Function at 0x408ec0
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541a80
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x594ca8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi]
mov ecx, 0x5704e4
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f16
test dx, dx
je 0x408f12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f16
add eax, 4
add ecx, 4
test dx, dx
jne 0x408ef0
xor eax, eax
jmp 0x408f1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x4096c3
call fcn.00417597
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408f42
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x17
lea esi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0040a5c0
mov eax, dword [ebp - 0x10]
add esp, 4
mov ecx, 0x5704e4
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f96
test dx, dx
je 0x408f92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f96
add eax, 4
add ecx, 4
test dx, dx
jne 0x408f70
xor eax, eax
jmp 0x408f9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x409219
push 0x570ea0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00404260
push 0x570c9c
push eax
lea eax, [ebp - 0x14]
mov bl, 1
push eax
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409000
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409023
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00404260
push 0x570c9c
push eax
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 4], 4
call fcn.00404260
add esp, 0x14
mov edx, esp
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], esp
push 0x570eb0
push eax
push edx
call fcn.00404260
push 0x57058c
lea eax, [ebp - 0x18]
push edi
push eax
mov byte [ebp - 4], 6
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0x28], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0xa
call fcn.0040a350
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4090df
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409102
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409125
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0xb
call fcn.00404260
push 0x570ebc
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xc
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x24], esp
push 0x570eb0
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0xe
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x20], esp
push 0x570ed0
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x12
call fcn.0040a350
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4091d3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4091f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409219
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 8], 0
je 0x40931f
push 0x19
lea esi, [ebp - 0x10]
call fcn.0040a5c0
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
mov ecx, esi
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0x13
call fcn.00404260
push 0x570c9c
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x14
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x24], esp
push 0x570eb0
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x16
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x1a
call fcn.0040a350
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4092d9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4092fc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40931f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
mov byte [ebp - 4], 0x1b
call fcn.00404260
push 0x570c9c
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x1c
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x24], esp
push 0x570eb0
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x1e
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x22
call fcn.0040a350
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4093ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4093ed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409410
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0xc], 0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
je 0x4095dd
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
call fcn.00404260
push 0x570c9c
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x23
call fcn.00404260
push 0x570eb0
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x24
call fcn.00404260
mov eax, dword [eax]
add esp, 0x24
push 5
push 0
push 0
push eax
push str.TaskbarPin
push 0
call ebx
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409489
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4094cf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1a
lea esi, [ebp - 0x10]
call fcn.0040a5c0
add esp, 4
push 0x29
push str.MicrosoftInternet_ExplorerQuick_Launch
mov ecx, esi
call fcn.00404340
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
mov ecx, esi
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0x25
call fcn.00404260
push 0x570c9c
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x26
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x24], esp
push 0x570eb0
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x28
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x2c
call fcn.0040a350
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409597
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4095ba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4095dd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
call fcn.00404260
push 0x570c9c
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x2d
call fcn.00404260
push 0x570eb0
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00404260
mov eax, dword [eax]
add esp, 0x24
push 5
push 0
push 0
push eax
push str.startpin
push 0
call ebx
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409646
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409669
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40968c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4096c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret