword [ebp - 0x178]
mov esi, dword [ebp - 0x170]
mov edx, dword [ebp - 0x174]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x30]
add eax, 0xffffffff
mov dword [ebp - 0x180], eax
mov ecx, dword [ebp - 0x180]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x181], dl
add dword [ebp - 0x180], 1
cmp byte [ebp - 0x181], 0
jne 0x411765
mov edi, dword [ebp - 0x180]
mov eax, dword [str..exe__]
mov dword [edi], eax
mov cx, word [0x447dc0]
mov word [edi + 4], cx
mov dl, byte [0x447dc2]
mov byte [edi + 6], dl
mov eax, dword [ebp + 8]
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp - 0x188]
mov al, byte [edx]
mov byte [ebp - 0x18d], al
add dword [ebp - 0x188], 1
cmp byte [ebp - 0x18d], 0
jne 0x4117ba
mov ecx, dword [ebp - 0x188]
sub ecx, dword [ebp - 0x18c]
mov edx, dword [ebp - 0x18c]
mov dword [ebp - 0x194], edx
mov dword [ebp - 0x198], ecx
mov eax, dword [ebp - 0x30]
add eax, 0xffffffff
mov dword [ebp - 0x19c], eax
mov ecx, dword [ebp - 0x19c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x19d], dl
add dword [ebp - 0x19c], 1
cmp byte [ebp - 0x19d], 0
jne 0x411802
mov edi, dword [ebp - 0x19c]
mov esi, dword [ebp - 0x194]
mov eax, dword [ebp - 0x198]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
add ecx, 0xffffffff
mov dword [ebp - 0x1a4], ecx
mov edx, dword [ebp - 0x1a4]
mov al, byte [edx + 1]
mov byte [ebp - 0x1a5], al
add dword [ebp - 0x1a4], 1
cmp byte [ebp - 0x1a5], 0
jne 0x41184d
mov edi, dword [ebp - 0x1a4]
mov cx, word [0x447dc4]
mov word [edi], cx
mov dl, byte [0x447dc6]
mov byte [edi + 2], dl
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x1ac], ecx
mov edx, dword [ebp - 0x1ac]
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp - 0x1ac]
mov cl, byte [eax]
mov byte [ebp - 0x1b1], cl
add dword [ebp - 0x1ac], 1
cmp byte [ebp - 0x1b1], 0
jne 0x4118a0
mov edx, dword [ebp - 0x1ac]
sub edx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1bc], edx
mov ecx, dword [ebp - 0x30]
add ecx, 0xffffffff
mov dword [ebp - 0x1c0], ecx
mov edx, dword [ebp - 0x1c0]
mov al, byte [edx + 1]
mov byte [ebp - 0x1c1], al
add dword [ebp - 0x1c0], 1
cmp byte [ebp - 0x1c1], 0
jne 0x4118e8
mov edi, dword [ebp - 0x1c0]
mov esi, dword [ebp - 0x1b8]
mov edx, dword [ebp - 0x1bc]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x30]
push eax
call fcn.00429586
add esp, 4
mov dword [ebp - 0x34], eax
jmp 0x411d9d
push 0x400
push 0
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.004306a0
add esp, 0xc
mov edx, dword [ebp - 0x30]
add edx, 0xffffffff
mov dword [ebp - 0x1c8], edx
mov eax, dword [ebp - 0x1c8]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1c9], cl
add dword [ebp - 0x1c8], 1
cmp byte [ebp - 0x1c9], 0
jne 0x41195a
mov edi, dword [ebp - 0x1c8]
mov edx, dword [str.__s__]
mov dword [edi], edx
mov ax, word [0x447dcc]
mov word [edi + 4], ax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1d0], ecx
mov edx, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d4], edx
mov eax, dword [ebp - 0x1d0]
mov cl, byte [eax]
mov byte [ebp - 0x1d5], cl
add dword [ebp - 0x1d0], 1
cmp byte [ebp - 0x1d5], 0
jne 0x4119a6
mov edx, dword [ebp - 0x1d0]
sub edx, dword [ebp - 0x1d4]
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], edx
mov ecx, dword [ebp - 0x30]
add ecx, 0xffffffff
mov dword [ebp - 0x1e4], ecx
mov edx, dword [ebp - 0x1e4]
mov al, byte [edx + 1]
mov byte [ebp - 0x1e5], al
add dword [ebp - 0x1e4], 1
cmp byte [ebp - 0x1e5], 0
jne 0x4119ee
mov edi, dword [ebp - 0x1e4]
mov esi, dword [ebp - 0x1dc]
mov edx, dword [ebp - 0x1e0]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x30]
add eax, 0xffffffff
mov dword [ebp - 0x1ec], eax
mov ecx, dword [ebp - 0x1ec]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x1ed], dl
add dword [ebp - 0x1ec], 1
cmp byte [ebp - 0x1ed], 0
jne 0x411a39
mov edi, dword [ebp - 0x1ec]
mov ax, word [0x447dd0]
mov word [edi], ax
mov cl, byte [0x447dd2]
mov byte [edi + 2], cl
mov edx, dword [ebp - 0x160]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x1f4], eax
mov ecx, dword [ebp - 0x1f4]
mov dword [ebp - 0x1f8], ecx
mov edx, dword [ebp - 0x1f4]
mov al, byte [edx]
mov byte [ebp - 0x1f9], al
add dword [ebp - 0x1f4], 1
cmp byte [ebp - 0x1f9], 0
jne 0x411a8b
mov ecx, dword [ebp - 0x1f4]
sub ecx, dword [ebp - 0x1f8]
mov edx, dword [ebp - 0x1f8]
mov dword [ebp - 0x200], edx
mov dword [ebp - 0x204], ecx
mov eax, dword [ebp - 0x30]
add eax, 0xffffffff
mov dword [ebp - 0x208], eax
mov ecx, dword [ebp - 0x208]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x209], dl
add dword [ebp - 0x208], 1
cmp byte [ebp - 0x209], 0
jne 0x411ad3
mov edi, dword [ebp - 0x208]
mov esi, dword [ebp - 0x200]
mov eax, dword [ebp - 0x204]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x100
call fcn.00427a82
add esp, 4
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
mov dword [ebp - 0x148], ecx
push 0x100
push 0
mov edx, dword [ebp - 0x148]
push edx
call fcn.004306a0
add esp, 0xc
mov eax, dword [ebp - 0x160]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x210], ecx
mov edx, dword [ebp - 0x210]
mov dword [ebp - 0x214], edx
mov eax, dword [ebp - 0x210]
mov cl, byte [eax]
mov byte [ebp - 0x215], cl
add dword [ebp - 0x210], 1
cmp byte [ebp - 0x215], 0
jne 0x411b62
mov edx, dword [ebp - 0x210]
sub edx, dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], edx
mov ecx, dword [ebp - 0x148]
add ecx, 0xffffffff
mov dword [ebp - 0x224], ecx
mov edx, dword [ebp - 0x224]
mov al, byte [edx + 1]
mov byte [ebp - 0x225], al
add dword [ebp - 0x224], 1
cmp byte [ebp - 0x225], 0
jne 0x411bad
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x220]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x148]
add eax, 0xffffffff
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x22d], dl
add dword [ebp - 0x22c], 1
cmp byte [ebp - 0x22d], 0
jne 0x411bfb
mov edi, dword [ebp - 0x22c]
mov eax, dword [0x447dd4]
mov dword [edi], eax
mov cl, byte [0x447dd8]
mov byte [edi + 4], cl
mov byte [ebp - 0x144], 0
push 0x63
push 0
lea edx, [ebp - 0x143]
push edx
call fcn.004306a0
add esp, 0xc
push 0x64
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x144]
add ecx, 0xffffffff
mov dword [ebp - 0x234], ecx
mov edx, dword [ebp - 0x234]
mov al, byte [edx + 1]
mov byte [ebp - 0x235], al
add dword [ebp - 0x234], 1
cmp byte [ebp - 0x235], 0
jne 0x411c68
mov edi, dword [ebp - 0x234]
mov cx, word [0x447ddc]
mov word [edi], cx
mov edx, dword [ebp - 0x160]
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x23c], eax
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x240], ecx
mov edx, dword [ebp - 0x23c]
mov al, byte [edx]
mov byte [ebp - 0x241], al
add dword [ebp - 0x23c], 1
cmp byte [ebp - 0x241], 0
jne 0x411cb2
mov ecx, dword [ebp - 0x23c]
sub ecx, dword [ebp - 0x240]
mov edx, dword [ebp - 0x240]
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x24c], ecx
lea eax, [ebp - 0x144]
add eax, 0xffffffff
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x251], dl
add dword [ebp - 0x250], 1
cmp byte [ebp - 0x251], 0
jne 0x411cfd
mov edi, dword [ebp - 0x250]
mov esi, dword [ebp - 0x248]
mov eax, dword [ebp - 0x24c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x144]
add ecx, 0xffffffff
mov dword [ebp - 0x258], ecx
mov edx, dword [ebp - 0x258]
mov al, byte [edx + 1]
mov byte [ebp - 0x259], al
add dword [ebp - 0x258], 1
cmp byte [ebp - 0x259], 0
jne 0x411d4b
mov edi, dword [ebp - 0x258]
mov ecx, dword [str..exe]
mov dword [edi], ecx
mov dl, byte [0x447de4]
mov byte [edi + 4], dl
push 1
push 0
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x144]
push ecx
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp dword [ebp - 0x30], 0
je 0x411dc2
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x154], edx
mov eax, dword [ebp - 0x154]
push eax
call fcn.00428d4f
add esp, 4
mov dword [ebp - 0x30], 0
cmp dword [ebp - 0x34], 1
jne 0x411e04
mov dword [ebp - 0x158], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004022f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.00412fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00410a10
mov eax, dword [ebp - 0x158]
jmp 0x411e42
mov dword [ebp - 0x15c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004022f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xdc]
call fcn.00412fe0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.00410a10
mov eax, dword [ebp - 0x15c]
jmp 0x411e42
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004286dd
mov esp, ebp
pop ebp
ret 4