Function at 0x402f40
Capabilities:
Create process on windows
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x146c
call fcn.00411fc0
mov eax, dword [0x443624]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1414]
push edi
mov edi, dword [ebp + 8]
push 0x1000
push 0
push eax
call fcn.00413a20
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00413a20
add esp, 0x18
lea eax, [ebp - 0x414]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x40324c
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x40324c
test esi, esi
je 0x402fd1
cmp word [esi], 0
je 0x402fd1
push esi
jmp 0x403063
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00413a20
lea ecx, [ebp - 0x20c]
mov esi, edi
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub esi, eax
jmp 0x403000
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x40301e
movzx eax, word [esi + ecx]
test ax, ax
je 0x40301e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x403000
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
test edx, edx
jne 0x403038
nop
mov dword [0], ecx
jmp 0x403030
push str..inf
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push edi
call esi
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
push edi
push str._s__u__s__s
lea eax, [ebp - 0x1414]
push 0x800
push eax
call fcn.00406c00
add esp, 0x14
test eax, eax
js 0x40324c
lea eax, [ebp - 0x1428]
mov dword [ebp - 0x1468], 0
push eax
lea eax, [ebp - 0x146c]
mov dword [ebp - 0x1464], 0
push eax
push 0
push 0
push 0x4000004
push 1
push 0
push 0
lea eax, [ebp - 0x1414]
mov dword [ebp - 0x1460], 0
push eax
push 0
mov dword [ebp - 0x145c], 0
mov dword [ebp - 0x1458], 0
mov dword [ebp - 0x1454], 0
mov dword [ebp - 0x1450], 0
mov dword [ebp - 0x144c], 0
mov dword [ebp - 0x1448], 0
mov dword [ebp - 0x1444], 0
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x143c], 0
mov dword [ebp - 0x1438], 0
mov dword [ebp - 0x1434], 0
mov dword [ebp - 0x1430], 0
mov dword [ebp - 0x142c], 0
mov dword [ebp - 0x146c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40317f
call dword [sym.imp.KERNEL32.dll_GetLastError]
or ecx, 0xffffffff
test eax, eax
pop edi
cmovne ecx, eax
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x1424]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x4031cc
push 1
push dword [ebp - 0x1428]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x4031cc
push eax
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x4031cc
mov edi, edi
mov dword [0], 0
jmp 0x4031c0
lea eax, [ebp - 0x1418]
mov dword [ebp - 0x1418], 1
push eax
push dword [ebp - 0x1428]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4031f9
cmp dword [ebp - 0x1418], 0x103
jne 0x403203
mov dword [ebp - 0x1418], 1
push dword [ebp - 0x1424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
test eax, eax
je 0x403240
push dword [ebp - 0x1428]
call esi
test eax, eax
je 0x403240
mov eax, dword [ebp - 0x1418]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00411faa
mov esp, ebp
pop ebp
ret
mov dword [0], 0
jmp 0x403240
mov ecx, dword [ebp - 4]
mov eax, 0xe
pop edi
xor ecx, ebp
pop esi
call fcn.00411faa
mov esp, ebp
pop ebp
ret