Function at 0x40c16f
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov eax, 0x4205c7
call fcn.00412bcc
sub esp, 0x5a4
lea eax, [esp + 0x58]
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x10
push edi
push eax
mov ebp, edi
call fcn.004122b0
add esp, 0xc
call fcn.0040ca1a
cmp eax, 3
jae 0x40c1b4
lea eax, [esp + 0x1a0]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x44
pop esi
push esi
lea eax, [esp + 0x160]
push edi
push eax
call fcn.004122b0
mov dword [esp + 0x168], esi
mov esi, dword [esp + 0x5d4]
add esp, 0xc
mov eax, dword [esi]
push 0x20
mov eax, dword [eax]
and eax, 0xf000
pop ebx
cmp eax, 0x2000
je 0x40c1f6
cmp eax, 0x8000
jne 0x40c212
add ebx, 0x60
jmp 0x40c212
push 0x40
pop ebx
call fcn.0040ca1a
cmp eax, 3
jae 0x40c212
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0040c661
lea edi, [esi + 0x1c]
push edi
mov dword [esi + 0x10], eax
lea eax, [esp + 0x118]
push 0x42e7dc
push eax
mov dword [esi + 0x14], edx
call fcn.00409d8d
and dword [esp + 0x5c8], 0
push 0x42e7d8
push eax
lea eax, [esp + 0xe0]
push eax
call fcn.00409d46
mov ecx, eax
mov byte [esp + 0x5d4], 1
lea eax, [esi + 0x34]
push eax
push ecx
lea eax, [esp + 0xd4]
push eax
call fcn.00409d05
add esp, 0x24
mov byte [esp + 0x5bc], 3
lea ecx, [esp + 0xcc]
call fcn.004015ab
mov byte [esp + 0x5bc], 4
lea ecx, [esp + 0x114]
call fcn.004015ab
lea eax, [esp + 0x20]
push edi
push eax
call fcn.0040a110
mov byte [esp + 0x5c4], 5
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.0040a110
add esp, 0x10
mov byte [esp + 0x5bc], 6
cmp dword [edi + 0x14], 0x10
jb 0x40c2cf
mov eax, dword [edi]
jmp 0x40c2d1
mov eax, edi
push 0
push eax
call fcn.0040fefc
pop ecx
pop ecx
test al, al
jne 0x40c454
push dword [0x42d1e0]
cmp dword [0x42d1e4], 0x10
mov eax, 0x42d1d0
cmovae eax, dword [0x42d1d0]
push 0
push eax
mov ecx, edi
call fcn.0040c5f9
cmp eax, 0xffffffff
jne 0x40c454
lea eax, [esp + 0xfc]
push str.PATH
push eax
call fcn.004104e9
mov byte [esp + 0x5c4], 7
push 1
push 0x3b
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041141b
add esp, 0x18
mov byte [esp + 0x5bc], 9
lea ecx, [esp + 0xfc]
call fcn.004015ab
lea eax, [esp + 0x50]
push str.SYSTEMROOT
push eax
call fcn.004104e9
mov byte [esp + 0x5c4], 0xa
cmp dword [esp + 0x6c], 0x10
lea eax, [esp + 0x58]
cmovae eax, dword [esp + 0x58]
push eax
lea eax, [esp + 0x150]
push str._sSYSTEM32
push eax
call fcn.0040743b
add esp, 0x14
mov byte [esp + 0x5bc], 0xb
push eax
lea ecx, [esp + 0x18]
call fcn.0040c928
mov byte [esp + 0x5bc], 0xa
lea ecx, [esp + 0x144]
call fcn.004015ab
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
call fcn.0040c995
cmp dword [edi + 0x14], 0x10
jb 0x40c3c6
mov edi, dword [edi]
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0xec]
push edi
push eax
call fcn.00410c95
mov byte [esp + 0x5cc], 0xc
push eax
lea eax, [esp + 0x140]
push eax
call fcn.0040a110
add esp, 0x18
mov byte [esp + 0x5bc], 0xd
push eax
lea ecx, [esp + 0x24]
call fcn.0040a3fa
mov byte [esp + 0x5bc], 0xc
push 0
push 1
lea ecx, [esp + 0x134]
call fcn.00401afa
mov byte [esp + 0x5bc], 0xa
lea ecx, [esp + 0xe4]
call fcn.004015ab
mov byte [esp + 0x5bc], 9
lea ecx, [esp + 0x50]
call fcn.004015ab
mov byte [esp + 0x5bc], 6
lea ecx, [esp + 0x14]
call fcn.0040afe3
mov eax, dword [esi]
test dword [eax], 0x600
je 0x40c520
call fcn.00410acd
test al, al
jne 0x40c520
push 0x3c
pop edi
push edi
lea eax, [esp + 0x7c]
push 0
push eax
call fcn.004122b0
add esp, 0xc
cmp dword [esp + 0x34], 8
lea eax, [esp + 0x20]
cmovae eax, dword [esp + 0x20]
cmp dword [esp + 0x4c], 8
mov dword [esp + 0x88], eax
lea eax, [esp + 0x38]
cmovae eax, dword [esp + 0x38]
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], 0x4140
mov dword [esp + 0x88], str.runas
mov dword [esp + 0x98], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40c512
cmp dword [esp + 0x98], 0x20
jbe 0x40c512
mov eax, dword [esi]
xor edi, edi
test byte [eax], 0x44
je 0x40c509
push edi
push dword [esp + 0xb4]
push esi
call fcn.0040b684
add esp, 0xc
jmp 0x40c5a7
mov eax, dword [esp + 0xb0]
jmp 0x40c591
mov eax, dword [esi]
test dword [eax], 0x400
jne 0x40c5a5
cmp dword [esp + 0x4c], 8
lea ecx, [esp + 0x38]
cmovae ecx, dword [esp + 0x38]
cmp dword [esp + 0x34], 8
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x24]
cmovae eax, dword [esp + 0x24]
xor edi, edi
lea edx, [esp + 0x160]
push edx
push edi
push edi
push ebx
push edi
push edi
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c596
call fcn.0040ca1a
cmp eax, 3
jae 0x40c57c
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
je 0x40c57c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
test byte [eax], 0x44
je 0x40c58d
push edi
push dword [esp + 0x6c]
jmp 0x40c4fb
mov eax, dword [esp + 0x68]
mov dword [esi + 8], eax
jmp 0x40c5a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push edi
jmp 0x40c4fb
xor edi, edi
mov byte [esp + 0x5bc], 5
push edi
push 1
lea ecx, [esp + 0x40]
call fcn.00401afa
mov byte [esp + 0x5bc], 4
push edi
push 1
lea ecx, [esp + 0x28]
call fcn.00401afa
or dword [esp + 0x5bc], 0xffffffff
lea ecx, [esp + 0xb4]
call fcn.004015ab
mov ecx, dword [esp + 0x5b4]
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret