Function at 0x406a4e
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
push 0x7c
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x567]
mov byte [ebp - 0x568], bl
rep stosd dword es:[edi], eax
test byte [0x413694], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x406a9c
or byte [0x413694], 1
push 0x41368c
mov ecx, 0x413690
call fcn.0040487d
push 0x406d35
call fcn.0040ebc0
pop ecx
mov eax, dword [0x413690]
mov esi, 0x104
cmp dword [eax - 8], ebx
jne 0x406bdd
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x373]
mov byte [ebp - 0x374], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x374]
lea ecx, [ebp - 0xc]
push eax
call fcn.0040487d
lea eax, [ebp - 0x568]
push eax
push 0xe
push 0x40f94c
call fcn.0040582c
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x406b02
xor eax, eax
jmp 0x406b09
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push eax
lea ecx, [ebp - 0xc]
call fcn.00404aae
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x16b]
mov byte [ebp - 0x16c], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x16c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 4]
push eax
call fcn.0040487d
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll__mbsrchr]
pop ecx
cmp eax, ebx
pop ecx
jne 0x406b5d
or eax, 0xffffffff
jmp 0x406b60
sub eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00404b55
push eax
lea ecx, [ebp - 4]
call fcn.00404912
lea ecx, [ebp - 8]
call fcn.00404851
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.0040481e
lea eax, [ebp - 8]
push eax
call fcn.0040e28a
add esp, 0xc
mov edi, 0x413690
mov ecx, edi
push eax
call fcn.00404912
lea ecx, [ebp - 8]
call fcn.00404851
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404a22
push eax
mov ecx, edi
call fcn.00404912
lea ecx, [ebp - 8]
call fcn.00404851
lea ecx, [ebp - 4]
call fcn.00404851
lea ecx, [ebp - 0xc]
call fcn.00404851
push ebx
push dword [0x413690]
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x406c0c
push ecx
mov ecx, esp
push 0x413690
call fcn.0040481e
call fcn.0040d34f
test al, al
pop ecx
je 0x406d30
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x568]
mov dword [ebp - 0x68], 0x44
push eax
push 0xc
push 0x40f8f0
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], bx
call fcn.0040582c
mov ecx, dword [0x413664]
add esp, 0xc
mov edi, str._t_n
push eax
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00407cd6
push eax
lea eax, [ebp - 8]
push eax
call fcn.00406f2d
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00406f2d
lea ecx, [ebp - 8]
call fcn.00404851
lea ecx, [ebp - 0xc]
call fcn.00404851
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.0040481e
push 0x41368c
push edi
lea ecx, [ebp - 0x10]
call fcn.0040713f
push dword [ebp - 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea eax, [ebp - 0x66c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x26f]
mov byte [ebp - 0x270], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x568]
push dword [ebp - 0x14]
push dword [0x413690]
push eax
push 0x1e
push 0x40f92c
call fcn.0040582c
add esp, 0xc
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x270]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x10]
call fcn.00404851
lea ecx, [ebp - 0x14]
call fcn.00404851
pop edi
pop esi
pop ebx
leave
ret