Function at 0x415790
Capabilities:
Create directory
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x434481
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1a58
call fcn.00425d70
mov eax, dword [0x43f474]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x420]
push eax
call fcn.0040ff00
add esp, 4
mov dword [ebp - 4], 0
push str._binwindows_
lea ecx, [ebp - 0x420]
call fcn.00415fa0
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0x43c]
call fcn.004060c0
mov byte [ebp - 4], 1
push 0x439dd0
lea ecx, [ebp - 0x43c]
call fcn.00415fa0
lea edx, [ebp - 0x420]
push edx
lea ecx, [ebp - 0xf4]
call fcn.004060c0
mov byte [ebp - 4], 2
push 0x439de4
lea ecx, [ebp - 0xf4]
call fcn.00415fa0
lea ecx, [ebp - 0x43c]
call fcn.004018f0
push eax
push 0x439df8
call fcn.0041b366
add esp, 8
push str.safeu
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1a18], esp
lea eax, [ebp - 0xf4]
push eax
call fcn.004060c0
mov dword [ebp - 0x1a30], eax
mov ecx, dword [ebp - 0x1a30]
mov dword [ebp - 0x1a34], ecx
mov byte [ebp - 4], 3
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1a1c], esp
lea edx, [ebp - 0x43c]
push edx
call fcn.004060c0
mov dword [ebp - 0x1a38], eax
mov byte [ebp - 4], 2
call fcn.00410be0
add esp, 0x3c
push 0x415560
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push str.pm___________________________________________
push 1
push 0x411
push 0x439e34
push 0x439e58
call fcn.00410db0
add esp, 0x14
push str.usbexplore.exe
call fcn.0040ff90
add esp, 4
movzx eax, al
test eax, eax
je 0x41594c
push str._usbexplore_shell_already_run_
push 1
push 0x414
push 0x439e90
push 0x439eb4
call fcn.00410db0
add esp, 0x14
mov dword [ebp - 0x1a20], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf4]
call fcn.004018d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.004018d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.004018d0
mov eax, dword [ebp - 0x1a20]
jmp 0x415f40
push str.cdbf1268_7b15_4b6c_bf16_c2441de79550
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x77c], eax
cmp dword [ebp - 0x77c], 0
jne 0x4159cd
push str.shell_already_run_
push 1
push 0x41b
push 0x439ef8
push 0x439f1c
call fcn.00410db0
add esp, 0x14
mov dword [ebp - 0x1a24], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf4]
call fcn.004018d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.004018d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.004018d0
mov eax, dword [ebp - 0x1a24]
jmp 0x415f40
push 0x104
lea ecx, [ebp - 0x548]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x439f24
movsx edx, byte [ebp - 0x548]
push edx
push str._c:_s_
lea eax, [ebp - 0x2f8]
push eax
call fcn.0041b225
add esp, 0x10
push str.EdpSecUdQt20230824
movsx ecx, byte [ebp - 0x548]
push ecx
push str._c:_s
lea edx, [ebp - 0x1f8]
push edx
call fcn.0041b225
add esp, 0x10
push 0x104
lea eax, [ebp - 0x778]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x404], 0
xor ecx, ecx
mov byte [ebp - 0x403], cl
movsx edx, byte [ebp - 0x778]
push edx
push 0x439f5c
lea eax, [ebp - 0x404]
push eax
call fcn.0041b225
add esp, 0xc
lea ecx, [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x66c]
call fcn.00401790
mov byte [ebp - 4], 4
push 0x439f60
lea ecx, [ebp - 0x66c]
call fcn.00415fa0
lea ecx, [ebp - 0x66c]
call fcn.004018f0
push eax
push 0x439f64
lea edx, [ebp - 0x650]
push edx
call fcn.0041b225
add esp, 0xc
lea eax, [ebp - 0x2f8]
push eax
push 0x439f68
lea ecx, [ebp - 0x400]
push ecx
call fcn.0041b225
add esp, 0xc
mov byte [ebp - 4], 5
lea edx, [ebp - 0x400]
push edx
lea ecx, [ebp - 0x30]
call fcn.00401790
mov dword [ebp - 0x1a3c], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x650]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00401790
mov dword [ebp - 0x1a40], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x4c]
push edx
call fcn.00411b30
add esp, 8
mov byte [ebp - 0x1a41], al
mov al, byte [ebp - 0x1a41]
mov byte [ebp - 0x1a25], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4c]
call fcn.004018d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x30]
call fcn.004018d0
movzx ecx, byte [ebp - 0x1a25]
test ecx, ecx
je 0x415c21
push str.IsModified
push 1
push 0x438
push 0x439f78
push 0x439f9c
call fcn.00410db0
add esp, 0x14
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x1a2c], esp
lea edx, [ebp - 0x1f8]
push edx
call fcn.00401790
mov dword [ebp - 0x1a48], eax
call fcn.00411090
add esp, 0x1c
push 0
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x68]
call fcn.00401790
mov dword [ebp - 0x1a4c], eax
mov byte [ebp - 4], 8
lea edx, [ebp - 0x650]
push edx
lea ecx, [ebp - 0x84]
call fcn.00401790
mov dword [ebp - 0x1a50], eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x84]
push ecx
call fcn.00411440
add esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x84]
call fcn.004018d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x68]
call fcn.004018d0
lea edx, [ebp - 0x2f8]
push edx
lea ecx, [ebp - 0xa0]
call fcn.00401790
lea eax, [ebp - 0xa0]
push eax
call fcn.00411af0
add esp, 4
lea ecx, [ebp - 0xa0]
call fcn.004018d0
lea ecx, [ebp - 0x2f8]
push ecx
push str._sbinwindows_
lea edx, [ebp - 0x8a0]
push edx
call fcn.0041b225
add esp, 0xc
lea eax, [ebp - 0x2f8]
push eax
push str._sbinwindowsusbexplore.exe
lea ecx, [ebp - 0x8a0]
push ecx
call fcn.0041b225
add esp, 0xc
lea edx, [ebp - 0x8a0]
push edx
push 1
push 0x450
push 0x439fd4
push 0x439ff8
call fcn.00410db0
add esp, 0x14
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0xbc]
call fcn.00401790
mov dword [ebp - 0x1a54], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xbc]
push ecx
lea edx, [ebp - 0xd8]
push edx
call fcn.00401390
add esp, 8
mov dword [ebp - 0x1a58], eax
mov eax, dword [ebp - 0x1a58]
mov dword [ebp - 0x1a5c], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x1a5c]
call fcn.00401aa0
push eax
lea ecx, [ebp - 0x798]
call fcn.00401940
mov dword [ebp - 0x1a60], eax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xd8]
call fcn.00401a80
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xbc]
call fcn.004018d0
lea ecx, [ebp - 0x404]
push ecx
lea edx, [ebp - 0x8a0]
push edx
push str.pm____s__disk_s
lea eax, [ebp - 0x9a8]
push eax
call fcn.0041b225
add esp, 0x10
lea ecx, [ebp - 0x9a8]
push ecx
push 1
push 0x454
push 0x43a014
push 0x43a038
call fcn.00410db0
add esp, 0x14
lea ecx, [ebp - 0x798]
call fcn.00401aa0
push eax
call fcn.00412300
add esp, 4
push str._disk_
lea ecx, [ebp - 0x9c4]
call fcn.00401790
mov dword [ebp - 0x1a64], eax
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x404]
push edx
lea ecx, [ebp - 0x9c4]
call fcn.00415fa0
lea ecx, [ebp - 0x1a10]
call fcn.00403aa0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x1a10]
call fcn.00403e50
cmp eax, 3
jne 0x415e3c
call fcn.00415620
mov dword [ebp - 0x1a68], eax
cmp dword [ebp - 0x1a68], 0
je 0x415dd9
push 1
push 0
lea ecx, [ebp - 0x9c4]
call fcn.004018f0
push eax
lea eax, [ebp - 0x8a0]
push eax
push 0x43a048
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x415e3a
push 0
lea ecx, [ebp - 0x9c4]
call fcn.004018f0
push eax
lea ecx, [ebp - 0x8a0]
push ecx
push 0
call fcn.004155f0
add esp, 0x10
test eax, eax
je 0x415e1c
push str.pm_run_as_admin_ok_
push 1
push 0x463
push 0x43a064
push 0x43a088
call fcn.00410db0
add esp, 0x14
jmp 0x415e3a
push str.pm_run_as_admin_error_
push 1
push 0x467
push 0x43a0a8
push 0x43a0cc
call fcn.00410db0
add esp, 0x14
jmp 0x415e60
push 1
push 0
lea ecx, [ebp - 0x9c4]
call fcn.004018f0
push eax
lea edx, [ebp - 0x8a0]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [ebp - 0x77c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1a10]
call fcn.00403be0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x9c4]
call fcn.004018d0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x798]
call fcn.00401a80
jmp 0x415ed6
mov dword [ebp - 4], 4
push str.pm_00______________________________
push 1
push 0x476
push str....._src_secureHDiskShellmain.cpp
push str.main
call fcn.00410db0
add esp, 0x14
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x66c]
call fcn.004018d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xf4]
call fcn.004018d0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x43c]
call fcn.004018d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x420]
call fcn.004018d0
jmp 0x415f3e
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00419e3a
mov esp, ebp
pop ebp
ret