Function at 0x4354f5
Capabilities:
Create pipe
Create process on windows
Get common file path

Disassembly:
mov eax, 0x455162
call fcn.00454158
mov eax, 0x20d4
call fcn.0044f570
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
push 0x44
pop esi
push esi
lea eax, [ebp - 0x94]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
call fcn.00446660
xor eax, eax
inc eax
add esp, 0xc
cmp dword [edi + 0x8c4], ebx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x68], eax
mov word [ebp - 0x62], bx
mov dword [ebp - 0x60], ebx
mov word [ebp - 0x64], ax
je 0x43557c
push 0x30
mov byte [ebp - 0x11], al
call fcn.00446648
cmp eax, ebx
pop ecx
je 0x435584
mov ecx, dword [edi + 0x8c4]
call fcn.0041414f
mov esi, eax
jmp 0x435586
mov byte [ebp - 0x11], bl
jmp 0x435772
xor esi, esi
test byte [edi + 0x8c4], 2
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], 0xc
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], ebx
je 0x4355fa
push ebx
lea edx, [ebp - 0x30]
push edx
lea eax, [esi + 8]
lea ecx, [esi + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4355bd
mov byte [ebp - 0x11], bl
push 2
push ebx
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x4355e0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x435632
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 8]
or byte [ebp - 0x67], 1
mov dword [ebp - 0x58], eax
jmp 0x435632
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp eax, ebx
mov dword [ebp - 0x58], eax
jne 0x435632
push ebx
push 0x80
push 3
lea eax, [ebp - 0x30]
push eax
push 2
push 0x40000000
push 0x45c734
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x58], eax
jne 0x435632
mov dword [ebp - 0x58], ebx
test byte [edi + 0x8c4], 4
je 0x435695
push ebx
lea edx, [ebp - 0x30]
push edx
lea eax, [esi + 0x14]
lea ecx, [esi + 0x10]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x435655
mov byte [ebp - 0x11], bl
push 2
push ebx
push ebx
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x43567b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x4356cd
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esi + 0x14]
or byte [ebp - 0x67], 1
mov dword [ebp - 0x54], eax
jmp 0x4356cd
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp eax, ebx
mov dword [ebp - 0x54], eax
jne 0x4356cd
push ebx
push 0x80
push 3
lea eax, [ebp - 0x30]
push eax
push 2
push 0x40000000
push 0x45c734
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x54], eax
jne 0x4356cd
mov dword [ebp - 0x54], ebx
test byte [edi + 0x8c4], 1
je 0x43573a
push ebx
lea edx, [ebp - 0x30]
lea eax, [esi + 0x1c]
push edx
lea ecx, [esi + 0x20]
push eax
push ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
test eax, eax
jne 0x4356f6
mov byte [ebp - 0x11], bl
push 2
push ebx
push ebx
add esi, 0x18
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
call esi
push eax
mov eax, dword [ebp - 0x34]
push dword [eax]
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x43571c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x435772
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
or byte [ebp - 0x67], 1
mov dword [ebp - 0x5c], eax
jmp 0x435772
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
cmp eax, ebx
mov dword [ebp - 0x5c], eax
jne 0x435772
push ebx
push 0x80
push 3
lea eax, [ebp - 0x30]
push eax
push 1
push SysReAllocString
push 0x45c734
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x5c], eax
jne 0x435772
mov dword [ebp - 0x5c], ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], ebx
ja 0x43577f
lea esi, [eax + 0x18]
jmp 0x435784
mov eax, dword [eax + 8]
mov esi, dword [eax]
call fcn.004149b3
push eax
lea eax, [ebp - 0x20dc]
push eax
call fcn.00446250
cmp dword [ebp + 0x10], 2
pop ecx
pop ecx
jb 0x4357c8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 1
ja 0x4357ac
lea esi, [eax + 0x18]
jmp 0x4357b2
mov eax, dword [eax + 8]
mov esi, dword [eax + 4]
call fcn.004149b3
push eax
lea eax, [ebp - 0x10dc]
push eax
call fcn.00446250
pop ecx
pop ecx
jmp 0x4357ce
mov byte [ebp - 0x10dc], bl
cmp byte [ebp - 0x10dc], bl
jne 0x4357e8
lea eax, [ebp - 0x10dc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryA]
cmp dword [ebp + 0x10], 3
jb 0x43580b
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0xc], 2
ja 0x4357fc
add eax, 0x18
jmp 0x435802
mov eax, dword [eax + 8]
mov eax, dword [eax + 8]
call fcn.00414a92
mov word [ebp - 0x64], ax
cmp byte [edi + 0x854], bl
je 0x435911
lea esi, [ebp - 0x24]
call fcn.004382ff
cmp dword [ebp - 0x1c], ebx
je 0x435901
push 0x44
pop esi
push esi
lea eax, [ebp - 0xdc]
push ebx
push eax
call fcn.00446660
mov ax, word [ebp - 0x64]
add esp, 0xc
cmp byte [ebp - 0x11], bl
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xb0], 1
mov word [ebp - 0xaa], bx
mov dword [ebp - 0xa8], ebx
mov word [ebp - 0xac], ax
je 0x43587e
mov byte [ebp - 0x11], bl
lea eax, [ebp - 0x20dc]
push ebx
push eax
call fcn.00412a6f
mov dword [ebp + 0xc], eax
lea eax, [ebp - 0x10dc]
push ebx
push eax
call fcn.00412a6f
add esp, 0x10
cmp byte [edi + 0x854], bl
mov dword [ebp + 0x10], eax
je 0x435911
lea esi, [ebp - 0x24]
call fcn.004382ff
cmp dword [ebp - 0x1c], ebx
je 0x435911
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0xdc]
push eax
push dword [ebp + 0x10]
mov eax, esi
push ebx
push ebx
push dword [ebp + 0xc]
push ebx
push dword [edi + 0x858]
push dword [edi + 0x864]
push dword [edi + 0x860]
push dword [edi + 0x85c]
call fcn.004382e9
call eax
push dword [ebp + 0xc]
mov esi, eax
call fcn.0044624a
pop ecx
push dword [ebp + 0x10]
call fcn.0044624a
pop ecx
jmp 0x43593c
push 0xffffffffffffffff
push 0x9b
mov ebx, edi
call fcn.0041bf47
jmp 0x43595a
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0x10dc]
push eax
movzx eax, byte [ebp - 0x11]
push ebx
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x20dc]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
mov esi, eax
cmp esi, ebx
jne 0x435998
cmp byte [edi + 0x60], 1
jne 0x435971
push 0xffffffffffffffff
call fcn.0041c2a6
push eax
push 0x87
mov ebx, edi
call fcn.0041c119
cmp dword [ebp - 0x24], 0
je 0x435969
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
inc eax
jmp 0x435a7d
xor eax, eax
push ebx
inc eax
mov ecx, edi
call fcn.0041da7b
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ecx, edi
call fcn.0041daa2
mov esi, dword [ebp + 0x14]
push ebx
call fcn.00415008
jmp 0x435a6d
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [ebp - 0x11], bl
je 0x435a12
test byte [edi + 0x8c4], 2
mov esi, dword [ebp - 0x18]
je 0x4359bb
push dword [esi + 8]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [edi + 0x8c4], 4
je 0x4359cd
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test byte [edi + 0x8c4], 1
je 0x4359df
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x44]
push 2
push ebx
mov dword [esi + 0x2c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea eax, [esi + 0x24]
push eax
call ebx
push eax
push dword [ebp - 0x4c]
call ebx
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push esi
lea ebx, [edi + 0x884]
call fcn.00438326
xor ebx, ebx
jmp 0x435a30
mov eax, dword [edi + 0x8c4]
cmp eax, ebx
je 0x435a30
mov esi, dword [ebp - 0x18]
call fcn.00414186
cmp esi, ebx
je 0x435a30
push 1
push esi
call fcn.0041de40
cmp dword [ebp + 8], 1
jne 0x435a41
mov eax, dword [ebp - 0x4c]
mov dword [edi + 0x850], eax
jmp 0x435a6d
mov eax, dword [ebp - 0x44]
fild dword [ebp - 0x44]
test eax, eax
jge 0x435a51
fadd qword [0x45cb28]
mov esi, dword [ebp + 0x14]
fstp qword [ebp - 0x3c]
fld qword [ebp - 0x3c]
push ecx
push ecx
fstp qword [esp]
call fcn.004150f0
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp dword [ebp - 0x24], ebx
je 0x435a7b
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x10