Function at 0x408e40
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x541a90
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
mov eax, dword [0x594ca8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edi]
mov ecx, 0x5704e4
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408e96
test dx, dx
je 0x408e92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408e96
add eax, 4
add ecx, 4
test dx, dx
jne 0x408e70
xor eax, eax
jmp 0x408e9b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x409643
call fcn.00417515
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x408ec2
push 0x80004005
call fcn.00404860
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0x17
lea esi, [ebp - 0x10]
mov dword [ebp - 4], 0
call fcn.0040a550
mov eax, dword [ebp - 0x10]
add esp, 4
mov ecx, 0x5704e4
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408f16
test dx, dx
je 0x408f12
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408f16
add eax, 4
add ecx, 4
test dx, dx
jne 0x408ef0
xor eax, eax
jmp 0x408f1b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x409199
push 0x570e88
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00404260
push 0x570c84
push eax
lea eax, [ebp - 0x14]
mov bl, 1
push eax
mov byte [ebp - 4], bl
call fcn.00404260
add esp, 0x18
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00404790
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408f80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408fa3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0x10]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 3
call fcn.00404260
push 0x570c84
push eax
lea ecx, [ebp - 0x14]
push ecx
mov byte [ebp - 4], 4
call fcn.00404260
add esp, 0x14
mov edx, esp
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], esp
push 0x570e98
push eax
push edx
call fcn.00404260
push 0x57058c
lea eax, [ebp - 0x18]
push edi
push eax
mov byte [ebp - 4], 6
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 7
mov dword [ebp - 0x28], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0xa
call fcn.0040a2e0
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40905f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409082
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4090a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0xb
call fcn.00404260
push 0x570ea4
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0xc
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x24], esp
push 0x570e98
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0xe
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x20], esp
push 0x570eb8
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x12
call fcn.0040a2e0
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409153
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409176
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409199
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 8], 0
je 0x40929f
push 0x19
lea esi, [ebp - 0x10]
call fcn.0040a550
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
mov ecx, esi
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0x13
call fcn.00404260
push 0x570c84
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x14
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x24], esp
push 0x570e98
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x16
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x1a
call fcn.0040a2e0
mov byte [ebp - 4], 0x19
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409259
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40927c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40929f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
mov byte [ebp - 4], 0x1b
call fcn.00404260
push 0x570c84
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x1c
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x24], esp
push 0x570e98
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x1e
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x1f
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x22
call fcn.0040a2e0
mov byte [ebp - 4], 0x21
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40934a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40936d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409390
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp dword [ebp + 0xc], 0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteW]
je 0x40955d
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
call fcn.00404260
push 0x570c84
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x23
call fcn.00404260
push 0x570e98
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x24
call fcn.00404260
mov eax, dword [eax]
add esp, 0x24
push 5
push 0
push 0
push eax
push str.TaskbarPin
push 0
call ebx
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409409
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x23
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40942c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40944f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1a
lea esi, [ebp - 0x10]
call fcn.0040a550
add esp, 4
push 0x29
push str.MicrosoftInternet_ExplorerQuick_Launch
mov ecx, esi
call fcn.00404340
push ecx
mov ecx, esp
mov dword [ebp - 0x28], esp
push 0x5704e4
call fcn.004040f0
push 0x57058c
mov ecx, esi
push ecx
lea edx, [ebp - 0x14]
push edx
mov byte [ebp - 4], 0x25
call fcn.00404260
push 0x570c84
push eax
lea eax, [ebp - 0x18]
push eax
mov byte [ebp - 4], 0x26
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x24], esp
push 0x570e98
push eax
push ecx
call fcn.00404260
push 0x57058c
lea edx, [ebp - 0x1c]
push edi
push edx
mov byte [ebp - 4], 0x28
call fcn.00404260
add esp, 0x14
mov ecx, esp
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x20], esp
push str.1905Client.exe
push eax
push ecx
call fcn.00404260
add esp, 0xc
mov byte [ebp - 4], 0x2c
call fcn.0040a2e0
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409517
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2a
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40953a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40955d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x57058c
lea ecx, [ebp - 0x14]
push edi
push ecx
call fcn.00404260
push 0x570c84
push eax
lea edx, [ebp - 0x18]
push edx
mov byte [ebp - 4], 0x2d
call fcn.00404260
push 0x570e98
push eax
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0x2e
call fcn.00404260
mov eax, dword [eax]
add esp, 0x24
push 5
push 0
push 0
push eax
push str.startpin
push 0
call ebx
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4095c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4095e9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40960c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409643
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret