Function at 0x406790
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43f136
mov eax, dword fs:[0]
push eax
mov eax, 0x1868
call fcn.00429090
mov eax, dword [0x451c14]
xor eax, esp
mov dword [esp + 0x1860], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451c14]
xor eax, esp
push eax
lea eax, [esp + 0x187c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x188c]
push 0x800
xor ebx, ebx
lea eax, [esp + 0x878]
push ebx
push eax
mov esi, ecx
call fcn.00428ee0
add esp, 0xc
push 0x800
lea ecx, [esp + 0x74]
push ebx
push ecx
mov dword [esp + 0x70], ebx
mov byte [esp + 0x74], bl
mov dword [esp + 0x78], ebx
call fcn.00428ee0
add esp, 0xc
mov dword [esp + 0x1884], ebx
call fcn.0041a69d
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x406830
push 0x80004005
call fcn.00401e70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
mov byte [esp + 0x1884], 1
cmp byte [esi + 0x2000], bl
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
je 0x406a22
cmp ebp, ebx
je 0x406a17
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x406870
sub eax, edx
sar eax, 1
je 0x406a17
push 0x800
lea ecx, [esp + 0x1078]
push ebx
push ecx
call fcn.00428ee0
lea edx, [esi + 0x800]
mov eax, edx
add esp, 0xc
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4068a6
sub eax, edi
sar eax, 1
je 0x4068d5
push edx
push ebp
push 0x445094
lea edx, [esp + 0x1080]
push 0x400
push edx
call fcn.004276e2
add esp, 0x14
jmp 0x4068f0
push 0x3ff
push ebp
lea eax, [esp + 0x107c]
push 0x400
push eax
call fcn.00426b21
add esp, 0x10
lea edi, [esp + 0x1074]
call fcn.0040f790
test al, al
je 0x4069dc
push 0x800
lea ecx, [esp + 0x878]
push ebx
push ecx
call fcn.00428ee0
add esp, 0xc
push str.start_here.htm
mov edx, edi
push edx
push 0x445094
lea eax, [esp + 0x880]
push 0x400
push eax
call fcn.004276e2
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea ecx, [esp + 0x874]
push ecx
call esi
test eax, eax
jne 0x406a51
push 0x800
lea edx, [esp + 0x878]
push ebx
push edx
call fcn.00428ee0
add esp, 0xc
push str.troubleshooting.htm
mov eax, edi
push eax
push 0x445094
lea ecx, [esp + 0x880]
push 0x400
push ecx
call fcn.004276e2
add esp, 0x14
lea edx, [esp + 0x874]
push edx
call esi
test eax, eax
jne 0x406a51
mov eax, edi
push eax
push str.Target_manual_file_was_not_found_under___s_
mov ecx, 0x463520
call fcn.0040bf70
add esp, 8
lea ecx, [esp + 0x18]
mov byte [esp + 0x1884], bl
call fcn.004023d0
lea eax, [esp + 0x64]
mov dword [esp + 0x1884], 0xffffffff
call fcn.0040c5f0
jmp 0x406b97
lea ecx, [esp + 0x1074]
push ecx
push esi
push str.Compress_the_file__s__to___s__fail__
mov ecx, 0x463520
call fcn.0040bf70
mov byte [esp + 0x1890], bl
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0xc
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x406b6b
push esi
push str.Temp_directory_is_invalid....._Open_Fail______s_
jmp 0x406b47
push str.manual_file_will_be_opend_by_saved_in_Local
mov ecx, 0x463520
call fcn.0040bf70
add esp, 4
push 0x3ff
push esi
lea ecx, [esp + 0x87c]
push 0x400
push ecx
call fcn.00426b21
add esp, 0x10
jmp 0x406a55
mov edi, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
call fcn.0040ee10
mov eax, dword [esp + 0x20]
add esp, 4
cmp eax, 6
ja 0x406a78
jne 0x406ab1
cmp dword [esp + 0x20], 2
jb 0x406ab1
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ebx
lea eax, [esp + 0x87c]
push eax
push str.explorer.exe
push str.open
push ebx
call esi
cmp eax, 0x20
ja 0x406ace
push 1
push ebx
push ebx
lea ecx, [esp + 0x880]
push ecx
push str.open
push ebx
call esi
jmp 0x406ac9
push 1
push ebx
push ebx
lea edx, [esp + 0x880]
push edx
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x406add
lea eax, [esp + 0x874]
push eax
push str.open___s__success__
jmp 0x406b47
push 0x38
lea ecx, [esp + 0x30]
push ebx
push ecx
mov dword [esp + 0x34], 0x3c
call fcn.00428ee0
add esp, 0xc
lea eax, [esp + 0x28]
lea edx, [esp + 0x874]
push eax
mov dword [esp + 0x30], 0x40
mov dword [esp + 0x48], 1
mov dword [esp + 0x38], str.openas
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, ebx
je 0x406b3a
lea ecx, [esp + 0x874]
push ecx
push str.open___s__success__
jmp 0x406b47
lea edx, [esp + 0x874]
push edx
push str.open___s__Fail___
mov ecx, 0x463520
call fcn.0040bf70
lea eax, [edi - 0x10]
add esp, 8
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x1884], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b77
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1884], 0xffffffff
cmp byte [esp + 0x68], bl
je 0x406b97
mov eax, dword [esp + 0x64]
cmp eax, ebx
je 0x406b97
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x187c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1860]
xor ecx, esp
call fcn.0042683e
add esp, 0x1874
ret 4