Function at 0x450650
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Set current directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d5e34
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x517b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x220], ebx
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0
call fcn.004a2a40
test eax, eax
jne 0x4506b2
push 0x30
push 0x4e4e40
push 0x4ec788
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x450b7b
mov dword [ebp - 0x21c], 0
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x264], eax
xor edi, edi
nop word [eax + eax]
mov ebx, dword [edi + 0x4ec690]
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4506e0
sub esi, ecx
lea ecx, [ebp + 0xc]
sar esi, 1
call fcn.004a2380
push esi
push ebx
push eax
call fcn.004bad40
add esp, 0xc
test eax, eax
je 0x450719
inc dword [ebp - 0x264]
add edi, 0xc
cmp edi, 0x3c
jb 0x4506d0
jmp 0x4508b9
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x224], 0
call fcn.004a2380
lea edi, [eax + esi*2]
mov eax, dword [ebp - 0x264]
lea esi, [eax + eax*2]
lea eax, [ebp - 0x224]
push eax
lea eax, [edi + 2]
push eax
push dword [esi*4 + 0x4ec698]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, dword [esi*4 + 0x4ec694]
mov ebx, eax
push esi
call fcn.004a27e0
push eax
push esi
call fcn.004a29e0
mov dword [ebp - 0x268], eax
push edi
mov byte [ebp - 4], 3
call fcn.004a27e0
push eax
push edi
call fcn.004a29e0
add esp, 0x18
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x264]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x268]
call fcn.004a24b0
mov esi, eax
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 5
test ecx, ecx
je 0x4507b4
call fcn.004a2a20
mov ecx, dword [esi]
mov dword [ebp + 0xc], ecx
test ecx, ecx
je 0x4507c2
call fcn.004a26e0
mov ecx, dword [ebp - 0x26c]
mov byte [ebp - 4], 6
test ecx, ecx
je 0x4507d5
call fcn.004a2a20
mov ecx, dword [ebp - 0x264]
mov byte [ebp - 4], 7
test ecx, ecx
je 0x4507e8
call fcn.004a2a20
mov ecx, dword [ebp - 0x268]
mov byte [ebp - 4], 8
test ecx, ecx
je 0x4507fb
call fcn.004a2a20
mov byte [ebp - 4], 2
test ebx, ebx
jne 0x450821
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4eaccc
lea ecx, [ebp + 0xc]
call fcn.004a2650
jmp 0x4508b9
push 0x5c
lea ecx, [ebp + 0xc]
call fcn.004a2380
push eax
call fcn.004ab2c0
add esp, 8
lea ecx, [ebp - 0x21c]
add eax, 2
push eax
call fcn.004a2300
lea ecx, [ebp - 0x21c]
call fcn.004a2a40
mov esi, eax
lea ecx, [ebp + 0xc]
not esi
call fcn.004a2a40
lea ecx, [ebp + 0xc]
add esi, eax
call fcn.004a2380
mov ecx, esi
neg ecx
sbb ecx, ecx
and ecx, 2
push ecx
push 0x4e454c
lea ecx, [esi + esi]
push ecx
push eax
call fcn.004a2980
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x26c], esi
mov ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 9
test ecx, ecx
je 0x450898
call fcn.004a2a20
mov dword [ebp + 0xc], esi
test esi, esi
je 0x4508a6
mov ecx, esi
call fcn.004a26e0
mov byte [ebp - 4], 0xa
test esi, esi
je 0x4508b5
mov ecx, esi
call fcn.004a2a20
mov byte [ebp - 4], 2
push 0x3c
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.004aa220
add esp, 0xc
push 0
push 0x4ec804
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
jne 0x450982
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x260]
mov dword [ebp - 0x260], 0x3c
push eax
mov dword [ebp - 0x25c], 0x40
mov dword [ebp - 0x254], 0x4e4c58
mov dword [ebp - 0x250], 0x4ec824
mov dword [ebp - 0x244], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push edi
push 0x4ec804
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
jne 0x4509a6
push 0x10
push 0x4e4e40
push 0x4ec840
push dword [ebp - 0x220]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 4], 0xb
jmp 0x450b6c
lea eax, [ebp - 0x220]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x220]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x228], eax
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4509b5
push 1
jmp 0x4509b7
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x4e4ad0
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push 0x10288
push 0x111
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ebx, 0x1e
nop dword [eax]
push 0
push 0x25
push 0x100
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
sub ebx, 1
jne 0x450a20
lea ecx, [ebp + 0xc]
call fcn.004a2380
mov ebx, eax
movzx eax, word [ebx]
test ax, ax
je 0x450a9f
mov ecx, eax
cmp cx, 0x5c
jne 0x450a68
push 0
push 0x27
push 0x100
jmp 0x450a7c
movzx eax, cx
push eax
call fcn.004bb160
add esp, 4
push 0
push eax
push 0x102
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x450a57
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea ecx, [ebp - 0x21c]
call fcn.004a2a40
test eax, eax
je 0x450b5a
push 0
push 0x4e45a0
push 0
push edi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push 0x24
push 0x100
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
lea ecx, [ebp - 0x21c]
call fcn.004a2380
mov esi, eax
movzx eax, word [esi]
test ax, ax
je 0x450b5a
mov ecx, eax
movzx ecx, cx
push ecx
call fcn.004bb160
add esp, 4
push 0
push eax
push 0x102
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push dword [ebp - 0x228]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
movzx eax, word [esi + 2]
lea esi, [esi + 2]
mov ecx, eax
test ax, ax
jne 0x450b23
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x21c]
test ecx, ecx
je 0x450b7b
call fcn.004a2a20
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xe
test ecx, ecx
je 0x450b8e
call fcn.004a2a20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a71aa
mov esp, ebp
pop ebp
ret