Function at 0x411300
Capabilities:
Check if file exists
Check mutex on windows
Create process on windows
Create process suspended
Create thread
Get file attributes

Disassembly:
sub esp, 0xc4
lea eax, [esp + 0x2c]
push ebx
push ebp
push esi
mov esi, 1
push edi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x41166f
push 0
push 0
lea ecx, [esp + 0x44]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
je 0x41166f
lea edx, [esp + 0x3c]
mov dword [esp + 0x10], 0xc
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], esi
call fcn.004130a0
test eax, eax
mov eax, str.CB508F94_4FFA_4fa7_A4BC_CFC2A25A564A
je 0x411362
mov eax, str.GlobalCB508F94_4FFA_4fa7_A4BC_CFC2A25A564A
push eax
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [0x4237e8], eax
je 0x41166f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4113a2
mov ecx, dword [0x4237e8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret
push str.69B199FB_6D89_46f5_8780_C6DAA97B0A8D_STOPEVENT
push 0
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4237e4], eax
call fcn.00406700
test eax, eax
jne 0x4113d4
call fcn.00407370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret
mov eax, dword [0x4237ec]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x4114e3
cmp dword [0x4236ac], esi
jne 0x4114e3
push 0x104
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x411416
call fcn.00407370
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret
push ebp
call fcn.0040d630
mov edi, str.RavStub.exe
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4114e3
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x54]
rep stosd dword es:[edi], eax
mov edi, str.__RAVMOND
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x50], 0x44
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x54]
mov dword [esp + 0x5c], str.WinSta0WinLogon
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
mov word [esp + 0xa8], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4114df
mov edx, dword [esp + 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x1c]
push eax
call esi
push 0
call ebx
lea ecx, [esp + 0x38]
push ecx
push 0
push 0
push 0x4116f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
mov esi, eax
call ebx
test esi, esi
je 0x41150c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
push 4
call fcn.00411280
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0xa1]
mov byte [esp + 0xa0], 0
rep stosd dword es:[edi], eax
add esp, 0xc
lea edx, [esp + 0x94]
stosw word es:[edi], ax
push 0x40
push edx
push 1
push str.RavMonD.exe
mov ecx, 0x423798
stosb byte es:[edi], al
call fcn.00413460
push 0
push 0x411c20
push 0x64
mov ecx, 0x423798
call fcn.00413550
push 0
push 0x411d40
push 0xc8
mov ecx, 0x423798
call fcn.00413550
push 0
push 0x411c40
push 0xd3
mov ecx, 0x423798
call fcn.00413550
push 0
push 0x411d20
push 0xd4
mov ecx, 0x423798
call fcn.00413550
push 0
push 0x411c60
push 0xd2
mov ecx, 0x423798
call fcn.00413550
mov eax, dword [0x4237ec]
test eax, eax
je 0x411613
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
call esi
test eax, eax
je 0x411622
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
mov ebx, 0x7933
cmp dword [esp + 0x20], ebx
je 0x411622
lea ecx, [esp + 0x1c]
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
call ebp
push 0
push 0
lea eax, [esp + 0x24]
push 0
push eax
call esi
test eax, eax
jne 0x4115ec
jmp 0x411622
mov ecx, dword [0x4237e4]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x4237e4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x4237e8]
xor edi, edi
push eax
mov dword [0x4237e4], edi
call esi
mov dword [0x4237e8], edi
call fcn.00411700
call fcn.00407370
cmp dword [0x4237ec], edi
jne 0x411665
push edi
push edi
push 3
call fcn.00411280
add esp, 0xc
mov ecx, 0x423800
call fcn.00413b20
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc4
ret