Function at 0x402ba0
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4279f7
mov eax, dword fs:[0]
push eax
sub esp, 0x574
mov eax, dword [0x439070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 0xc]
push 0
mov dword [ebp - 0x48c], edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
mov dword [ebp - 0x4d8], 7
push eax
push 0x104
lea ecx, [ebp - 0x4ec]
mov dword [ebp - 0x4dc], 0
mov word [ebp - 0x4ec], ax
call fcn.00403b10
push 0x104
lea eax, [ebp - 0x280]
mov dword [ebp - 4], 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x280]
call fcn.004051f0
lea esi, [ebp - 0x280]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x402c46
sub esi, ecx
mov dword [ebp - 0x490], 7
xor eax, eax
sar esi, 1
xor ecx, ecx
mov word [ebp - 0x4a4], ax
cmp word [ebp - 0x280], cx
mov eax, esi
mov dword [ebp - 0x494], 0
cmove eax, ecx
lea ecx, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.00403c00
mov eax, dword [ebp - 0x4d8]
cmp eax, 8
jb 0x402cb1
inc eax
lea ecx, [ebp - 0x4ec]
push eax
push dword [ebp - 0x4ec]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4d8], 7
mov word [ebp - 0x4ec], ax
lea ecx, [ebp - 0x4ec]
lea eax, [ebp - 0x4a4]
mov dword [ebp - 0x4dc], 0
push eax
call fcn.00403e20
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x490]
cmp eax, 8
jb 0x402d02
inc eax
lea ecx, [ebp - 0x4a4]
push eax
push dword [ebp - 0x4a4]
call fcn.00404540
lea eax, [esi - 9]
push eax
push ecx
lea eax, [ebp - 0x4bc]
push eax
lea ecx, [ebp - 0x4ec]
call fcn.00403720
mov esi, eax
lea eax, [ebp - 0x4ec]
cmp eax, esi
je 0x402d6c
mov eax, dword [ebp - 0x4d8]
cmp eax, 8
jb 0x402d43
inc eax
lea ecx, [ebp - 0x4ec]
push eax
push dword [ebp - 0x4ec]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4d8], 7
push esi
lea ecx, [ebp - 0x4ec]
mov dword [ebp - 0x4dc], 0
mov word [ebp - 0x4ec], ax
call fcn.00403e20
mov eax, dword [ebp - 0x4a8]
cmp eax, 8
jb 0x402d8a
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
push 0x104
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x64
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.0040d470
mov byte [ebp - 4], 3
mov al, byte [ebp - 0x488]
mov byte [ebp - 0x50c], al
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 0x50b], 0
push 0x64
push eax
call fcn.0040fa53
push str.:_system.sav
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.0040fa53
add esp, 0x24
lea edx, [ebp - 0x78]
call fcn.004054e0
push eax
call fcn.004059d0
add esp, 4
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x4bc]
push eax
call fcn.004057d0
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 4
call fcn.00402560
push str.logs
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.0040fa53
add esp, 0xc
lea eax, [ebp - 0x78]
lea ecx, [ebp - 0x4a4]
push eax
call fcn.004057d0
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 5
call fcn.00402560
push str.HPSASetUpCpp.txt
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.0040fa53
mov eax, dword [ebp - 0x490]
add esp, 0xc
cmp eax, 8
jb 0x402e76
inc eax
lea ecx, [ebp - 0x4a4]
push eax
push dword [ebp - 0x4a4]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x490], 7
mov word [ebp - 0x4a4], ax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x494], 0
cmp eax, 8
jb 0x402eb1
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
push 1
mov dword [ebp - 4], 0
call fcn.00411cda
push eax
push 0x4356b4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x57c]
push eax
call fcn.004120c4
add esp, 0x14
push str.Output_message_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
add esp, 8
call fcn.00402790
lea edx, [ebp - 0x4ec]
test al, al
je 0x40354d
push str.InstallHPSA.exe
lea ecx, [ebp - 0x4d4]
call fcn.00405b40
add esp, 4
push str.start
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0xa
call fcn.004037e0
lea ecx, [ebp - 0x4d4]
mov byte [ebp - 4], 0xb
push ecx
mov edx, eax
lea ecx, [ebp - 0x4a4]
call fcn.00405000
add esp, 4
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x4a8]
cmp eax, 8
jb 0x402f67
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4a8], 7
cmp dword [ebp - 0x4c0], 8
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x4ac], 0
cmovae ecx, dword [ebp - 0x4d4]
mov word [ebp - 0x4bc], ax
call fcn.004028f0
test al, al
je 0x4034ed
push 0x435224
lea ecx, [ebp - 0x504]
call fcn.004037e0
mov esi, dword [ebp + 8]
push esi
push str.argc:__d_n
push 1
mov byte [ebp - 4], 0xe
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
mov edi, 1
add esp, 0xc
cmp esi, edi
jle 0x403155
lea edx, [edi + 1]
nop word [eax + eax]
mov esi, dword [ebp - 0x48c]
mov esi, dword [esi + edi*4]
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x403000
sub esi, ecx
xor ecx, ecx
inc esi
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040ad5f
mov dword [ebp - 0x580], eax
lea ecx, [esi - 1]
mov eax, dword [ebp - 0x48c]
push ecx
push dword [eax + edi*4]
lea eax, [ebp - 0x510]
push esi
mov esi, dword [ebp - 0x580]
push esi
push eax
call fcn.00412340
add esp, 0x18
push esi
push str.arg:__S_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
push 0x435714
lea edx, [ebp - 0x504]
lea ecx, [ebp - 0x578]
call fcn.00405b40
push esi
mov edx, eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x4bc]
call fcn.00405a80
add esp, 0x14
mov dword [ebp - 0x580], eax
lea ecx, [ebp - 0x504]
cmp ecx, eax
je 0x4030de
mov eax, dword [ebp - 0x4f0]
cmp eax, 8
jb 0x4030b0
inc eax
push eax
push dword [ebp - 0x504]
call fcn.00404540
push dword [ebp - 0x580]
xor eax, eax
mov dword [ebp - 0x4f0], 7
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x4f4], 0
mov word [ebp - 0x504], ax
call fcn.00403e20
mov eax, dword [ebp - 0x4a8]
cmp eax, 8
jb 0x4030fc
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
xor eax, eax
mov byte [ebp - 4], 0xe
mov word [ebp - 0x4bc], ax
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x4a8], 7
mov dword [ebp - 0x4ac], 0
cmp eax, 8
jb 0x40313b
inc eax
lea ecx, [ebp - 0x578]
push eax
push dword [ebp - 0x578]
call fcn.00404540
push 2
push esi
call fcn.0040a670
inc edi
add esp, 8
mov edx, 2
cmp edi, dword [ebp + 8]
jl 0x402ff0
lea eax, [ebp - 0x504]
push eax
lea edx, [ebp - 0x4d4]
lea ecx, [ebp - 0x4bc]
call fcn.00405090
add esp, 4
mov esi, eax
lea eax, [ebp - 0x4d4]
cmp eax, esi
je 0x4031c3
mov eax, dword [ebp - 0x4c0]
cmp eax, 8
jb 0x40319a
inc eax
lea ecx, [ebp - 0x4d4]
push eax
push dword [ebp - 0x4d4]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4c0], 7
push esi
lea ecx, [ebp - 0x4d4]
mov dword [ebp - 0x4c4], 0
mov word [ebp - 0x4d4], ax
call fcn.00403e20
mov eax, dword [ebp - 0x4a8]
cmp eax, 8
jb 0x4031e1
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
cmp dword [ebp - 0x4c0], 8
lea eax, [ebp - 0x4d4]
cmovae eax, dword [ebp - 0x4d4]
push eax
push str.args:__ls_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
mov ecx, dword [ebp - 0x4d4]
lea eax, [ebp - 0x4d4]
add esp, 0xc
lea esi, [ebp - 0x4d4]
cmp dword [ebp - 0x4c0], 8
cmovae eax, ecx
cmovae esi, ecx
push eax
push str.setupPath_and_args:__ls_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
add esp, 0xc
push 3
push ecx
push 0x435740
lea ecx, [ebp - 0x504]
call fcn.00403a30
cmp eax, 0xffffffff
jne 0x403336
push 3
push ecx
push 0x435748
lea ecx, [ebp - 0x504]
call fcn.00403a30
cmp eax, 0xffffffff
jne 0x403336
push str.not_find__s_or__s_n
jmp 0x40333b
push str.find__s_or__s_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
add esp, 8
lea eax, [ebp - 0x560]
push 0x44
push 0
push eax
call fcn.0040d470
add esp, 0xc
mov dword [ebp - 0x560], 0x44
lea eax, [ebp - 0x570]
xorps xmm0, xmm0
movups xmmword [ebp - 0x570], xmm0
push eax
lea eax, [ebp - 0x560]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4033b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.004066b0
add esp, 8
mov esi, 0xffffff9c
jmp 0x4033fe
push 0xffffffffffffffff
push dword [ebp - 0x570]
mov dword [ebp - 0x48c], 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x570]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x570]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x56c]
call esi
mov esi, dword [ebp - 0x48c]
push esi
push str.exit_code:__d_n
push 1
call fcn.00411cda
add esp, 4
push eax
call fcn.00406650
mov eax, dword [ebp - 0x4f0]
add esp, 0xc
cmp eax, 8
jb 0x403435
inc eax
lea ecx, [ebp - 0x504]
push eax
push dword [ebp - 0x504]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4f0], 7
mov word [ebp - 0x504], ax
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x4f4], 0
cmp eax, 8
jb 0x403470
inc eax
lea ecx, [ebp - 0x4a4]
push eax
push dword [ebp - 0x4a4]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x490], 7
mov word [ebp - 0x4a4], ax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x494], 0
cmp eax, 8
jb 0x4034ab
inc eax
lea ecx, [ebp - 0x4d4]
push eax
push dword [ebp - 0x4d4]
call fcn.00404540
mov ecx, dword [ebp - 0x4d8]
xor eax, eax
mov dword [ebp - 0x4c0], 7
mov dword [ebp - 0x4c4], 0
mov word [ebp - 0x4d4], ax
cmp ecx, 8
jb 0x4034e6
inc ecx
push ecx
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x4ec]
call fcn.00404540
mov eax, esi
jmp 0x4036de
mov eax, dword [ebp - 0x490]
cmp eax, 8
jb 0x40350b
inc eax
lea ecx, [ebp - 0x4a4]
push eax
push dword [ebp - 0x4a4]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x490], 7
mov word [ebp - 0x4a4], ax
mov eax, dword [ebp - 0x4c0]
mov dword [ebp - 0x494], 0
cmp eax, 8
jb 0x403546
inc eax
lea ecx, [ebp - 0x4d4]
push eax
push dword [ebp - 0x4d4]
call fcn.00404540
push 0
call fcn.004125d1
push str.NetFramework45Installed.ps1
lea ecx, [ebp - 0x4bc]
call fcn.00405b40
add esp, 4
push str.Powershell.exe__executionpolicy_bypass__File
lea ecx, [ebp - 0x578]
mov byte [ebp - 4], 0x12
call fcn.004037e0
lea ecx, [ebp - 0x4bc]
mov byte [ebp - 4], 0x13
push ecx
mov edx, eax
lea ecx, [ebp - 0x4a4]
call fcn.00405000
mov eax, dword [ebp - 0x564]
add esp, 4
cmp eax, 8
jb 0x4035ad
inc eax
lea ecx, [ebp - 0x578]
push eax
push dword [ebp - 0x578]
call fcn.00404540
cmp dword [ebp - 0x490], 8
lea eax, [ebp - 0x560]
push 0x44
push 0
lea esi, [ebp - 0x4a4]
cmovae esi, dword [ebp - 0x4a4]
push eax
call fcn.0040d470
add esp, 0xc
mov dword [ebp - 0x560], 0x44
lea eax, [ebp - 0x570]
xorps xmm0, xmm0
movups xmmword [ebp - 0x570], xmm0
push eax
lea eax, [ebp - 0x560]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403628
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failed___d_._n
call fcn.004066b0
add esp, 8
jmp 0x403648
push dword [ebp - 0x570]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x510], 0
call esi
push dword [ebp - 0x56c]
call esi
mov eax, dword [ebp - 0x490]
cmp eax, 8
jb 0x403666
inc eax
lea ecx, [ebp - 0x4a4]
push eax
push dword [ebp - 0x4a4]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x490], 7
mov word [ebp - 0x4a4], ax
mov eax, dword [ebp - 0x4a8]
mov dword [ebp - 0x494], 0
cmp eax, 8
jb 0x4036a1
inc eax
lea ecx, [ebp - 0x4bc]
push eax
push dword [ebp - 0x4bc]
call fcn.00404540
xor eax, eax
mov dword [ebp - 0x4a8], 7
mov word [ebp - 0x4bc], ax
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x4ac], 0
cmp eax, 8
jb 0x4036dc
inc eax
lea ecx, [ebp - 0x4ec]
push eax
push dword [ebp - 0x4ec]
call fcn.00404540
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040a65f
mov esp, ebp
pop ebp
ret