Function at 0x406fe0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c9b90
mov eax, dword fs:[0]
push eax
mov eax, 0x2154
call fcn.004a9260
mov eax, dword [0x4ebfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x2c]
call fcn.0040bdf0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0xed4]
call fcn.0040bdf0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xed4]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00406af0
add esp, 0xc
push str._install
lea ecx, [ebp - 0xeb8]
call fcn.00402ba0
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 0xc]
call fcn.00407be0
movzx eax, al
test eax, eax
jne 0x407086
push 0x4dfe50
lea ecx, [ebp - 0xeb8]
call fcn.00407ae0
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0xeb8]
call fcn.00407ac0
xor edx, edx
mov word [ebp - 0x22c], dx
push 0x1fe
push 0
lea eax, [ebp - 0x22a]
push eax
call fcn.004a8470
add esp, 0xc
push 0xff
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x22c]
push edx
lea ecx, [ebp - 0xf10]
call fcn.00401840
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe9c]
call fcn.00408640
mov byte [ebp - 4], 4
push 0x4dfe54
lea ecx, [ebp - 0x1ff0]
call fcn.00401840
mov byte [ebp - 4], 5
lea eax, [ebp - 0x1ff0]
push eax
lea ecx, [ebp - 0xe9c]
push ecx
lea edx, [ebp - 0xf10]
push edx
call fcn.0040e310
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1ff0]
call fcn.004018c0
push 0x4dfe58
push 0
lea ecx, [ebp - 0xe9c]
call fcn.00408750
push eax
lea eax, [ebp - 0x200c]
push eax
call fcn.0040b530
add esp, 0xc
mov dword [ebp - 0x2120], eax
mov ecx, dword [ebp - 0x2120]
mov dword [ebp - 0x2124], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x2124]
push edx
lea ecx, [ebp - 0xf10]
call fcn.004018e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x200c]
call fcn.004018c0
push 0x4dfe84
lea ecx, [ebp - 0xf10]
call fcn.00401920
lea ecx, [ebp - 0x2c]
call fcn.00407be0
movzx eax, al
test eax, eax
jne 0x4071e3
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x2028]
push edx
call fcn.0040e210
add esp, 8
mov dword [ebp - 0x2128], eax
mov eax, dword [ebp - 0x2128]
mov dword [ebp - 0x212c], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x212c]
call fcn.00407bc0
push eax
lea ecx, [ebp - 0xf10]
call fcn.00401900
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2028]
call fcn.004018c0
lea ecx, [ebp - 0xf48]
call fcn.00401810
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef4]
call fcn.00401810
mov byte [ebp - 4], 9
mov dword [ebp - 0x2030], 1
push str.UninstallString
lea ecx, [ebp - 0x204c]
call fcn.00401840
mov byte [ebp - 4], 0xa
push 0x4dfeb0
lea ecx, [ebp - 0x2068]
call fcn.00401840
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xf48]
push ecx
lea edx, [ebp - 0x2030]
push edx
lea eax, [ebp - 0x204c]
push eax
lea ecx, [ebp - 0x2068]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00410a80
add esp, 0x14
mov byte [ebp - 0x2029], al
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2068]
call fcn.004018c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x204c]
call fcn.004018c0
movzx edx, byte [ebp - 0x2029]
test edx, edx
je 0x40742c
lea ecx, [ebp - 0x17d4]
call fcn.00408640
mov byte [ebp - 4], 0xc
push 0x4dfeac
lea ecx, [ebp - 0x2084]
call fcn.00401840
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x2084]
push eax
lea ecx, [ebp - 0x17d4]
push ecx
lea edx, [ebp - 0xf48]
push edx
call fcn.0040e310
add esp, 0xc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2084]
call fcn.004018c0
lea ecx, [ebp - 0x17d4]
call fcn.00408730
sub eax, 1
push eax
lea ecx, [ebp - 0x17d4]
call fcn.00408750
push eax
lea ecx, [ebp - 0x17bc]
call fcn.00401880
mov byte [ebp - 4], 0xe
xor eax, eax
mov word [ebp - 0x1fd4], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x1fd2]
push ecx
call fcn.004a8470
add esp, 0xc
lea ecx, [ebp - 0xf48]
call fcn.00402c10
mov dword [ebp - 0x2130], eax
mov edx, dword [ebp - 0x2130]
add edx, 2
mov dword [ebp - 0x2134], edx
mov eax, dword [ebp - 0x2130]
mov cx, word [eax]
mov word [ebp - 0x2136], cx
add dword [ebp - 0x2130], 2
cmp word [ebp - 0x2136], 0
jne 0x407347
mov edx, dword [ebp - 0x2130]
sub edx, dword [ebp - 0x2134]
sar edx, 1
mov dword [ebp - 0x213c], edx
lea ecx, [ebp - 0x17bc]
call fcn.00402c10
mov dword [ebp - 0x2140], eax
mov eax, dword [ebp - 0x2140]
add eax, 2
mov dword [ebp - 0x2144], eax
mov ecx, dword [ebp - 0x2140]
mov dx, word [ecx]
mov word [ebp - 0x2146], dx
add dword [ebp - 0x2140], 2
cmp word [ebp - 0x2146], 0
jne 0x40739c
mov eax, dword [ebp - 0x2140]
sub eax, dword [ebp - 0x2144]
sar eax, 1
mov dword [ebp - 0x214c], eax
mov ecx, dword [ebp - 0x213c]
sub ecx, dword [ebp - 0x214c]
sub ecx, 1
push ecx
lea ecx, [ebp - 0xf48]
call fcn.00402c10
push eax
lea edx, [ebp - 0x1fd4]
push edx
call fcn.004a5357
add esp, 0xc
lea eax, [ebp - 0x1fd4]
push eax
lea ecx, [ebp - 0xef4]
call fcn.00401900
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x17bc]
call fcn.004018c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17d4]
call fcn.004086b0
push 0x4dff20
lea ecx, [ebp - 0xef4]
push ecx
call fcn.0040b5e0
add esp, 8
movzx edx, al
test edx, edx
je 0x407459
lea eax, [ebp - 0xf10]
push eax
lea ecx, [ebp - 0xef4]
call fcn.004018e0
lea ecx, [ebp - 0xef4]
call fcn.00472d20
sub eax, 1
push eax
lea ecx, [ebp - 0xef4]
call fcn.00407b90
movzx ecx, word [eax]
cmp ecx, 0x5c
je 0x40748b
push 0x4dff24
lea ecx, [ebp - 0xef4]
call fcn.00401920
push 0x4dff28
lea edx, [ebp - 0xef4]
push edx
lea eax, [ebp - 0x17a0]
push eax
call fcn.0040b530
add esp, 0xc
mov byte [ebp - 4], 0xf
push str.ok.exeokjiasu.exeopenvpn.exelocal333.exelocal256.exelocal335.exe
lea ecx, [ebp - 0x20a0]
call fcn.00401840
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x20a0]
push ecx
call fcn.00406930
add esp, 4
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x20a0]
call fcn.004018c0
xor edx, edx
mov word [ebp - 0x1784], dx
push 0x7fe
push 0
lea eax, [ebp - 0x1782]
push eax
call fcn.004a8470
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xa84], cx
push 0x7fe
push 0
lea edx, [ebp - 0xa82]
push edx
call fcn.004a8470
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0xa84]
push eax
lea ecx, [ebp - 0x1784]
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x20a4], esp
lea edx, [ebp - 0xef4]
push edx
call fcn.00401880
mov dword [ebp - 0x2150], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00404e80
add esp, 0x2c
mov byte [ebp - 0x2151], al
mov cl, byte [ebp - 0x2151]
mov byte [ebp - 0xed5], cl
movzx edx, byte [ebp - 0xed5]
test edx, edx
jne 0x407601
mov byte [ebp - 0x20a5], 0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17a0]
call fcn.004018c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef4]
call fcn.004018c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf48]
call fcn.004018c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe9c]
call fcn.004086b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf10]
call fcn.004018c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xeb8]
call fcn.00402350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xed4]
call fcn.00402350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402350
mov al, byte [ebp - 0x20a5]
jmp 0x407a7f
lea eax, [ebp - 0xef4]
push eax
lea ecx, [ebp - 0xf80]
call fcn.00401880
mov byte [ebp - 4], 0x11
push str._setup.ini
lea ecx, [ebp - 0xf80]
call fcn.00401920
xor ecx, ecx
mov word [ebp - 0xe84], cx
push 0x3fe
push 0
lea edx, [ebp - 0xe82]
push edx
call fcn.004a8470
add esp, 0xc
push 0x1ff
lea eax, [ebp - 0xe84]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0xf80]
call fcn.00402c10
push eax
lea ecx, [ebp - 0xe84]
push ecx
push str.packpath
push 0x4dfff0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea ecx, [ebp - 0x284]
call fcn.00401810
mov byte [ebp - 4], 0x12
lea edx, [ebp - 0x284]
push edx
lea eax, [ebp - 0xef4]
push eax
call fcn.00405630
add esp, 8
mov byte [ebp - 0x249], al
movzx ecx, byte [ebp - 0x249]
test ecx, ecx
jne 0x4076c7
push 0x4dfff8
push 0
push 0x4f0a0c
call fcn.00412020
add esp, 0xc
lea edx, [ebp - 0x1784]
push edx
lea ecx, [ebp - 0xf64]
call fcn.00401840
mov byte [ebp - 4], 0x13
push 0x4e000c
lea ecx, [ebp - 0xf64]
call fcn.00401920
push 0x4e0010
lea ecx, [ebp - 0xf64]
call fcn.00401920
lea eax, [ebp - 0x1784]
push eax
lea ecx, [ebp - 0xf2c]
call fcn.00401840
mov byte [ebp - 4], 0x14
push str.unins000.exe
lea ecx, [ebp - 0xf2c]
call fcn.00401920
lea ecx, [ebp - 0xf2c]
push ecx
lea edx, [ebp - 0xf64]
push edx
call fcn.00405860
add esp, 8
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0xef4]
push ecx
call fcn.00405370
add esp, 8
lea edx, [ebp - 0x1784]
push edx
lea ecx, [ebp - 0x268]
call fcn.00401840
mov byte [ebp - 4], 0x15
push 0x4e003c
lea ecx, [ebp - 0x268]
call fcn.00401920
push 0x4e0040
lea ecx, [ebp - 0x268]
call fcn.00401920
lea eax, [ebp - 0x1784]
push eax
lea ecx, [ebp - 0x20c4]
call fcn.00401840
mov dword [ebp - 0x2158], eax
mov ecx, dword [ebp - 0x2158]
mov dword [ebp - 0x215c], ecx
mov byte [ebp - 4], 0x16
push str.local.cfg
mov edx, dword [ebp - 0x215c]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.0040b530
add esp, 0xc
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20c4]
call fcn.004018c0
lea ecx, [ebp - 0x268]
call fcn.00402c10
push eax
lea ecx, [ebp - 0x20e0]
call fcn.00401840
mov byte [ebp - 4], 0x19
push 0x4e0068
lea ecx, [ebp - 0x20fc]
call fcn.00401840
lea ecx, [ebp - 0x20e0]
push ecx
lea edx, [ebp - 0x20fc]
push edx
call fcn.00410ec0
add esp, 8
lea ecx, [ebp - 0x20fc]
call fcn.004018c0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20e0]
call fcn.004018c0
lea eax, [ebp - 0x17a0]
push eax
call fcn.00406de0
add esp, 4
lea ecx, [ebp - 0xeb8]
push ecx
lea edx, [ebp - 0x2118]
push edx
call fcn.0040e210
add esp, 8
mov dword [ebp - 0x2160], eax
push 1
push 0x4e0070
mov ecx, dword [ebp - 0x2160]
call fcn.00407bc0
push eax
lea ecx, [ebp - 0x17a0]
call fcn.00402c10
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp + 8], eax
lea ecx, [ebp - 0x2118]
call fcn.004018c0
cmp dword [ebp + 8], 0x20
jg 0x4079a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4e0080
push 0
push 0x4f0a0c
call fcn.00412020
add esp, 0x10
mov byte [ebp - 0x2119], 0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x248]
call fcn.004018c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x268]
call fcn.004018c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xf2c]
call fcn.004018c0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xf64]
call fcn.004018c0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x284]
call fcn.004018c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf80]
call fcn.004018c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17a0]
call fcn.004018c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef4]
call fcn.004018c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf48]
call fcn.004018c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe9c]
call fcn.004086b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf10]
call fcn.004018c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xeb8]
call fcn.00402350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xed4]
call fcn.00402350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402350
mov al, byte [ebp - 0x2119]
jmp 0x407a7f
mov byte [ebp - 0x211a], 1
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x248]
call fcn.004018c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x268]
call fcn.004018c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xf2c]
call fcn.004018c0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xf64]
call fcn.004018c0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x284]
call fcn.004018c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xf80]
call fcn.004018c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x17a0]
call fcn.004018c0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xef4]
call fcn.004018c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf48]
call fcn.004018c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe9c]
call fcn.004086b0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xf10]
call fcn.004018c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xeb8]
call fcn.00402350
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xed4]
call fcn.00402350
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00402350
mov al, byte [ebp - 0x211a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a4ea6
mov esp, ebp
pop ebp
ret