Function at 0x406f73
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412fed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9f4
push edi
mov dword [ebp - 0x9d8], ecx
mov dword [ebp - 0x10], 1
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x9d8]
mov ecx, dword [eax + 0xdc]
push ecx
push 0x4075ad
call sub.MFC42.DLL_AfxBeginThread
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x9d8]
cmp dword [edx + 0x138], 0
je 0x406fe4
push 0xffffffffffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x40709e
mov edx, dword [ebp - 0x9d8]
mov ecx, dword [edx + 0xdc]
mov eax, dword [ebp - 0x9d8]
mov edx, dword [eax + 0xdc]
mov eax, dword [edx]
call dword [eax + 0xc0]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 1
je 0x40701a
xor eax, eax
jmp 0x407414
mov byte [ebp - 0x48], 0
mov ecx, 0xc
xor eax, eax
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 0x448], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x447]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x48]
push ecx
push str.TIPCAPTION3
push 0x4188b8
push 0x4188c0
mov ecx, 0x419598
call fcn.0040298e
lea edx, [ebp - 0x448]
push edx
push str.TIPOUT03
push 0x4188d8
push 0x4188e0
mov ecx, 0x419598
call fcn.0040298e
push 0x40
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x448]
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x64c], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x64b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x200
lea edx, [ebp - 0x64c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x760], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x75f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x760]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4188ec
lea ecx, [ebp - 0x760]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x4188f0
lea edx, [ebp - 0x760]
push edx
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x768]
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 4], 0
lea eax, [ebp - 0x768]
push eax
call fcn.0040641c
add esp, 4
lea ecx, [ebp - 0x660]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64c]
push ecx
lea ecx, [ebp - 0x660]
call fcn.0040b6a0
push str.ModFrwk.dll
lea edx, [ebp - 0x768]
push edx
lea eax, [ebp - 0x9c4]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0x9dc], eax
mov ecx, dword [ebp - 0x9dc]
mov dword [ebp - 0x9e0], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x9e0]
push edx
lea ecx, [ebp - 0x660]
call fcn.0040b5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c4]
call sub.MFC42.DLL_CString::CString
push str.Deploy.dll
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0x9c8]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x9e4], eax
mov edx, dword [ebp - 0x9e4]
mov dword [ebp - 0x9e8], edx
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x9e8]
push eax
lea ecx, [ebp - 0x660]
call fcn.0040b5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9c8]
call sub.MFC42.DLL_CString::CString
push str.AppDeploy.dll
lea ecx, [ebp - 0x768]
push ecx
lea edx, [ebp - 0x9cc]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x9ec], eax
mov eax, dword [ebp - 0x9ec]
mov dword [ebp - 0x9f0], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x9f0]
push ecx
lea ecx, [ebp - 0x660]
call fcn.0040b5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9cc]
call sub.MFC42.DLL_CString::CString
push str._viewmgr.dll
lea edx, [ebp - 0x768]
push edx
lea eax, [ebp - 0x9d0]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0x9f4], eax
mov ecx, dword [ebp - 0x9f4]
mov dword [ebp - 0x9f8], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x9f8]
push edx
lea ecx, [ebp - 0x660]
call fcn.0040b5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9d0]
call sub.MFC42.DLL_CString::CString
push str.ZExUiLib.dll
lea eax, [ebp - 0x768]
push eax
lea ecx, [ebp - 0x9d4]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x9fc], eax
mov edx, dword [ebp - 0x9fc]
mov dword [ebp - 0xa00], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa00]
push eax
lea ecx, [ebp - 0x660]
call fcn.0040b5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9d4]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x764], 0
jmp 0x407306
mov ecx, dword [ebp - 0x764]
add ecx, 1
mov dword [ebp - 0x764], ecx
lea ecx, [ebp - 0x660]
call fcn.0040b5e0
cmp dword [ebp - 0x764], eax
jge 0x4073ee
mov edx, dword [ebp - 0x764]
push edx
lea eax, [ebp - 0x76c]
push eax
lea ecx, [ebp - 0x660]
call fcn.0040b660
mov byte [ebp - 0x9c0], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x9bf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 0x76c]
push ecx
lea edx, [ebp - 0x760]
push edx
push 0x418944
lea eax, [ebp - 0x9c0]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x44
push 0
lea ecx, [ebp - 0x7c0]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea edx, [ebp - 0x77c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x77c]
push eax
lea ecx, [ebp - 0x7c0]
push ecx
push 0x418950
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x9c0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp - 0x77c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x778]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x76c]
call sub.MFC42.DLL_CString::CString
jmp 0x4072f7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x660]
call fcn.004116c4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x768]
call sub.MFC42.DLL_CString::CString
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret