Function at 0x4071c8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
push 0x7c
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x567]
mov byte [ebp - 0x568], bl
rep stosd dword es:[edi], eax
test byte [0x415694], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x407216
or byte [0x415694], 1
push 0x41568c
mov ecx, 0x415690
call fcn.0040485f
push 0x4074af
call fcn.00410308
pop ecx
mov eax, dword [0x415690]
mov esi, 0x104
cmp dword [eax - 8], ebx
jne 0x407357
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x373]
mov byte [ebp - 0x374], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x374]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x374]
lea ecx, [ebp - 0xc]
push eax
call fcn.0040485f
lea eax, [ebp - 0x568]
push eax
push 0xe
push 0x41194c
call fcn.0040580e
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x40727c
xor eax, eax
jmp 0x407283
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push eax
lea ecx, [ebp - 0xc]
call fcn.00404a90
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x16b]
mov byte [ebp - 0x16c], bl
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x16c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x16c]
lea ecx, [ebp - 4]
push eax
call fcn.0040485f
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll__mbsrchr]
pop ecx
cmp eax, ebx
pop ecx
jne 0x4072d7
or eax, 0xffffffff
jmp 0x4072da
sub eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
call fcn.00404b37
push eax
lea ecx, [ebp - 4]
call fcn.004048f4
lea ecx, [ebp - 8]
call fcn.00404833
lea eax, [ebp - 4]
push eax
push ecx
lea eax, [ebp - 0xc]
mov ecx, esp
push eax
call fcn.00404800
lea eax, [ebp - 8]
push eax
call fcn.0040f9d2
add esp, 0xc
mov edi, 0x415690
mov ecx, edi
push eax
call fcn.004048f4
lea ecx, [ebp - 8]
call fcn.00404833
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00404a04
push eax
mov ecx, edi
call fcn.004048f4
lea ecx, [ebp - 8]
call fcn.00404833
lea ecx, [ebp - 4]
call fcn.00404833
lea ecx, [ebp - 0xc]
call fcn.00404833
push ebx
push dword [0x415690]
call dword [sym.imp.MSVCRT.dll__access]
pop ecx
cmp eax, 0xffffffff
pop ecx
jne 0x407386
push ecx
mov ecx, esp
push 0x415690
call fcn.00404800
call fcn.0040ea97
test al, al
pop ecx
je 0x4074aa
xor eax, eax
lea edi, [ebp - 0x20]
mov dword [ebp - 0x24], ebx
push 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x568]
mov dword [ebp - 0x68], 0x44
push eax
push 0xc
push 0x4118f0
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], bx
call fcn.0040580e
mov ecx, dword [0x415664]
add esp, 0xc
mov edi, str._t_n
push eax
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00408450
push eax
lea eax, [ebp - 8]
push eax
call fcn.004076a7
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004076a7
lea ecx, [ebp - 8]
call fcn.00404833
lea ecx, [ebp - 0xc]
call fcn.00404833
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.00404800
push 0x41568c
push edi
lea ecx, [ebp - 0x10]
call fcn.004078b9
push dword [ebp - 0x10]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
lea eax, [ebp - 0x66c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x26f]
mov byte [ebp - 0x270], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x568]
push dword [ebp - 0x14]
push dword [0x415690]
push eax
push 0x1e
push 0x41192c
call fcn.0040580e
add esp, 0xc
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x270]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x10]
call fcn.00404833
lea ecx, [ebp - 0x14]
call fcn.00404833
pop edi
pop esi
pop ebx
leave
ret