Function at 0x423598
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00403668
mov eax, dword [ebp - 8]
call fcn.00403668
mov eax, dword [ebp + 8]
call fcn.00403668
xor eax, eax
push ebp
push 0x423b5f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov byte [0x427670], 0
mov byte [ebp - 0xa], 0
xor eax, eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], 0
jne 0x423664
lea eax, [ebp - 0x2a0]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004036b8
mov eax, dword [ebp - 0x2a0]
mov edx, 0x423b78
call fcn.004035c4
je 0x423664
mov byte [ebp - 9], 1
mov eax, dword [0x427678]
mov edx, 0x423b88
call fcn.004035c4
jne 0x423668
mov byte [ebp - 0xa], 1
lea eax, [ebp - 0x25c]
push eax
push 0
push 0x423b8c
push 0x423b90
call sub.kernel32.dll_GetTempFileNameA
push 0
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll__lcreat
mov dword [ebp - 0x10], eax
jmp 0x423668
mov byte [ebp - 9], 0
xor ebx, ebx
lea eax, [ebp - 0x2a0]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004036b8
mov eax, dword [ebp - 0x2a0]
mov edx, 0x423b78
call fcn.004035c4
jne 0x4236d5
mov bl, 1
mov eax, dword [0x427674]
mov edx, 0x423b88
call fcn.004035c4
jne 0x4236d5
mov byte [ebp - 0xa], 1
lea eax, [ebp - 0x25c]
push eax
push 0
push 0x423b94
push 0x423b90
call sub.kernel32.dll_GetTempFileNameA
push 0
lea eax, [ebp - 0x25c]
push eax
call sub.kernel32.dll__lcreat
mov dword [ebp - 0x10], eax
test bl, bl
jne 0x423723
cmp byte [ebp - 9], 0
jne 0x423723
mov byte [ebp - 0xa], 1
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 8]
call fcn.00405850
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.kernel32.dll__lcreat
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x423723
push 0x30
mov ecx, 0x423b98
mov edx, 0x423ba8
mov eax, dword [0x427620]
call fcn.0041eef0
jmp 0x423b31
push 0
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 5
lea ecx, [ebp - 0x2a8]
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.00424090
cmp eax, 5
je 0x423b31
xor edx, edx
mov eax, dword [edi + 0x1b0]
call fcn.004216cc
mov eax, dword [edi + 0x1b0]
mov dword [eax + 0x2c0], 0x1e
mov eax, edi
call fcn.00423cb8
cmp eax, 5
jne 0x423786
mov eax, dword [edi + 0x1b0]
call fcn.00422368
jmp 0x423b31
test bl, bl
je 0x4238b3
cmp byte [ebp - 0xa], 0
je 0x423833
push 0
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 5
lea ecx, [ebp - 0x2a8]
mov edx, 0x423bc4
mov eax, edi
call fcn.00424090
lea eax, [ebp - 0x21c]
mov edx, dword [0x427668]
call fcn.00405850
lea eax, [ebp - 0x21c]
call fcn.00405760
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll__lwrite
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2a0]
call fcn.004033d4
lea eax, [ebp - 0x2a0]
mov edx, 0x423bd0
call fcn.004034bc
mov edx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x21c]
call fcn.00405850
lea eax, [ebp - 0x21c]
call fcn.00405760
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll__lwrite
mov eax, dword [edi + 0x1ac]
xor edx, edx
mov dword [eax + 0x2c0], edx
push 0
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 5
lea ecx, [ebp - 0x2a8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00424090
mov edx, dword [edi + 0x1ac]
mov dword [edx + 0x2c0], 0x1e
cmp eax, 4
je 0x423880
cmp eax, 5
jne 0x423927
push 0
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 5
lea ecx, [ebp - 0x2a8]
mov edx, 0x423bdc
mov eax, edi
call fcn.00424214
mov eax, dword [edi + 0x1b0]
call fcn.00422368
jmp 0x423b31
push 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 0xb
lea ecx, [ebp - 0x2a8]
mov edx, 0x423c00
mov eax, edi
call fcn.00424090
cmp eax, 4
je 0x4238e1
cmp eax, 5
jne 0x42391d
push 0
xor eax, eax
mov dword [ebp - 0x2a8], eax
mov byte [ebp - 0x2a4], 5
lea ecx, [ebp - 0x2a8]
mov edx, 0x423c10
mov eax, edi
call fcn.00424214
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll__lclose
mov eax, dword [edi + 0x1b0]
call fcn.00422368
jmp 0x423b31
mov eax, edi
call fcn.0042465c
mov dword [ebp - 0x1c], eax
mov eax, edi
call fcn.00424618
mov eax, dword [edi + 0x1b0]
call fcn.004223f4
mov eax, edi
call fcn.0042463c
mov eax, edi
call fcn.00423f14
test al, al
jne 0x423954
cmp dword [0x42766c], 0
je 0x42396f
push 0x30
mov ecx, 0x423c28
mov edx, 0x423c30
mov eax, dword [0x427620]
call fcn.0041eef0
jmp 0x423b31
mov eax, edi
call fcn.00424618
mov dword [ebp - 0x14], 0xff
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x21c]
mov esi, dword [edi + 0x1b0]
mov edx, dword [esi + 0x2b4]
mov eax, esi
call fcn.0042199c
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x21c], 0
cmp dword [ebp - 0x14], 0
jle 0x423a76
test bl, bl
je 0x4239df
cmp byte [ebp - 0xa], 0
jne 0x4239df
lea edx, [ebp - 0x2a0]
lea eax, [ebp - 0x21c]
call fcn.004058f4
mov edx, dword [ebp - 0x2a0]
mov eax, edi
call fcn.004242a0
jmp 0x423a76
cmp byte [ebp - 9], 0
je 0x423a0b
cmp byte [ebp - 0xa], 0
jne 0x423a0b
lea edx, [ebp - 0x2a0]
lea eax, [ebp - 0x21c]
call fcn.004058f4
mov edx, dword [ebp - 0x2a0]
mov eax, edi
call fcn.004242a0
jmp 0x423a76
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll__lwrite
inc eax
jne 0x423a5f
push 1
mov eax, 0x423bd0
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 0x2b4], 0xb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2b0], eax
mov byte [ebp - 0x2ac], 0xb
lea ecx, [ebp - 0x2b8]
mov edx, 0x423c6c
mov eax, edi
call fcn.00424214
mov byte [0x427670], 1
test bl, bl
jne 0x423a76
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00424744
mov eax, edi
call fcn.00423f14
test al, al
je 0x423a98
mov edx, 0x423ca4
mov eax, dword [edi + 0x1ac]
call fcn.004217b8
mov eax, edi
call fcn.00424410
cmp dword [ebp - 0x14], 0
jg 0x423976
mov eax, edi
call fcn.0042463c
cmp byte [ebp - 0xa], 0
je 0x423ab8
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll__lclose
or bl, byte [ebp - 9]
je 0x423b14
cmp byte [ebp - 0xa], 0
je 0x423b14
mov edx, dword [0x42767c]
lea eax, [ebp - 0x2a0]
call fcn.004033d4
lea eax, [ebp - 0x2a0]
mov edx, 0x423cb4
call fcn.004034bc
mov edx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x29c]
call fcn.00405850
lea edx, [ebp - 0x25c]
lea eax, [ebp - 0x29c]
call fcn.00405870
push 5
lea eax, [ebp - 0x29c]
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [edi + 0x1b0]
call fcn.00422368
mov eax, dword [edi + 0x1b0]
call fcn.0042248c
mov eax, edi
call fcn.00424410
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423b66
lea eax, [ebp - 0x2a0]
call fcn.00403340
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403360
lea eax, [ebp + 8]
call fcn.00403340
ret