Function at 0x448c00
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4ba5d4
call fcn.0045901c
test bl, bl
je 0x448c34
test al, 1
jne 0x448c34
xor eax, eax
jmp 0x448f9b
call fcn.0044a498
mov edi, eax
mov byte [0x4bd628], 0
xor eax, eax
call fcn.00452b10
lea edx, [ebp - 0xa0]
mov eax, 0x4ba5d4
call fcn.0045d2a4
mov ecx, 0x4b2b34
mov edx, 0x4b2734
mov eax, 0x4ba5d4
call fcn.0045d270
mov edx, dword [ebp - 0x90]
mov dword [0x4b12ec], edx
mov byte [0x4b0a12], bl
mov dword [0x4b0ed4], 1
xor ecx, ecx
mov dword [0x4b09b8], ecx
xor eax, eax
mov dword [0x4b09e4], eax
call fcn.0043e446
lea edx, [ebp - 0x4a0]
mov eax, 0x4ba5d4
xor ecx, ecx
call fcn.0045d270
lea edx, [ebp - 0x8a0]
mov eax, 0x4ba5d4
xor ecx, ecx
call fcn.0045d244
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4bd628
mov dl, byte [ebp + 8]
push edx
mov edx, 0x49ca45
call fcn.004498e0
cmp byte [ebp - 1], 0
je 0x448d04
mov eax, 1
call fcn.0043e337
test al, al
jne 0x448d04
xor eax, eax
jmp 0x448f9b
cmp byte [ebp - 0x8a0], 0
jne 0x448d37
mov eax, 0x4b98a4
call fcn.00463884
mov esi, eax
mov eax, 0x4b98a4
call fcn.004638b8
cmp esi, eax
jne 0x448d37
cmp dword [ebp - 0x2c], 0
je 0x448d33
cmp byte [ebp - 0xb], 0
je 0x448d37
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x448d4e
mov edx, 0x49cbc1
mov eax, dword [0x4b3334]
call fcn.0040efd4
jmp 0x448dc5
mov eax, 0x4b98a4
xor ecx, ecx
mov edx, dword [0x4b3334]
call fcn.004639cc
test al, al
jne 0x448d6b
xor eax, eax
jmp 0x448f9b
mov edx, dword [0x4b3334]
cmp dword [edx + 0x30], 0
jne 0x448dc5
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.0048d8e8
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x448da1
lea eax, [ebp - 0xca0]
call fcn.0040ba60
push 0x49cbc1
lea edx, [ebp - 0xca0]
push edx
call fcn.0048d80c
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4b3334]
call fcn.0040efd4
cmp dword [ebp - 0x2c], 0
je 0x448e47
cmp byte [ebp - 0xb], 0
jne 0x448e47
mov eax, 0x4b98a4
call fcn.00463884
mov esi, eax
test esi, esi
je 0x448df8
cmp byte [ebp - 0x8a0], 0
jne 0x448e47
mov eax, 0x4b98a4
call fcn.004638b8
cmp esi, eax
jne 0x448e47
test esi, esi
jne 0x448e03
mov edx, 1
jmp 0x448e25
push 0x4b2734
push 0x43f355
push dword [0x4b9890]
push str.ASKPROCESSVOLDLG
push dword [0x4a7028]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x448e31
sub edx, 2
je 0x448e38
jmp 0x448e47
xor eax, eax
jmp 0x448f9b
mov edx, 0x49cbc1
mov eax, dword [0x4b3334]
call fcn.0040efd4
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x448eb0
cmp byte [0x4bd628], 0
je 0x448eb0
cmp dword [0x4b091c], 5
je 0x448eb0
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4bd628
xor ecx, ecx
xor edx, edx
call fcn.00409c94
push 0x4bd628
call fcn.0048f2ec
pop ecx
inc eax
jne 0x448eb0
push 0x4bd628
mov eax, 0x1f7
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
xor eax, eax
jmp 0x448f9b
mov eax, 0x4ba5d4
xor ecx, ecx
xor edx, edx
call fcn.004587a4
cmp byte [ebp - 0x10a0], 0
je 0x448ed4
lea eax, [ebp - 0x10a0]
push eax
call fcn.0048f2ec
pop ecx
call fcn.0044a498
cmp edi, eax
jne 0x448ee6
cmp dword [0x4bc228], 0
je 0x448eea
xor edx, edx
jmp 0x448eef
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x448f57
test bl, bl
je 0x448f21
push 0x40
mov eax, 0x3a7
call fcn.004116e8
push eax
mov eax, 0x3a8
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
jmp 0x448f57
cmp dword [0x4b1afc], 0
je 0x448f57
mov edx, 0x4b2b34
mov eax, 0x4b2734
call fcn.0040a0c8
test al, al
jne 0x448f57
mov eax, 0x4b98a4
call fcn.00463b8c
test al, al
je 0x448f57
mov eax, 0x4b98a4
xor edx, edx
call fcn.0045e350
mov byte [0x4b9e28], 0
mov eax, 0x4b9dfc
call fcn.00445520
test bl, bl
jne 0x448f98
cmp dword [0x4bc228], 0
jne 0x448f98
cmp byte [0x4bda2d], 0
je 0x448f98
push 1
push 0x49ca45
push 0
push 0x4bd628
push 0x49d4ae
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4