Function at 0x402e40
Capabilities:
Create process on windows
Get common file path
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x206c
call fcn.00403710
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 2
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x200c], ebx
jge 0x402eae
push 0x4271b0
call fcn.00403530
push 0x4271f8
call fcn.00403530
push 0x427260
call fcn.00403530
push 0x427270
call fcn.00403530
push 0x4272c0
call fcn.00403530
add esp, 0x14
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
push esi
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00405580
add esp, 0xc
mov byte [ebp - 0x2005], 0
mov esi, 1
push edi
push 0x427374
push dword [ebx + esi*4]
call fcn.00404830
mov ecx, dword [ebx + esi*4]
add esp, 8
cmp eax, ecx
jne 0x402f33
mov edi, dword [ebx + esi*4 + 4]
lea ecx, [ebp - 0x404]
inc esi
mov eax, ecx
mov edx, 0x400
sub edi, eax
nop dword [eax]
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x402f19
mov al, byte [edi + ecx]
test al, al
je 0x402f19
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402f00
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesA]
jmp 0x402f4f
push 0x427378
push ecx
call fcn.00404830
mov edi, dword [ebx + esi*4]
add esp, 8
cmp eax, edi
jne 0x402f7a
mov byte [ebp - 0x2005], 1
inc esi
cmp esi, dword [ebp + 8]
jl 0x402ed2
push 0x427308
call fcn.00403530
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x404], 0
jne 0x402fc3
lea ecx, [ebp - 0x404]
mov edx, 0x400
mov eax, ecx
sub edi, eax
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x402fab
mov al, byte [ecx + edi]
test al, al
je 0x402fab
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x402f92
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
test eax, eax
jne 0x402ffe
lea eax, [ebp - 0x404]
push eax
push 0x427380
call fcn.00403530
add esp, 8
mov eax, 0x2329
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x1404]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push 0x4273c4
push 0x400
lea eax, [ebp - 0x1404]
push eax
call fcn.00401bc0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
lea eax, [ebp - 0x404]
push eax
call ebx
test eax, eax
je 0x4030c7
lea ecx, [ebp - 0x1c04]
mov edx, 0x400
lea edi, [ebp - 0x1404]
mov eax, ecx
sub edi, eax
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x40306b
mov al, byte [ecx + edi]
test al, al
je 0x40306b
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x403052
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
lea eax, [ebp - 0x404]
push eax
push 0x400
lea eax, [ebp - 0x1c04]
push eax
call fcn.00401bc0
lea ecx, [ebp - 0x404]
mov edx, 0x400
lea edi, [ebp - 0x1c04]
mov eax, ecx
sub edi, eax
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x4030bc
mov al, byte [ecx + edi]
test al, al
je 0x4030bc
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4030a3
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
cmp byte [ebp - 0x2005], 0
je 0x403124
lea eax, [ebp - 0x2024]
mov dword [ebp - 0x2024], 0
push eax
lea eax, [ebp - 0x2004]
push eax
push 0x400
push 0x4273c8
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x403124
push 0x4273c8
push 0x4273d4
call fcn.00403530
add esp, 8
mov eax, 0x232a
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x1804]
push 0
push eax
call fcn.00405580
mov edi, dword [ebp - 0x200c]
lea ecx, [ebp - 0x804]
xorps xmm0, xmm0
mov dword [ebp - 0x2028], 0
mov eax, ecx
movlpd qword [ebp - 0x2068], xmm0
add esp, 0xc
movlpd qword [ebp - 0x2060], xmm0
mov edi, dword [edi + esi*4]
mov edx, 0x400
movlpd qword [ebp - 0x2058], xmm0
sub edi, eax
movlpd qword [ebp - 0x2050], xmm0
movlpd qword [ebp - 0x2048], xmm0
movlpd qword [ebp - 0x2040], xmm0
movlpd qword [ebp - 0x2038], xmm0
movlpd qword [ebp - 0x2030], xmm0
movups xmmword [ebp - 0x2020], xmm0
mov dword [ebp - 0x206c], 0x44
mov byte [ebp - 0x1004], 0
nop word [eax + eax]
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x4031d9
mov al, byte [ecx + edi]
test al, al
je 0x4031d9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x4031c0
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
cmp esi, dword [ebp + 8]
jge 0x403305
mov edi, dword [ebp - 0x200c]
push 0x20
push dword [edi + esi*4]
call fcn.00404700
add esp, 8
test eax, eax
jne 0x403252
push 9
push dword [edi + esi*4]
call fcn.00404700
add esp, 8
test eax, eax
jne 0x403252
cmp byte [ebp - 0x1004], al
jne 0x40324d
lea eax, [ebp - 0x804]
push eax
call ebx
test eax, eax
je 0x40324d
lea eax, [ebp - 0x1404]
push eax
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
lea eax, [ebp - 0x804]
jmp 0x4032ce
mov eax, dword [edi + esi*4]
jmp 0x4032ce
cmp byte [ebp - 0x1004], 0
jne 0x40329f
lea eax, [ebp - 0x804]
push eax
call ebx
test eax, eax
je 0x40329f
push 0x427410
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
lea eax, [ebp - 0x1404]
push eax
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
lea eax, [ebp - 0x804]
push eax
jmp 0x4032b8
push 0x427410
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
push dword [edi + esi*4]
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
mov eax, 0x427410
push eax
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
lea eax, [esi + 1]
mov esi, eax
cmp eax, dword [ebp + 8]
jge 0x403305
push 0x427414
push 0x800
lea eax, [ebp - 0x1004]
push eax
call fcn.00401bc0
jmp 0x4031f3
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x2028]
push eax
lea eax, [ebp - 0x1804]
push eax
push 0x400
push 0x427418
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
cmp byte [ebp - 0x2005], 0
jne 0x4033c1
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryA]
lea eax, [ebp - 0x2020]
xor ecx, ecx
cmp byte [ebp - 0x1804], cl
push eax
lea eax, [ebp - 0x206c]
push eax
lea eax, [ebp - 0x404]
push eax
push 0
push 0x4000004
push 1
push 0
push 0
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1804]
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4034b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x427420
call fcn.00403530
add esp, 8
mov eax, 0x2331
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp byte [ebp - 0x1804], cl
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x200c], eax
lea eax, [ebp - 0x1804]
cmove eax, ecx
lea ecx, [ebp - 0x2020]
push ecx
lea ecx, [ebp - 0x206c]
push ecx
lea ecx, [ebp - 0x404]
push ecx
push 0
push 0x4000004
push 1
push 0
push 0
lea ecx, [ebp - 0x1004]
push ecx
push eax
call esi
test eax, eax
jne 0x40341e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40347b
push 1
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 0x2020]
call fcn.004029a0
test eax, eax
jne 0x4034b1
push esi
lea eax, [ebp - 0x200c]
push eax
push 1
push dword [ebp - 0x2018]
call fcn.00402780
test eax, eax
jne 0x4034b1
push 0xffffffffffffffff
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [ebp - 0x2020]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x201c]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push eax
push 0x427420
call fcn.00403530
add esp, 8
cmp esi, 6
jne 0x40349b
push 0x427448
call fcn.00403530
add esp, 4
pop edi
pop esi
mov eax, 0x2331
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x201c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0xffffffffffffffff
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x2010], 0
push eax
push dword [ebp - 0x2020]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x403516
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4274a4
call fcn.00403530
add esp, 8
mov eax, 0x2332
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004036fa
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2010]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004036fa
mov esp, ebp
pop ebp
ret