Function at 0x40bb2d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
push ebx
push esi
push edi
push 2
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll__lopen]
mov edi, eax
cmp edi, 0xffffffff
je 0x40bb88
mov esi, dword [sym.imp.KERNEL32.dll__lread]
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], ebx
je 0x40bb8f
push dword [ebp + 8]
call fcn.004132a2
pop ecx
mov dword [0x420cbc], eax
push dword [ebp + 8]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
je 0x40bb8f
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
xor eax, eax
jmp 0x40bebf
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], ebx
je 0x40bbb7
push dword [ebp + 8]
call fcn.004132a2
pop ecx
mov dword [0x420cb8], eax
push dword [ebp + 8]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
jne 0x40bb81
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
je 0x40bbef
push dword [ebp + 8]
push 2
call ebx
push eax
mov dword [0x420cd0], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 8]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
mov dword [0x420cb4], eax
jne 0x40bb81
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], 0
je 0x40bc1a
push dword [ebp + 8]
call fcn.004132a2
pop ecx
mov dword [ebp - 8], eax
push dword [ebp + 8]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
jne 0x40bb81
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], 0
je 0x40bc45
push dword [ebp + 8]
call fcn.004132a2
pop ecx
mov dword [ebp - 4], eax
push dword [ebp + 8]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
jne 0x40bb81
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], 0
je 0x40bc6a
push dword [ebp + 8]
lea eax, [ebp - 0x418]
push eax
push edi
call esi
cmp eax, dword [ebp + 8]
jne 0x40bb81
push 0xe04
push 0x4227e0
push edi
call esi
push 0x422d04
push 0x422260
call fcn.00413bb0
push 0x422e14
push 0x4225c0
call fcn.00413bb0
add esp, 0x10
lea eax, [ebp + 8]
push 4
push eax
push edi
call esi
cmp dword [ebp + 8], 0
je 0x40bcd8
push dword [ebp + 8]
push 2
call ebx
push eax
mov dword [0x420cdc], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp + 8]
mov ebx, eax
push ebx
push edi
call esi
cmp eax, dword [ebp + 8]
mov dword [0x420d10], eax
jne 0x40bb81
push ebx
call fcn.00406346
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x420cbc]
xor ebx, ebx
cmp eax, ebx
je 0x40bded
mov esi, eax
push 0x7c
push esi
call fcn.00414320
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40bded
sub eax, esi
mov dword [ebp + 8], eax
push eax
lea eax, [ebp - 0x670]
push esi
push eax
call fcn.00413eb0
mov eax, dword [ebp + 8]
push 0x3b
and byte [ebp + eax - 0x670], 0
lea eax, [ebp - 0x670]
push eax
call fcn.00414320
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x40bb88
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.00413bb0
and byte [esi], 0
lea eax, [ebp - 0x210]
push eax
push 0x14
call fcn.0040364f
add esp, 0x10
test eax, eax
jne 0x40bd8a
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x210]
push str.Fonts
push eax
call fcn.00403d6d
pop ecx
pop ecx
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.00413bb0
lea eax, [ebp - 0x314]
push 0x5c
push eax
call fcn.00413b80
add esp, 0x10
cmp eax, ebx
je 0x40bdb5
and byte [eax], 0
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x314]
push eax
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x40bde5
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.GDI32.dll_AddFontResourceA]
mov dword [0x420d08], 1
lea esi, [edi + 1]
jmp 0x40bcf0
mov eax, dword [0x420cb8]
cmp eax, ebx
je 0x40be1b
mov edi, eax
cmp edi, ebx
je 0x40be1b
push 0x7c
push edi
call fcn.00414320
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x40be1b
and byte [esi], 0
push edi
call fcn.00405917
pop ecx
lea edi, [esi + 1]
jmp 0x40bdf8
call fcn.0040820d
cmp dword [0x4235dc], ebx
je 0x40be46
cmp byte [0x4234cc], 0
je 0x40be46
push 1
push ebx
push ebx
push 0x4234cc
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [ebp - 8]
cmp esi, ebx
je 0x40be79
push esi
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00404fef
lea eax, [ebp - 0x10c]
push eax
push dword [0x422d00]
push ebx
push ebx
push esi
call fcn.00403a53
push esi
call fcn.00413354
add esp, 0x24
cmp dword [ebp - 4], ebx
je 0x40bea5
lea eax, [ebp - 0x418]
push eax
push dword [0x4234b4]
push dword [0x4234b0]
push ebx
push dword [ebp - 4]
call fcn.00403a53
push dword [ebp - 4]
call fcn.00413354
add esp, 0x18
cmp dword [0x420d08], ebx
je 0x40bebc
push ebx
push ebx
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret