Function at 0x403de0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor dl, dl
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x213]
mov byte [ebp - 0x214], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0xc], 1
stosb byte es:[edi], al
push ebx
xor bx, 0x70c5
sub ebx, eax
or bx, cx
xor bl, bl
test cx, bx
cmp bh, cl
mov bh, 3
pop ebx
lea eax, [ebp - 0x214]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x214]
push ecx
push edx
lea eax, [ebp - 0x110]
push 0x40f748
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
pushal
sub ebx, 0xe88
test ecx, esi
dec ch
test bh, 0x2a
or ah, 0x12
sub bh, dh
or ax, ax
or al, 0x2f
cmp ch, 5
popal
lea ecx, [ebp - 8]
lea edx, [ebp - 4]
push ecx
push edx
call fcn.00403790
add esp, 8
push ecx
push edi
push ax
test di, 0x934
test edi, 0x48bd
and edi, eax
and ch, 0xb
cmp cl, 0x6f
mov cl, 0xc
sub di, 0x5090
test cx, di
pop ax
pop edi
pop ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0x10]
push ecx
push edx
push eax
push edi
push ebx
call fcn.004043a0
add esp, 0x18
test eax, eax
jne 0x403ee8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push edx
xor al, 0x3d
sub ah, 0x2b
add eax, 0x7c28
or dh, dl
xor ax, dx
cmp ax, 0x4001
pop edx
pop eax
call fcn.00403d20
mov dword [0x41cc54], eax
push edx
add edx, 0x2915
sub dl, ah
pop edx
mov edx, dword [0x41cc54]
mov eax, dword [ebp - 4]
xor ecx, ecx
test edx, edx
mov edx, dword [ebp - 8]
sete cl
push ecx
push edx
push eax
lea ecx, [ebp - 0x110]
push 0x40f75c
push ecx
call fcn.00401f40
add esp, 0x14
test eax, eax
jne 0x403f48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
cmp cl, 0x3f
or ch, dl
cmp cx, cx
or ch, 0x1f
pop ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00403af0
add esp, 4
push ecx
dec ecx
and cx, di
or cx, 0x61be
pop ecx
call fcn.00401a70
push ax
push ecx
push esi
dec al
pop esi
pop ecx
pop ax
push 0x40f780
call fcn.00401b30
add esp, 4
cmp eax, 0xffffffff
je 0x403f97
mov esi, 0xe
jmp 0x403fae
push 0x40f774
call fcn.00401b30
add esp, 4
cmp eax, 0xffffffff
je 0x403fd7
mov esi, 0xf
push edi
push ebx
call fcn.004048b0
add esp, 8
test eax, eax
je 0x403fd7
push esi
call fcn.00401c80
push esi
call fcn.00403090
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push ax
push dx
and ax, 0x4e68
test ch, dh
mov al, 0x4d
dec dx
and dx, cx
pop dx
pop ax
pop edi
lea eax, [ebp - 0x110]
push eax
push ebx
call fcn.00401eb0
add esp, 8
test eax, eax
jne 0x404006
xor esi, esi
jmp 0x404009
mov esi, dword [ebp - 0xc]
push ebx
push cx
push dx
xor ch, bl
pop dx
pop cx
pop ebx
test esi, esi
je 0x40402e
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401380
add esp, 4
test eax, eax
jne 0x40402e
mov dword [ebp - 0xc], eax
mov esi, eax
push ecx
push edi
push ax
test di, 0x934
test edi, 0x48bd
and edi, eax
mov ebp, 0x23000048
clc
and ch, 0xb
cmp cl, 0x6f
mov cl, 0xc
sub di, 0x5090
test cx, di
pop ax
pop edi
pop ecx
test esi, esi
jne 0x404069
mov edx, dword [ebp + 8]
push esi
push edx
call fcn.00404220
add esp, 8
mov dword [ebp - 0xc], eax
mov esi, eax
jbe 0x40408b
push si
mov si, 0x5c11
pop si
ja 0x40408b
jo 0x404039
push cs
invalid
test esi, esi
je 0x404099
push 0xffffffffffffffff
call fcn.00403090
add esp, 4
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push 0x40f794
call dword [sym.imp.KERNEL32.DLL_WinExec]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret