Function at 0x420e80
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x4607d7
mov eax, dword fs:[0]
push eax
sub esp, 0x8f8
mov eax, dword [0x498f90]
xor eax, esp
mov dword [esp + 0x8f4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x498f90]
xor eax, esp
push eax
lea eax, [esp + 0x90c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x92c]
mov ecx, dword [esp + 0x924]
mov eax, dword [esp + 0x920]
mov edx, dword [esp + 0x928]
xor ebx, ebx
push ebx
mov dword [esp + 0x18], ecx
lea ebp, [edi + 4]
push 0x462f68
mov ecx, ebp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], edx
mov dword [edi], ebx
call fcn.00402040
push 0x103
lea eax, [esp + 0x1b1]
push ebx
push eax
mov byte [esp + 0x1b8], bl
call fcn.0043f310
mov edx, dword [0x49a868]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x608]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x420f91
push ebx
push 0x462f68
mov ecx, ebp
mov dword [edi], 0xffff009c
call fcn.00402040
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 1
xor ecx, ecx
call fcn.00420ca0
add esp, 4
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x11
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.GetModuleFileName
mov byte [ecx + 4], bl
call fcn.00402040
mov ecx, edi
call fcn.00420bc0
xor al, al
jmp 0x421412
lea eax, [esp + 0x708]
push eax
lea ecx, [esp + 0x80c]
push ecx
lea edx, [esp + 0x50c]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x614]
push ecx
call fcn.00441829
push 0x468f0c
push str.LmsCheckKey
lea edx, [esp + 0x520]
push edx
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x1d0]
push ecx
call fcn.00441e55
add esp, 0x28
lea edx, [esp + 0x404]
push edx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x421058
push ebx
push 0x462f68
mov ecx, ebp
mov dword [edi], 0xffff009c
call fcn.00402040
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 1
xor ecx, ecx
call fcn.00420ca0
add esp, 4
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xb
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], ebx
push str.GetTempPath
mov byte [ecx + 4], bl
call fcn.00402040
mov ecx, edi
call fcn.00420bc0
xor al, al
jmp 0x421412
lea eax, [esp + 0xa8]
push eax
push ebx
push 0x468ef0
lea ecx, [esp + 0x410]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4210c8
push ebx
push 0x462f68
mov ecx, ebp
mov dword [edi], 0xffff009c
call fcn.00402040
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 1
xor ecx, ecx
call fcn.00420ca0
add esp, 4
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.GetTempFileName
call fcn.00402920
mov ecx, edi
call fcn.00420bc0
xor al, al
jmp 0x421412
lea eax, [esp + 0x2b0]
mov word [esp + 0x2b0], 0x22
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4210e0
sub eax, edx
lea esi, [esp + eax + 0x2b0]
lea eax, [esp + 0xa8]
mov edx, esi
mov ecx, eax
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
cmp cl, bl
jne 0x421100
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x421111
sub eax, edx
mov word [esi + eax], 0x22
add esi, eax
lea ecx, [esp + 0x50]
lea edx, [esp + 0x1ac]
lea eax, [esp + 0x2b0]
push ecx
mov dword [esp + 0x54], 0x3c
mov dword [esp + 0x58], 0x440
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], str.open
mov dword [esp + 0x64], edx
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x4211c1
push ebx
push 0x462f68
mov ecx, ebp
mov dword [edi], 0xffff009c
call fcn.00402040
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
push 1
xor ecx, ecx
call fcn.00420ca0
add esp, 4
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push str.ShellExecuteEx
call fcn.00402920
mov ecx, edi
call fcn.00420bc0
xor al, al
jmp 0x421412
mov edx, dword [esp + 0x88]
push 0xea60
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, 0xf
mov dword [esp + 0xa4], esi
mov dword [esp + 0xa0], ebx
mov byte [esp + 0x90], bl
cmp eax, ebx
mov dword [esp + 0x914], ebx
mov byte [esp + 0x1b], bl
je 0x421237
cmp eax, 0x102
je 0x421221
push 1
xor ecx, ecx
lea esi, [esp + 0x34]
call fcn.00420ca0
add esp, 4
mov byte [esp + 0x914], 1
jmp 0x421323
push str.Timed_out_after_60_seconds
lea ecx, [esp + 0x90]
call fcn.004027e0
jmp 0x421343
mov ecx, dword [esp + 0x88]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x42126b
push 1
xor ecx, ecx
lea esi, [esp + 0x34]
call fcn.00420ca0
add esp, 4
mov byte [esp + 0x914], 2
jmp 0x421323
mov ecx, dword [esp + 0x20]
cmp ecx, ebx
je 0x42138b
test ecx, 0x20000000
je 0x42130e
and ecx, 0xdfffffff
sub ecx, 0x1fe89
mov dword [esp + 0x20], ecx
push 0xffff009c
mov ecx, edi
call fcn.00420ba0
mov edx, dword [esp + 0x20]
mov dword [esp + 0x30], edx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], ebx
mov byte [esp + 0x38], bl
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x38], esp
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x934], 3
call fcn.0041b190
mov ecx, edi
call fcn.00420bc0
lea ecx, [esp + 0x30]
call fcn.00401ce0
mov ecx, dword [esp + 0x88]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [esp + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x8c]
call fcn.00401d10
xor al, al
jmp 0x421412
push ebx
lea esi, [esp + 0x34]
call fcn.00420ca0
add esp, 4
mov byte [esp + 0x914], 4
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x98]
call fcn.00401d70
lea ecx, [esp + 0x30]
mov byte [esp + 0x914], bl
call fcn.00401d10
push 0xffff009c
mov ecx, edi
call fcn.00420ba0
sub esp, 0x1c
lea eax, [esp + 0xa8]
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.004027b0
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.WaitFor..._GetExitCode
call fcn.00402920
mov ecx, edi
call fcn.00420bc0
jmp 0x4212de
lea eax, [esp + 0xa8]
push 0x465cd8
push eax
call fcn.00440279
mov ebp, eax
add esp, 8
cmp ebp, ebx
jne 0x42143a
push 0xffff009c
mov ecx, edi
mov byte [esp + 0x1f], 1
call fcn.00420ba0
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x38], esp
push 1
xor ecx, ecx
call fcn.00420ca0
add esp, 4
mov ecx, edi
call fcn.00420bc0
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Read_temporary_file
call fcn.00402920
mov ecx, edi
call fcn.00420bc0
mov edx, dword [esp + 0x88]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x8c]
call fcn.00401d10
cmp byte [esp + 0x1b], bl
sete al
mov ecx, dword [esp + 0x90c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x8f4]
xor ecx, esp
call fcn.0043ec69
add esp, 0x904
ret
mov edi, dword [esp + 0x24]
push edi
push 0x468e7c
push ebp
call fcn.00441e38
add esp, 0xc
xor esi, esi
cmp dword [edi], ebx
jle 0x4214ac
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x28]
sub eax, edi
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x2c]
push ecx
push 0x468e7c
push ebp
call fcn.00441e38
lea edx, [esp + 0x28]
push edx
push 0x468e7c
push ebp
call fcn.00441e38
add esp, 0x18
cmp esi, dword [esp + 0x91c]
jge 0x42149e
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov dword [ecx + edi], eax
mov dword [edi], edx
mov eax, dword [esp + 0x24]
add esi, 1
add edi, 4
cmp esi, dword [eax]
jl 0x421461
push ebp
call fcn.0043ffea
lea ecx, [esp + 0xac]
push ecx
call fcn.004411be
add esp, 8
jmp 0x4213f1