Function at 0x43413d
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cb36
mov eax, dword fs:[0]
push eax
mov eax, 0x56cc
call fcn.004615a0
mov eax, dword [0x49b854]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x4ffe
mov word [ebp - 0x5628], ax
xor edi, edi
lea eax, [ebp - 0x5626]
push edi
push eax
call fcn.0045c380
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push edi
push eax
call fcn.0045c380
xor eax, eax
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call fcn.0045c380
xor eax, eax
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push edi
push eax
call fcn.0045c380
add esp, 0x30
push 0x104
lea eax, [ebp - 0x628]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x49d860]
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x5634], eax
mov eax, dword [0x49d868]
push edi
mov dword [ebp - 0x5638], eax
push 0x1c
lea eax, [ebp - 0x218]
push eax
push edi
call esi
push edi
push 0x1a
lea eax, [ebp - 0x420]
push eax
push edi
call esi
push str.__needcommunicate
lea ecx, [ebp - 0x562c]
call fcn.00418091
mov esi, str.__localapp_
push esi
mov dword [ebp - 4], edi
call fcn.0045e6b2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x562c]
call fcn.00417da6
lea eax, [ebp - 0x218]
push eax
call fcn.0045e6b2
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x562c]
call fcn.00417da6
mov esi, 0x4814dc
push esi
call fcn.0045e6b2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x562c]
call fcn.00417da6
mov ebx, str.__appdata_
push ebx
call fcn.0045e6b2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x562c]
call fcn.00417da6
lea eax, [ebp - 0x420]
push eax
call fcn.0045e6b2
pop ecx
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x562c]
call fcn.00417da6
push esi
call fcn.0045e6b2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x562c]
call fcn.00417da6
lea eax, [ebp - 0x5630]
push eax
call fcn.004338bf
lea eax, [ebp - 0x5630]
push eax
mov byte [ebp - 4], 1
call fcn.0042cd22
mov eax, dword [ebp - 0x5630]
pop ecx
pop ecx
cmp dword [eax - 0xc], edi
je 0x43433f
mov ebx, str.__curinstallpath_
push ebx
call fcn.0045e6b2
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x562c]
call fcn.00417da6
mov eax, dword [ebp - 0x5630]
push dword [eax - 0xc]
lea ecx, [ebp - 0x562c]
push eax
call fcn.00417da6
push esi
call fcn.0045e6b2
pop ecx
push eax
push esi
lea ecx, [ebp - 0x562c]
call fcn.00417da6
push dword [ebp - 0x562c]
lea eax, [ebp - 0x5628]
push eax
call fcn.004611fc
lea eax, [ebp - 0x5628]
push str.__upgradepower
push eax
call fcn.004611fc
xor ebx, ebx
inc ebx
add esp, 0x10
mov esi, ebx
cmp dword [ebp - 0x5634], ebx
jle 0x4343a4
lea eax, [ebp - 0x5628]
push 0x483158
push eax
call fcn.004611fc
mov eax, dword [ebp - 0x5638]
push dword [eax + esi*4]
lea eax, [ebp - 0x5628]
push eax
call fcn.004611fc
add esp, 0x10
inc esi
cmp esi, dword [ebp - 0x5634]
jl 0x434372
push 0x38
lea eax, [ebp - 0x56a8]
push edi
push eax
mov dword [ebp - 0x56ac], 0x3c
call fcn.0045c380
lea eax, [ebp - 0x628]
mov dword [ebp - 0x569c], eax
lea eax, [ebp - 0x5628]
mov dword [ebp - 0x5698], eax
add esp, 0xc
lea eax, [ebp - 0x56ac]
push eax
mov dword [ebp - 0x56a8], 0x500
mov dword [ebp - 0x5674], edi
mov dword [ebp - 0x56a4], edi
mov dword [ebp - 0x56a0], str.runas
mov dword [ebp - 0x5690], ebx
mov dword [ebp - 0x568c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x434456
push 5
pop esi
mov dword [0x49d5b0], esi
mov ecx, dword [ebp - 0x5630]
add ecx, 0xfffffff0
call fcn.0041788d
mov ecx, dword [ebp - 0x562c]
add ecx, 0xfffffff0
call fcn.0041788d
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045bc90
leave
ret
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push edi
push dword [0x49d570]
mov esi, 0x49d5b4
push edi
mov ecx, esi
call fcn.00431de2
mov dword [ebp - 0x5670], 0x483330
mov dword [ebp - 0x566c], edi
mov dword [ebp - 0x5668], edi
mov dword [ebp - 0x5664], edi
mov dword [ebp - 0x5660], edi
mov dword [ebp - 0x565c], edi
mov dword [ebp - 0x5658], edi
lea eax, [ebp - 0x5670]
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0043366c
lea ecx, [ebp - 0x56d8]
call fcn.00434b24
lea ecx, [ebp - 0x5670]
mov byte [ebp - 4], 3
call fcn.00431d5e
mov ecx, esi
call fcn.0043385d
mov ecx, esi
call fcn.00433836
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [0x49d5b0]
lea ecx, [ebp - 0x56d8]
mov byte [ebp - 4], 2
call fcn.00434a41
lea ecx, [ebp - 0x5660]
call fcn.00431c75
lea ecx, [ebp - 0x566c]
call fcn.00431c75
jmp 0x43441e