Function at 0x5254c0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x5254c8
push ebx
push esi
push edi
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x52585a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x19], 0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.00470b84
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x525504
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x525827
mov eax, dword [0x7334b4]
cmp dword [eax], 6
jl 0x5255ee
mov eax, dword [0x733bb4]
cmp dword [eax], 2
jl 0x5255ee
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406e30
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406e30
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00406e30
mov dl, 1
mov eax, dword [0x49fee0]
call fcn.004a0214
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.004a02f0
mov edx, 0x525878
mov eax, ebx
call fcn.004a055c
test al, al
je 0x52558e
lea ecx, [ebp - 4]
mov edx, 0x525920
mov eax, ebx
call fcn.004a0964
lea ecx, [ebp - 8]
mov edx, 0x52593c
mov eax, ebx
call fcn.004a0964
cmp dword [ebp - 4], 0
je 0x5255e5
cmp dword [ebp - 8], 0
je 0x5255e5
mov edx, 0x80000000
mov eax, ebx
call fcn.004a02f0
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x525954
call fcn.00527260
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004a055c
test al, al
je 0x5255dd
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.004a0964
cmp dword [ebp - 0xc], 0
setne byte [ebp - 0x19]
mov eax, ebx
call fcn.00404700
jmp 0x5255f2
mov byte [ebp - 0x19], 1
cmp byte [ebp - 0x19], 0
je 0x525693
mov eax, dword [0x7334b4]
cmp dword [eax], 0xa
jl 0x525693
mov eax, dword [0x7335e0]
cmp dword [eax], 0x295a
jl 0x525693
xor eax, eax
push ebp
push 0x525689
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x49fee0]
call fcn.004a0214
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.004a02f0
mov edx, 0x52598c
mov eax, ebx
call fcn.004a0dd8
test al, al
jne 0x52566f
mov edx, 0x525a24
mov eax, ebx
call fcn.004a0dd8
test al, al
jne 0x52566f
mov edx, 0x525ab4
mov eax, ebx
call fcn.004a0dd8
test al, al
je 0x525673
xor eax, eax
jmp 0x525675
mov al, 1
mov byte [ebp - 0x19], al
mov eax, ebx
call fcn.00404700
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525693
cmp byte [ebp - 0x19], 0
je 0x5256e1
xor edx, edx
push ebp
push 0x5256d3
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00406e68
push eax
push 0x525b24
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x19]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5256e1
cmp byte [ebp - 0x19], 0
jne 0x525756
mov eax, dword [0x7334b4]
cmp dword [eax], 0xa
jl 0x525756
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x525b3c
call fcn.00527260
xor edx, edx
push ebp
push 0x525748
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00406e68
push eax
push 0x525b24
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x19]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525756
cmp byte [ebp - 0x19], 0
jne 0x525827
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00406e30
lea eax, [ebp - 0x20]
push eax
push 0x26
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x5257b9
mov eax, 0x104
call fcn.00472a84
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x5257b2
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.00472a58
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x10]
call fcn.00479b20
mov eax, ebx
call fcn.00472ac4
cmp dword [ebp - 0x10], 0
je 0x525827
lea eax, [ebp - 0x10]
mov edx, 0x525b6c
call fcn.00407130
mov eax, dword [ebp - 0x10]
call fcn.00471b68
test al, al
je 0x525827
xor edx, edx
push ebp
push 0x525819
push dword fs:[edx]
mov dword fs:[edx], esp
push 1
push 0
mov eax, dword [ebp - 0x18]
call fcn.00406e68
push eax
mov eax, dword [ebp - 0x10]
call fcn.00406e68
push eax
push 0x525b24
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x19]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x525827
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x525861
lea eax, [ebp - 0x38]
call fcn.00406dcc
lea eax, [ebp - 0x2c]
call fcn.00406dcc
lea eax, [ebp - 0x24]
call fcn.00406dcc
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00406dd4
ret