Function at 0x410910
Capabilities:
Create process on windows
Delete file
Get common file path
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x438470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a8
mov eax, dword [0x449320]
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 0x43c4e0
lea ecx, [esi + 0xf4]
mov dword [esp + 0x4b8], eax
mov dword [esi + 0x170], 2
call fcn.0042dbcd
lea ecx, [esp + 0x68]
call fcn.00410770
mov dword [esp + 0x4c0], 0
call fcn.00429b49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], eax
mov byte [esp + 0x4c0], 1
call fcn.00429b49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x4c0], 2
call fcn.00429b49
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x5c]
push eax
mov ecx, esi
mov byte [esp + 0x4c4], 3
call fcn.0040d8b0
push str.update_
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x4cc], 4
call fcn.00401c00
add esp, 0xc
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 6
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410a09
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.ecpver.xml
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00401c00
add esp, 0xc
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.004132ad
push 3
push 0x43c4c8
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c8], 8
call fcn.00405510
mov edx, dword [esp + 0x18]
push edx
lea eax, [esp + 0x2b0]
push 0x439e50
push eax
call fcn.0041c5fc
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0040d8b0
push 0
lea edx, [esp + 0x2b0]
push edx
lea ecx, [esp + 0x40]
mov byte [esp + 0x4c8], 9
call fcn.00413340
test eax, eax
mov ebp, dword [esp + 0x24]
je 0x410d05
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea esp, [esp]
lea ecx, [esp + 0x38]
call fcn.00413146
lea ecx, [esp + 0x38]
mov dword [esp + 0x34], eax
call fcn.00413274
test eax, eax
jne 0x410cf9
mov eax, dword [esp + 0x38]
push 0x10
lea ecx, [esp + 0x3c]
call dword [eax + 0x38]
test eax, eax
je 0x410cf9
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x3c]
call fcn.00413438
mov eax, dword [eax]
push 0x43c240
push eax
call fcn.0041cd02
mov ebx, eax
mov eax, dword [esp + 0x18]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x410b17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
lea ecx, [esp + 0x38]
je 0x410b45
lea eax, [esp + 0x60]
push eax
call fcn.004134c9
mov eax, dword [eax]
push ebp
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xa
call fcn.0040fbd0
mov eax, dword [esp + 0x60]
jmp 0x410cd7
lea eax, [esp + 0x58]
push eax
call fcn.00413438
mov eax, dword [eax]
push str.system32
push eax
call fcn.0041cd02
mov ebx, eax
mov eax, dword [esp + 0x60]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410b85
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x410bca
push 1
push 0x25
lea eax, [esp + 0xac]
push eax
push 0
call edi
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004134c9
mov eax, dword [eax]
lea edx, [esp + 0xa4]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xb
call fcn.0040fbd0
mov eax, dword [esp + 0x50]
jmp 0x410cd7
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
call fcn.00413438
mov eax, dword [eax]
push str.My_Documents
push eax
call fcn.0041cd02
mov ebx, eax
mov eax, dword [esp + 0x5c]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410c0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x410c53
push 1
push 5
lea eax, [esp + 0x1b0]
push eax
push 0
call edi
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004134c9
mov eax, dword [eax]
lea edx, [esp + 0x1a8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xc
call fcn.0040fbd0
mov eax, dword [esp + 0x64]
jmp 0x410cd7
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
call fcn.00413438
mov eax, dword [eax]
push str.WINDOWS
push eax
call fcn.0041cd02
mov ebx, eax
mov eax, dword [esp + 0x30]
add esp, 8
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410c97
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, bl
je 0x410cf9
push 1
push 0x24
lea eax, [esp + 0x3b8]
push eax
push 0
call edi
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004134c9
mov eax, dword [eax]
lea edx, [esp + 0x3b0]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x4c8], 0xd
call fcn.0040fbd0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410cf9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x410aa0
mov edi, dword [esp + 0x20]
push edi
lea ecx, [esp + 0x6c]
call fcn.00406370
test al, al
jne 0x410d6c
push 0
push 0x439690
push 0x43c4b8
mov ecx, esi
call fcn.0042b3ae
mov ecx, esi
call fcn.0040f9a0
lea eax, [ebp - 0x10]
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410d53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.004132d1
lea eax, [edi - 0x10]
jmp 0x410f81
push 0x43c240
lea ecx, [esp + 0x6c]
call fcn.00405230
test al, al
je 0x411144
lea ecx, [esp + 0x68]
call fcn.00404a30
push str.ModuleList
lea ecx, [esp + 0x6c]
call fcn.00405230
test al, al
je 0x41113b
lea ecx, [esp + 0x68]
call fcn.00404a30
push str.Module
lea ecx, [esp + 0x6c]
call fcn.00405230
test al, al
je 0x411132
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
lea esp, [esp]
push str.ModuleName
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x70]
call fcn.0040cf40
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x4c4], 0xe
call fcn.00401b90
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410e1b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.RelativeDirectory
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x70]
call fcn.0040cf40
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x4c4], 0xf
call fcn.00401b90
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410e66
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.Type
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x70]
call fcn.0040cf40
mov eax, dword [eax]
push eax
call fcn.0041c6dc
mov edi, eax
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410ea4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call fcn.0040d210
push 1
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.0040e280
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.004070c0
add esp, 0xc
lea eax, [edi - 1]
cmp eax, 3
mov byte [esp + 0x4c0], 0x10
ja case.default.0x410ee9
jmp dword [eax*4 + 0x411270]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0040d420
test eax, eax
jne case.default.0x410ee9
push eax
push 0x439690
push 0x43c46c
mov ecx, esi
call fcn.0042b3ae
mov ecx, esi
call fcn.0040f9a0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410f43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410f69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.004132d1
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410fa0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410fc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410fec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411012
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411038
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x68]
mov dword [esp + 0x4c0], 0xffffffff
call fcn.00410820
xor eax, eax
jmp 0x41124a
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push ecx
push str.open
push eax
call ebx
jmp case.default.0x410ee9
lea edx, [esp + 0x10]
push edx
call fcn.00406d50
add esp, 4
test eax, eax
je case.default.0x410ee9
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x1c]
push 1
push 0
push 0
push ecx
push str.open
push eax
call ebx
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0040dfc0
cmp eax, 0xffffffff
je 0x4110cb
push eax
push 0
push 0x1f0fff
call ebp
mov edi, eax
push 0x3e8
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test edi, edi
je 0x4110cb
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x10]
push eax
jmp 0x4110e8
lea ecx, [esp + 0x10]
push ecx
call fcn.00406d50
add esp, 4
test eax, eax
je case.default.0x410ee9
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411114
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push str.Module
lea ecx, [esp + 0x6c]
call fcn.00405230
test al, al
jne 0x410dd0
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x68]
call fcn.00404f50
lea ecx, [esp + 0x68]
call fcn.00404f50
lea eax, [ebp - 0x10]
mov byte [esp + 0x4c0], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411166
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
mov byte [esp + 0x4c0], 7
call fcn.004132d1
lea eax, [edi - 0x10]
mov byte [esp + 0x4c0], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411199
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4111bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4111e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41120b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x4c0], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x411231
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x68]
mov dword [esp + 0x4c0], 0xffffffff
call fcn.00410820
mov eax, 1
mov ecx, dword [esp + 0x4b8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x4a8]
pop ebx
call fcn.0041c22b
add esp, 0x4b4
ret