Function at 0x420651
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0xcec
lea ebp, [esp - 4]
mov eax, dword [0x62ece4]
xor eax, ebp
mov dword [ebp + 0xcec], eax
push 0x50
mov eax, 0x5af5e5
call fcn.00499ab7
mov eax, dword [ebp + 0xcfc]
mov esi, dword [ebp + 0xcf8]
xor edi, edi
push edi
push 0x5ca414
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, edi
jne 0x42077f
push edi
xor ebx, ebx
inc ebx
push ebx
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push esi
call fcn.00408c50
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x5cabac
mov dword [ebp - 4], edi
call fcn.00408c50
or dword [ebp - 4], 0xffffffff
push 0x5cab38
push SysReAllocString
call fcn.004204ed
add esp, 0x18
mov esi, 0x104
push esi
lea eax, [ebp + 0xae4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x8dc]
push eax
push esi
push edi
push 0x5cab20
lea eax, [ebp + 0xae4]
push eax
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x420735
push 0x10
push 0x5cab14
push 0x5caac0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
jmp 0x4208b7
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x5c]
push edi
push eax
call fcn.0049af70
lea eax, [ebp + 0x8dc]
mov dword [ebp - 0x4c], eax
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x50], 0x5ca0b4
mov dword [ebp - 0x40], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, ebx
jmp 0x4208b7
push 3
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push 0x5caaa0
push edi
push ebx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x18], eax
cmp eax, edi
je 0x4208b5
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0x24
mov ebx, 0x100
push ebx
push eax
call esi
lea eax, [ebp]
push eax
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp dword [ebp + 0xa8], 8
jbe 0x4207d8
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x20]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, dword [ebp - 0x20]
jmp 0x42082a
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp ax, 0x5c
jne 0x42080d
cmp dword [ebp + 0xa8], 8
jbe 0x420807
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0x27
push ebx
jmp 0x42081e
movzx eax, ax
push edi
push eax
call fcn.0049c36f
pop ecx
push eax
push 0x102
push dword [ebp - 0x18]
call esi
add dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x10]
cmp word [eax], di
jne 0x4207ea
cmp dword [ebp - 0x14], edi
je 0x4208b2
push edi
push 0x5caa84
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x10], eax
cmp eax, edi
je 0x4208b2
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetFocus]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
push 0x24
push ebx
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x14]
lea eax, [ebp + 0xdc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ebx, [ebp + 0xdc]
cmp word [ebp + 0xdc], di
je 0x4208b2
movzx eax, word [ebp + 0xdc]
movzx eax, ax
push edi
push eax
call fcn.0049c36f
pop ecx
push eax
push 0x102
push dword [ebp - 0x10]
call esi
inc ebx
inc ebx
movzx eax, word [ebx]
cmp ax, di
jne 0x420892
xor edi, edi
inc edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xcec]
xor ecx, ebp
call fcn.00499aa8
add ebp, 0xcf0
leave
ret