Function at 0x4147c0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4322fe
mov eax, dword fs:[0]
push eax
mov eax, 0x2c34
call fcn.00422200
mov eax, dword [0x43d76c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2bd0], ecx
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0xd1
push 0x434ab8
call fcn.00401a00
add esp, 0xc
cmp eax, 1
jne 0x415447
cmp dword [ebp - 0x10], 0
jbe 0x415447
push 4
push 0x434ac0
push 0x8a
lea ecx, [ebp - 0x29f4]
push ecx
call fcn.00401d70
add esp, 8
mov dword [ebp - 0x2bd4], eax
mov edx, dword [ebp - 0x2bd4]
mov dword [ebp - 0x2bd8], edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x2bd8]
call fcn.00404b90
push eax
mov ecx, dword [ebp - 0x2bd0]
add ecx, 4
call fcn.0040c0f0
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x29f4]
call fcn.00403a00
cmp dword [ebp - 0x14], 6
jne 0x415447
push str.ck_WS_
push 0
push 0x503
mov eax, dword [ebp - 0x2bd0]
mov ecx, dword [eax + 0x28]
add ecx, 4
call fcn.00410320
mov dword [ebp - 0x820], 0
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00420a12
add esp, 4
mov dword [ebp - 0x29f8], eax
mov edx, dword [ebp - 0x29f8]
mov dword [ebp - 0x860], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x860]
push ecx
push 0xd1
push 0x434ae0
call fcn.00401b50
add esp, 0x10
push 0
push str._ue3
lea edx, [ebp - 0x858]
push edx
call fcn.00401a40
add esp, 0xc
mov dword [ebp - 4], 1
lea eax, [ebp - 0x81c]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [ebp - 0x83c]
call fcn.00403970
mov byte [ebp - 4], 2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x85c], eax
lea ecx, [ebp - 0x81c]
push ecx
lea ecx, [ebp - 0x83c]
call fcn.00403a50
cmp dword [ebp - 0x85c], 0
jge 0x414970
push str._tyF9666847_2BAA_4cca_AC6E_9975C7929B3B
lea ecx, [ebp - 0x83c]
call fcn.00403a80
jmp 0x4149ff
lea edx, [ebp - 0x870]
push edx
call dword [sym.imp.ole32.dll_CoCreateGuid]
movzx eax, byte [ebp - 0x861]
push eax
movzx ecx, byte [ebp - 0x862]
push ecx
movzx edx, byte [ebp - 0x863]
push edx
movzx eax, byte [ebp - 0x864]
push eax
movzx ecx, byte [ebp - 0x865]
push ecx
movzx edx, byte [ebp - 0x866]
push edx
movzx eax, byte [ebp - 0x867]
push eax
movzx ecx, byte [ebp - 0x868]
push ecx
movzx edx, word [ebp - 0x86a]
push edx
movzx eax, word [ebp - 0x86c]
push eax
mov ecx, dword [ebp - 0x870]
push ecx
push str._X__X__X__X_X_X_X_X_X_X_X
push 0x400
lea edx, [ebp - 0x1074]
push edx
call fcn.00421de3
add esp, 0x38
lea eax, [ebp - 0x1074]
push eax
lea ecx, [ebp - 0x83c]
call fcn.00403a80
lea ecx, [ebp - 0x858]
call fcn.00403bc0
movzx ecx, al
test ecx, ecx
jne 0x415403
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x858]
call fcn.00404b90
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1078], eax
cmp dword [ebp - 0x1078], 0xffffffff
je 0x415403
push 0
lea edx, [ebp - 0x107c]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x860]
push ecx
mov edx, dword [ebp - 0x1078]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1080], eax
mov eax, dword [ebp - 0x1078]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x107c]
cmp ecx, dword [ebp - 0x10]
jne 0x415403
cmp dword [ebp - 0x1080], 0
je 0x415403
lea ecx, [ebp - 0x10d4]
call fcn.00401920
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x858]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x10d4]
call fcn.00402330
test eax, eax
je 0x4153f4
push 0x434b84
lea edx, [ebp - 0x83c]
push edx
lea eax, [ebp - 0x2a18]
push eax
call fcn.00413250
add esp, 0xc
mov dword [ebp - 0x2bdc], eax
mov ecx, dword [ebp - 0x2bdc]
mov dword [ebp - 0x2be0], ecx
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x2be0]
call fcn.00404b90
push eax
push str._tmp_install_items.xml
lea ecx, [ebp - 0x10d4]
call fcn.00402530
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x29f9], al
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2a18]
call fcn.00403a00
movzx edx, byte [ebp - 0x29f9]
test edx, edx
je 0x4153f4
lea ecx, [ebp - 0x10f8]
call fcn.00412ba0
mov byte [ebp - 4], 5
lea eax, [ebp - 0x10f8]
push eax
push str._redist.xml
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x2a34]
push edx
call fcn.00413250
add esp, 0xc
mov dword [ebp - 0x2be4], eax
mov eax, dword [ebp - 0x2be4]
mov dword [ebp - 0x2be8], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2be8]
call fcn.00404b90
push eax
call fcn.004172b0
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2a34]
call fcn.00403a00
lea ecx, [ebp - 0x10dc]
call fcn.00412d00
mov dword [ebp - 0x10e0], 0
lea ecx, [ebp - 0x2a3c]
push ecx
lea ecx, [ebp - 0x10f8]
call fcn.004185a0
mov edx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10dc], edx
mov dword [ebp - 0x10d8], eax
jmp 0x414bed
lea ecx, [ebp - 0x10dc]
call fcn.00412d40
lea ecx, [ebp - 0x2a44]
push ecx
lea ecx, [ebp - 0x10f8]
call fcn.004185d0
push eax
lea ecx, [ebp - 0x10dc]
call fcn.00419b20
movzx edx, al
test edx, edx
je 0x414cb6
lea ecx, [ebp - 0x10dc]
call fcn.00412d20
add eax, 0x38
push eax
lea eax, [ebp - 0x83c]
push eax
lea ecx, [ebp - 0x2a64]
push ecx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2bec], eax
mov edx, dword [ebp - 0x2bec]
mov dword [ebp - 0x2bf0], edx
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x2bf0]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x10dc]
call fcn.00412d20
add eax, 0x1c
mov ecx, eax
call fcn.00404b90
push eax
lea ecx, [ebp - 0x10d4]
call fcn.00402530
neg eax
sbb eax, eax
add eax, 1
mov byte [ebp - 0x2a45], al
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2a64]
call fcn.00403a00
movzx eax, byte [ebp - 0x2a45]
test eax, eax
je 0x414cb1
mov dword [ebp - 0x10e0], 1
jmp 0x414cb6
jmp 0x414be2
cmp dword [ebp - 0x10e0], 0
jne 0x4153e5
mov dword [ebp - 0x10fc], 0
push str.r_ccsUNICODE
push str._redistinz.txt
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x2a80]
push edx
call fcn.00413250
add esp, 0xc
mov dword [ebp - 0x2bf4], eax
mov eax, dword [ebp - 0x2bf4]
mov dword [ebp - 0x2bf8], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2bf8]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x10fc]
push ecx
call fcn.0042219e
add esp, 0xc
mov dword [ebp - 0x1100], eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2a80]
call fcn.00403a00
cmp dword [ebp - 0x1100], 0
jne 0x4153cb
cmp dword [ebp - 0x10fc], 0
je 0x4153cb
mov edx, 1
test edx, edx
je 0x4153cb
push 0x800
push 0
lea eax, [ebp - 0x2104]
push eax
call fcn.004212e0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x1904]
push ecx
call fcn.004212e0
add esp, 0xc
push 0x800
push 0
lea edx, [ebp - 0x2904]
push edx
call fcn.004212e0
add esp, 0xc
mov eax, dword [ebp - 0x10fc]
push eax
call fcn.0042248c
add esp, 4
test eax, eax
je 0x414db4
jmp 0x4153cb
mov ecx, dword [ebp - 0x10fc]
push ecx
push 0x3ff
lea edx, [ebp - 0x1904]
push edx
call fcn.004223cb
add esp, 0xc
mov eax, dword [ebp - 0x10fc]
push eax
push 0x3ff
lea ecx, [ebp - 0x2904]
push ecx
call fcn.004223cb
add esp, 0xc
mov edx, dword [ebp - 0x10fc]
push edx
push 0x3ff
lea eax, [ebp - 0x2104]
push eax
call fcn.004223cb
add esp, 0xc
lea ecx, [ebp - 0x1904]
push ecx
call fcn.00420c4b
add esp, 4
test eax, eax
jbe 0x4153c4
lea ecx, [ebp - 0x294c]
call fcn.00403970
mov byte [ebp - 4], 9
lea edx, [ebp - 0x1904]
push edx
call fcn.00420c4b
add esp, 4
xor ecx, ecx
mov word [ebp + eax*2 - 0x1906], cx
lea edx, [ebp - 0x2104]
push edx
lea ecx, [ebp - 0x294c]
call fcn.00403a50
push 0x434c20
lea ecx, [ebp - 0x29b8]
call fcn.00403990
mov byte [ebp - 4], 0xa
push 0
lea eax, [ebp - 0x29b8]
push eax
lea ecx, [ebp - 0x294c]
call fcn.00403bd0
cmp eax, 0xffffffff
je 0x414eb6
push 0x434c28
lea ecx, [ebp - 0x29b8]
call fcn.00403bb0
push eax
push 0
lea ecx, [ebp - 0x29b8]
push ecx
lea ecx, [ebp - 0x294c]
call fcn.00403bd0
push eax
lea ecx, [ebp - 0x294c]
call fcn.00403ab0
jmp 0x414e6a
lea ecx, [ebp - 0x294c]
call fcn.00404b90
push eax
push 0
push 0x503
mov edx, dword [ebp - 0x2bd0]
mov ecx, dword [edx + 0x28]
add ecx, 4
call fcn.00410320
mov dword [ebp - 0x299c], 0x44
lea eax, [ebp - 0x1904]
push eax
lea ecx, [ebp - 0x83c]
push ecx
lea edx, [ebp - 0x2920]
push edx
call fcn.00413250
add esp, 0xc
mov byte [ebp - 4], 0xb
push 0x44
push 0
lea eax, [ebp - 0x299c]
push eax
call fcn.004212e0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x2930]
push ecx
call fcn.004212e0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x2a82], dx
mov eax, 0xd
mov word [ebp - 0x2a84], ax
lea ecx, [ebp - 0x2a82]
push ecx
lea edx, [ebp - 0x2a84]
push edx
lea eax, [ebp - 0x2a8c]
push eax
lea ecx, [ebp - 0x2920]
call fcn.00403b50
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2a94]
push eax
lea ecx, [ebp - 0x2920]
call fcn.00403af0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.00407060
add esp, 0x18
xor eax, eax
mov word [ebp - 0x2a96], ax
mov ecx, 0xa
mov word [ebp - 0x2a98], cx
lea edx, [ebp - 0x2a96]
push edx
lea eax, [ebp - 0x2a98]
push eax
lea ecx, [ebp - 0x2aa0]
push ecx
lea ecx, [ebp - 0x2920]
call fcn.00403b50
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2aa8]
push ecx
lea ecx, [ebp - 0x2920]
call fcn.00403af0
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.00407060
add esp, 0x18
lea ecx, [ebp - 0x2904]
push ecx
lea ecx, [ebp - 0x29d4]
call fcn.00403990
mov byte [ebp - 4], 0xc
xor edx, edx
mov word [ebp - 0x2aaa], dx
mov eax, 0xd
mov word [ebp - 0x2aac], ax
lea ecx, [ebp - 0x2aaa]
push ecx
lea edx, [ebp - 0x2aac]
push edx
lea eax, [ebp - 0x2ab4]
push eax
lea ecx, [ebp - 0x29d4]
call fcn.00403b50
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x2abc]
push eax
lea ecx, [ebp - 0x29d4]
call fcn.00403af0
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
call fcn.00407060
add esp, 0x18
xor eax, eax
mov word [ebp - 0x2abe], ax
mov ecx, 0xa
mov word [ebp - 0x2ac0], cx
lea edx, [ebp - 0x2abe]
push edx
lea eax, [ebp - 0x2ac0]
push eax
lea ecx, [ebp - 0x2ac8]
push ecx
lea ecx, [ebp - 0x29d4]
call fcn.00403b50
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x2ad0]
push ecx
lea ecx, [ebp - 0x29d4]
call fcn.00403af0
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
call fcn.00407060
add esp, 0x18
lea ecx, [ebp - 0x29d4]
push ecx
push 0x434c2c
lea ecx, [ebp - 0x2aec]
call fcn.00403990
mov dword [ebp - 0x2bfc], eax
mov edx, dword [ebp - 0x2bfc]
mov dword [ebp - 0x2c00], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x2c00]
push eax
lea ecx, [ebp - 0x2920]
push ecx
push 0x434c34
lea ecx, [ebp - 0x2b08]
call fcn.00403990
mov dword [ebp - 0x2c04], eax
mov edx, dword [ebp - 0x2c04]
mov dword [ebp - 0x2c08], edx
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x2c08]
push eax
lea ecx, [ebp - 0x2b24]
push ecx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2c0c], eax
mov edx, dword [ebp - 0x2c0c]
mov dword [ebp - 0x2c10], edx
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x2c10]
push eax
lea ecx, [ebp - 0x2b40]
push ecx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2c14], eax
mov edx, dword [ebp - 0x2c14]
mov dword [ebp - 0x2c18], edx
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x2c18]
push eax
lea ecx, [ebp - 0x2b5c]
push ecx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2c1c], eax
mov edx, dword [ebp - 0x2c1c]
mov dword [ebp - 0x2c20], edx
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x2c20]
push eax
lea ecx, [ebp - 0x29d4]
call fcn.00403a30
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x2b5c]
call fcn.00403a00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2b40]
call fcn.00403a00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2b24]
call fcn.00403a00
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2b08]
call fcn.00403a00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2aec]
call fcn.00403a00
lea ecx, [ebp - 0x29d4]
call fcn.00404b90
push eax
lea ecx, [ebp - 0x2904]
push ecx
call fcn.0040fe40
add esp, 8
lea edx, [ebp - 0x2930]
push edx
lea eax, [ebp - 0x299c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2904]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x2950], eax
cmp dword [ebp - 0x2950], 1
jne 0x415277
push 0xffffffffffffffff
mov edx, dword [ebp - 0x2930]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x29d8], eax
cmp dword [ebp - 0x29d8], 0
jne 0x415272
mov dword [ebp - 0x820], 1
jmp 0x415386
push 0
push 0x434c38
push 0x434c3c
lea ecx, [ebp - 0x2b78]
call fcn.00403990
mov dword [ebp - 0x2c24], eax
mov eax, dword [ebp - 0x2c24]
mov dword [ebp - 0x2c28], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x2c28]
push ecx
lea edx, [ebp - 0x2920]
push edx
push 0x434c44
lea ecx, [ebp - 0x2b94]
call fcn.00403990
mov dword [ebp - 0x2c2c], eax
mov eax, dword [ebp - 0x2c2c]
mov dword [ebp - 0x2c30], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x2c30]
push ecx
lea edx, [ebp - 0x2bb0]
push edx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2c34], eax
mov eax, dword [ebp - 0x2c34]
mov dword [ebp - 0x2c38], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x2c38]
push ecx
lea edx, [ebp - 0x2bcc]
push edx
call fcn.0040bfa0
add esp, 0xc
mov dword [ebp - 0x2c3c], eax
mov eax, dword [ebp - 0x2c3c]
mov dword [ebp - 0x2c40], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x2c40]
call fcn.00404b90
push eax
mov ecx, dword [ebp - 0x2bd0]
add ecx, 4
call fcn.0040c0f0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x2bcc]
call fcn.00403a00
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2bb0]
call fcn.00403a00
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2b94]
call fcn.00403a00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2b78]
call fcn.00403a00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x29d4]
call fcn.00403a00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2920]
call fcn.00403a00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x29b8]
call fcn.00403a00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x294c]
call fcn.00403a00
jmp 0x4153c6
jmp 0x4153cb
jmp 0x414d4d
push 0
push 0
push 0x502
mov ecx, dword [ebp - 0x2bd0]
mov ecx, dword [ecx + 0x28]
add ecx, 4
call fcn.00410320
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10f8]
call fcn.00412c10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10d4]
call fcn.00401960
cmp dword [ebp - 0x820], 0
jne 0x415426
push 0
push 0x434c4c
push 0x434c50
mov ecx, dword [ebp - 0x2bd0]
add ecx, 4
call fcn.0040c0f0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x83c]
call fcn.00403a00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x858]
call fcn.00403a00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00421275
mov esp, ebp
pop ebp
ret