Function at 0x4257c0
Capabilities:
Check if file exists
Check mutex on windows
Create directory
Create thread
Delete file
Get common file path

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push esi
push edi
push str.c:zv_npav4dbg.log
call ebp
test eax, eax
je 0x4257df
mov byte [0x46fec5], 1
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.c:zv_npav4.log
call esi
push str.npav4_started
call fcn.004073f0
call fcn.00409060
mov eax, dword [esp + 0x64]
push 0x190
xor ebx, ebx
push ebx
push 0x4693b8
mov dword [0x469cc4], eax
call fcn.0042e2e0
add esp, 0x10
xor eax, eax
push 1
lea ecx, [esp + 0x4c]
mov dword [esp + 0x40], eax
mov dword [esp + 0x48], eax
push ecx
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], 0xc
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push ebx
push ebx
push 1
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.Global__t3_mutx__123_
push 0x100001
lea ecx, [esp + 0x44]
lea eax, [esp + 0x50]
push ecx
mov dword [esp + 0x4c], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x425888
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call fcn.0043074c
mov dword [0x470144], ebx
call fcn.00409ed0
cmp eax, 1
jne 0x42589d
mov dword [0x470144], eax
mov dword [0x47015c], ebx
call fcn.004075f0
call fcn.0040e080
call fcn.0040df40
call fcn.0040e150
call fcn.0040e260
call fcn.0040e370
mov eax, dword [0x470180]
mov dword [0x46f944], ebx
cmp eax, ebx
je 0x4258e9
call eax
test eax, eax
je 0x4258e9
push str.NPAV_IS_EXPIRED
call fcn.004073f0
add esp, 4
push ebx
call fcn.0043074c
push 0x5000
push ebx
push 0x46a1e8
call fcn.0042e2e0
add esp, 0xc
push str.c:zvxPajPid.ini
call esi
call fcn.004077c0
call fcn.004076c0
call fcn.00407710
call fcn.00408830
call fcn.00407280
call fcn.00407890
push 0x104
push ebx
push 0x46f630
call fcn.0042e2e0
add esp, 0xc
push 0x104
push 0x46f630
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, 0x46f630
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x425950
mov edx, dword [str.NPDP]
mov cx, word [0x45ea5c]
mov dword [eax], edx
push 0x46f630
mov word [eax + 4], cx
call ebp
test eax, eax
jne 0x425982
push ebx
push 0x46f630
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, 0x46f630
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x425988
mov edx, dword [str.ZVMNSrvr.Log]
mov ecx, dword [0x45ea4c]
mov dword [eax], edx
mov edx, dword [0x45ea50]
mov dword [eax + 4], ecx
mov cx, word [0x45ea54]
mov dword [eax + 8], edx
mov word [eax + 0xc], cx
mov eax, 0x46f630
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4259c0
sub eax, edx
jne 0x4259d5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret 0x10
push 0x104
push ebx
push 0x470018
call fcn.0042e2e0
push 0x470018
call fcn.00407530
add esp, 0x10
mov ecx, 0x45b5a5
mov eax, 0x470018
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x425a20
cmp dl, bl
je 0x425a1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x425a20
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x425a00
xor eax, eax
jmp 0x425a25
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x425a76
push ebx
push 0x23
push 0x470018
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov eax, 0x470018
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x425a40
mov edx, dword [str.Net_Protector]
mov ecx, dword [0x45bcac]
mov dword [eax], edx
mov edx, dword [0x45bcb0]
mov dword [eax + 4], ecx
mov cx, word [0x45bcb4]
mov dword [eax + 8], edx
mov dl, byte [0x45bcb6]
mov word [eax + 0xc], cx
mov byte [eax + 0xe], dl
mov eax, 0x470018
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x425a80
mov ecx, dword [str._npav4schedule.ini]
mov edx, dword [0x45ea38]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [eax], ecx
mov ecx, dword [0x45ea3c]
mov dword [eax + 4], edx
mov edx, dword [0x45ea40]
mov dword [eax + 8], ecx
mov cx, word [0x45ea44]
mov dword [eax + 0xc], edx
mov dl, byte [0x45ea46]
mov word [eax + 0x10], cx
mov byte [eax + 0x12], dl
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push 0x40ed40
push ebx
push ebx
call esi
lea ecx, [esp + 0x14]
push ecx
push ebx
push ebx
push 0x40c060
push ebx
push ebx
call esi
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push 0x40bbf0
push ebx
push ebx
call esi
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 0x40b740
push ebx
push ebx
call esi
lea ecx, [esp + 0x20]
push ecx
push ebx
push ebx
push 0x40ba80
push ebx
push ebx
call esi
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push 0x40bbc0
push ebx
push ebx
call esi
lea eax, [esp + 0x28]
push eax
push ebx
push ebx
push 0x40cfa0
push ebx
push ebx
call esi
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x40d170
push ebx
push ebx
call esi
lea edx, [esp + 0x30]
push edx
push ebx
push ebx
push 0x4257a0
push ebx
push ebx
call esi
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push 0x40d490
push ebx
push ebx
call esi
push 0x470018
call ebp
test eax, eax
jne 0x425b90
lea ecx, [esp + 0x60]
push ecx
push ebx
push ebx
push 0x409ec0
push ebx
push ebx
call esi
lea edx, [esp + 0x38]
push edx
push ebx
push ebx
push 0x409330
push ebx
push ebx
call esi
push ebx
xor esi, esi
call fcn.0041e3c0
add esp, 4
mov ecx, 0x470380
call fcn.00406980
test eax, eax
jne 0x425bac
lea esi, [eax + 1]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x470128], ebx
mov dword [0x470124], ebx
mov dword [0x470120], ebx
push ebx
cmp esi, ebx
je 0x425bda
call fcn.0041e3c0
add esp, 4
push 0x3e8
call edi
jmp 0x425be2
call fcn.0041f290
add esp, 4
mov ebp, 1
cmp dword [0x470124], ebp
jne 0x425c26
mov dword [0x47014c], ebp
push ebx
cmp esi, ebx
je 0x425c10
call fcn.0041e3c0
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x425c33
call fcn.0041f290
add esp, 4
mov dword [0x470124], ebx
mov dword [0x470120], ebx
jmp 0x425c33
cmp dword [0x470128], ebp
jne 0x425c33
call fcn.00407ba0
cmp dword [0x470130], 0x1e
jg 0x425c42
add dword [0x470130], ebp
cmp dword [0x470138], 0x12c
jg 0x425c59
add dword [0x470138], ebp
jmp 0x425bb2
cmp dword [0x47014c], ebp
jne 0x425bb2
call fcn.00408a30
mov dword [0x47014c], ebx
mov dword [0x470138], ebx
jmp 0x425bb2