Function at 0x403480
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4beb5b
mov eax, dword fs:[0]
push eax
sub esp, 0x8b4
mov eax, dword [0x4f7458]
xor eax, ebp
mov dword [ebp - 0x58], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x8b4], ecx
mov eax, dword [ebp - 0x8b4]
mov ecx, dword [eax]
sub ecx, 0x10
mov dword [ebp - 0x884], ecx
mov edx, dword [ebp - 0x884]
push edx
call fcn.00411c60
add esp, 4
mov dword [ebp - 0x888], eax
mov eax, dword [ebp - 0x888]
add eax, 0x10
mov dword [ebp - 0x860], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x8b4]
call fcn.004030c0
test eax, eax
jne 0x40353d
mov ecx, str.EstNsffilectrl.exe
test ecx, ecx
jne 0x403511
mov dword [ebp - 0x88c], 0
jmp 0x403524
push str.EstNsffilectrl.exe
call fcn.0048bb5c
add esp, 4
mov dword [ebp - 0x88c], eax
mov edx, dword [ebp - 0x88c]
push edx
push str.EstNsffilectrl.exe
lea ecx, [ebp - 0x860]
call fcn.00410800
jmp 0x40357c
mov eax, str.EstNsffilectrl64.exe
test eax, eax
jne 0x403552
mov dword [ebp - 0x890], 0
jmp 0x403565
push str.EstNsffilectrl64.exe
call fcn.0048bb5c
add esp, 4
mov dword [ebp - 0x890], eax
mov ecx, dword [ebp - 0x890]
push ecx
push str.EstNsffilectrl64.exe
lea ecx, [ebp - 0x860]
call fcn.00410800
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x894], edx
mov eax, dword [ebp - 0x894]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4035c0
mov dword [ebp - 0x874], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.00402470
mov eax, dword [ebp - 0x874]
jmp 0x40385b
mov dword [ebp - 0x864], 0
xor ecx, ecx
mov word [ebp - 0x85c], cx
push 0x7fe
push 0
lea edx, [ebp - 0x85a]
push edx
call fcn.0048ac80
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x40360c
mov eax, dword [ebp - 0x860]
push eax
push str.service_create_process___s__i_______asuser_
lea ecx, [ebp - 0x85c]
push ecx
call fcn.00403880
add esp, 0xc
jmp 0x403627
mov edx, dword [ebp - 0x860]
push edx
push str.service_create_process___s__u_______asuser_
lea eax, [ebp - 0x85c]
push eax
call fcn.00403880
add esp, 0xc
mov dword [ebp - 0x86c], 3
lea ecx, [ebp - 0x85c]
mov dword [ebp - 0x54], ecx
cmp dword [ebp - 0x54], 0
jne 0x40364f
mov dword [ebp - 0x8b8], 0
jmp 0x403710
mov edx, dword [ebp - 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3fffffff
jle 0x403677
mov dword [ebp - 0x8bc], 0
jmp 0x403704
mov eax, dword [ebp - 0x14]
shl eax, 1
call fcn.0048bb30
mov dword [ebp - 0x8a0], esp
mov eax, dword [ebp - 0x8a4]
mov dword [ebp - 0x8bc], eax
cmp dword [ebp - 0x8a0], 0
je 0x4036a2
cmp dword [ebp - 0x54], 0
jne 0x4036ae
mov dword [ebp - 0x8bc], 0
jmp 0x403704
mov ecx, dword [ebp - 0x8a0]
mov byte [ecx], 0
push 0
push 0
mov edx, dword [ebp - 0x14]
shl edx, 1
push edx
mov eax, dword [ebp - 0x8a0]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x54]
push ecx
push 0
mov edx, dword [ebp - 0x86c]
push edx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x89c], eax
cmp dword [ebp - 0x89c], 0
jne 0x4036f8
mov dword [ebp - 0x8bc], 0
jmp 0x403704
mov eax, dword [ebp - 0x8a0]
mov dword [ebp - 0x8bc], eax
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp - 0x8b8], ecx
mov edx, dword [ebp - 0x8b8]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
push eax
mov ecx, dword [ebp - 0x8b4]
call fcn.00403110
mov dword [ebp - 0x864], eax
cmp dword [ebp - 0x864], 0
je 0x40376f
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x878], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.00402470
mov eax, dword [ebp - 0x878]
jmp 0x40385b
mov dword [ebp - 0x50], 0
push 0x38
push 0
lea ecx, [ebp - 0x4c]
push ecx
call fcn.0048ac80
add esp, 0xc
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov edx, dword [ebp - 0x860]
mov dword [ebp - 0x40], edx
cmp dword [ebp + 8], 0
jne 0x4037bd
mov dword [ebp - 0x8c0], 0x4c8950
jmp 0x4037c7
mov dword [ebp - 0x8c0], 0x4c8948
mov eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x440
lea ecx, [ebp - 0x50]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x403809
mov dword [ebp - 0x87c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.00402470
mov eax, dword [ebp - 0x87c]
jmp 0x40385b
mov dword [ebp - 0x10], 0xffff
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 0x10], 0
sete al
mov dword [ebp - 0x880], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x860]
call fcn.00402470
mov eax, dword [ebp - 0x880]
lea esp, [ebp - 0x8c4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x58]
xor ecx, ebp
call fcn.0048abfc
mov esp, ebp
pop ebp
ret 4