Function at 0x402a20
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0xdc
xor eax, eax
mov ecx, 0x3e8
mov byte [0x41a4ec], 0xd
push edi
push eax
push 0x80
push 2
push eax
mov edi, 0x41954c
push eax
push 0x40000000
rep stosd dword es:[edi], eax
push str.Report.txt
mov byte [0x41a4ed], 0xa
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x419530], eax
jne 0x402a87
push 0
push str.Error
push str.Cant_create_file_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
add esp, 0xdc
ret 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x12]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xe]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0xe]
push edx
mov edx, dword [esp + 0x10]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x2c]
push str._d__d__d__d:_2.2d_
push eax
call edi
push str.Report_generated_on
call fcn.004029f0
lea ecx, [esp + 0x38]
push ecx
call fcn.004029f0
push str.by_MicroDog_Diagnose__version_4.0.4.0_.
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.System_Information
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
add esp, 0x40
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
add esp, 8
call fcn.00402610
call fcn.00401140
mov eax, dword [0x41aa04]
cmp eax, 0x1f4
je 0x402b72
cmp eax, 0x1f5
je 0x402b72
cmp eax, 0x1f6
jne 0x402b9f
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x402b9f
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x402b9f
push 0x105
push 0x41a5f8
call eax
jmp 0x402baf
push 0x105
push 0x41a5f8
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._____Windows_folder____:
call fcn.004029f0
push 0x41a5f8
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
add esp, 0xc
push 0x105
push 0x41a4f0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str._____System_folder_____:
call fcn.004029f0
push 0x41a4f0
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
mov eax, dword [0x41aa04]
add esp, 0xc
cmp eax, 0x15f
je 0x402cd1
cmp eax, 0x190
je 0x402cd1
cmp eax, 0x578
je 0x402cd1
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Parallel_Port_Information
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Ports
mov byte [0x41a700], 0
call fcn.00401c70
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.USB_Port_Information
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x4158d4
call fcn.00401c70
add esp, 0x40
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Drivers_Information
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Installation_information:
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
lea edx, [esp + 0x28]
mov dword [esp + 0x28], 0
push edx
push str.build_no
push str.SOFTWARE_rcdrvinfoumh
push 0x80000002
call fcn.00401040
add esp, 0x34
test eax, eax
je 0x402d73
mov eax, dword [esp + 4]
lea ecx, [esp + 0x18]
push eax
push str.____Build_number:__d
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call fcn.004029f0
add esp, 0x10
jmp 0x402d80
push str.____No_build_number_Information.
call fcn.004029f0
add esp, 4
push 0x41a4ec
call fcn.004029f0
lea eax, [esp + 0x1c]
push eax
push str.product_time
push str.SOFTWARE_rcdrvinfoumh
push 0x80000002
call fcn.00401040
add esp, 0x14
test eax, eax
je 0x402dc3
push str.____Package_time:
call fcn.004029f0
lea ecx, [esp + 0x1c]
push ecx
call fcn.004029f0
add esp, 8
jmp 0x402dd0
push str.____No_package_time_Information.
call fcn.004029f0
add esp, 4
push 0x41a4ec
call fcn.004029f0
push str.Files:_______path_____t_t__size__t________version_________status_
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
mov eax, dword [0x41aa04]
add esp, 0x10
cmp eax, 0x15f
je 0x402e3b
cmp eax, 0x190
je 0x402e3b
cmp eax, 0x578
je 0x402e3b
push str._Windows_inf
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.rcusbwdm.inf
call fcn.004020d0
mov eax, dword [0x41aa04]
add esp, 0xc
cmp eax, 0x3e8
jae 0x402edb
push str._System32_drivers
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.RCMHDog.sys
call fcn.00402230
push str..lptmh1
call fcn.004025b0
push str.Mhdrv.sys
call fcn.00402230
push str..lptdog1
call fcn.004025b0
push str.HostNt.sys
call fcn.00402230
push str..HostNt
call fcn.004025b0
mov eax, dword [0x41aa04]
add esp, 0x20
cmp eax, 0x1f4
je 0x402eb7
cmp eax, 0x1f5
je 0x402eb7
cmp eax, 0x1f6
jne 0x402f78
push str.rcusbwdm.sys
call fcn.00402230
mov eax, dword [0x41aa00]
add esp, 4
test eax, eax
je 0x402f6b
push str._______running
jmp 0x402f70
push str._System_
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.RCMHDog.vxd
call fcn.00402230
push str..RCMHDog.vxd
call fcn.004025b0
push str.Gsdog.vxd
call fcn.00402230
push str..Gsdog.vxd
call fcn.004025b0
push str.Host95.vxd
call fcn.00402230
push str..Host95.vxd
call fcn.004025b0
push str._System32_drivers
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
mov eax, dword [0x41aa04]
add esp, 0x28
cmp eax, 0x578
jbe 0x402f85
push str.rcusbwdm.sys
call fcn.00402230
mov eax, dword [0x41aa00]
add esp, 4
test eax, eax
je 0x402f6b
push str._______running
jmp 0x402f70
push str._______stopped
call fcn.004029f0
add esp, 4
push 0x41a4ec
call fcn.004029f0
add esp, 4
cmp dword [0x41aa04], 0x3e8
jae 0x40300b
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Register_Keys
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.RCMHDOG
call fcn.00401cc0
mov eax, dword [0x41aa04]
add esp, 0x20
cmp eax, 0x1f4
je 0x402ffe
cmp eax, 0x1f5
je 0x402ffe
cmp eax, 0x1f6
jne 0x40300b
push str.UsbC
call fcn.00401cc0
add esp, 4
push esi
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push str.Results
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
push 0x415a10
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
add esp, 0x1c
mov byte [0x419538], 0
call fcn.004090f7
mov esi, eax
test esi, esi
jne 0x403076
push str.Check_Dog_succeed.
call fcn.004029f0
add esp, 4
jmp 0x4030cc
push esi
lea edx, [esp + 0x84]
push str.Failed_with_return_code:__d
push edx
call edi
lea eax, [esp + 0x8c]
push eax
call fcn.004029f0
push 0x41a4ec
call fcn.004029f0
lea ecx, [esp + 0x94]
push ecx
push esi
call fcn.00402220
add esp, 0x1c
test eax, eax
je 0x4030cc
push str.Information:
call fcn.004029f0
lea edx, [esp + 0x84]
push edx
call fcn.004029f0
add esp, 8
mov eax, dword [0x419530]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
push 0
push 0
push str.Report.txt
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop esi
xor eax, eax
pop edi
add esp, 0xdc
ret 0x10