Function at 0x638c00
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x14
push 0
push 0
dec ecx
jne 0x638c08
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x639300
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [esi + 0x311], 0
jne 0x639120
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov ebx, eax
mov dl, 1
mov eax, dword [0x456678]
call fcn.004567e4
mov dword [ebp - 8], eax
mov edx, 0x80000003
mov eax, dword [ebp - 8]
call fcn.004568c0
xor ecx, ecx
mov edx, 0x63931c
mov eax, dword [ebp - 8]
call fcn.00456a04
mov edx, 0x639348
mov eax, dword [ebp - 8]
call fcn.00457200
test al, al
je 0x638d5a
lea ecx, [ebp - 0xc]
mov edx, 0x639348
mov eax, dword [ebp - 8]
call fcn.00457068
lea eax, [ebp - 0x28]
mov edx, dword [0x65a2c0]
mov edx, dword [edx + 0x2d0]
add edx, 0x24
call fcn.00404134
push dword [ebp - 0x28]
lea edx, [ebp - 0x2c]
mov eax, dword [0x65a2c0]
call fcn.0063bee4
push dword [ebp - 0x2c]
push 0x639358
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0050793c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.004042a0
jne 0x638d5a
mov byte [esi + 0x311], 1
mov byte [esi + 0x312], 1
mov byte [ebp - 1], 1
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x3a8]
xor edx, edx
call fcn.004354d0
mov eax, dword [0x6456c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x394]
xor edx, edx
call fcn.004354d0
mov eax, ebx
call fcn.00403170
mov eax, dword [ebp - 8]
call fcn.00403170
lea edx, [ebp - 0x30]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
call fcn.004355b8
lea eax, [ebp - 0x30]
mov edx, 0x639368
call fcn.00404198
mov edx, dword [ebp - 0x30]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
call fcn.004355e8
jmp 0x6392b8
lea edx, [ebp - 0x34]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
call fcn.004355b8
lea eax, [ebp - 0x34]
mov edx, 0x63937c
call fcn.00404198
mov edx, dword [ebp - 0x34]
mov eax, dword [0x6456c8]
mov eax, dword [eax]
call fcn.004355e8
cmp byte [0x65a2c5], 0
je 0x638f5f
mov eax, 0x46
call fcn.00402dd8
dec eax
jne 0x638f5f
push 0x1024
mov ecx, 0x639388
mov edx, 0x639390
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.004540b8
cmp eax, 6
jne 0x638f5f
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 1
jne 0x638e61
push 3
push 0
push 0
lea ecx, [ebp - 0x3c]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x6393e8
call fcn.00597218
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x40]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x63945c
call fcn.00597218
push dword [ebp - 0x40]
lea ecx, [ebp - 0x44]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x6394c0
call fcn.00597218
push dword [ebp - 0x44]
lea ecx, [ebp - 0x48]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x639518
call fcn.00597218
push dword [ebp - 0x48]
lea eax, [ebp - 0x38]
mov edx, 4
call fcn.00404250
mov eax, dword [ebp - 0x38]
call fcn.00404354
push eax
push 0x639568
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 2
jne 0x638ee0
push 3
push 0
push 0
lea ecx, [ebp - 0x50]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x639578
call fcn.00597218
push dword [ebp - 0x50]
lea ecx, [ebp - 0x54]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x6395ec
call fcn.00597218
push dword [ebp - 0x54]
lea ecx, [ebp - 0x58]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x639650
call fcn.00597218
push dword [ebp - 0x58]
lea eax, [ebp - 0x4c]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x4c]
call fcn.00404354
push eax
push 0x639568
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [0x65a2c0]
cmp dword [eax + 0x314], 3
jne 0x638f5f
push 3
push 0
push 0
lea ecx, [ebp - 0x60]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x6396a8
call fcn.00597218
push dword [ebp - 0x60]
lea ecx, [ebp - 0x64]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x639718
call fcn.00597218
push dword [ebp - 0x64]
lea ecx, [ebp - 0x68]
mov eax, dword [0x645718]
mov eax, dword [eax]
mov edx, 0x639774
call fcn.00597218
push dword [ebp - 0x68]
lea eax, [ebp - 0x5c]
mov edx, 3
call fcn.00404250
mov eax, dword [ebp - 0x5c]
call fcn.00404354
push eax
push 0x639568
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0x32
call fcn.00402dd8
dec eax
jne 0x639072
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov edi, eax
mov edx, 0x6397c0
mov eax, edi
call fcn.00413a78
mov edx, 0x6397d4
mov eax, edi
call fcn.00413a78
mov edx, 0x639814
mov eax, edi
call fcn.00413a78
mov edx, 0x639830
mov eax, edi
call fcn.00413a78
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [0x6454e4]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x14]
mov edx, 0x64
call fcn.004044c4
mov eax, dword [ebp - 0x14]
call fcn.00404354
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.shell32.dll_SHGetPathFromIDList
push 0
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [0x644f6c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, 0x63986c
call fcn.0050afe0
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x14]
mov ecx, 0x63986c
call fcn.004041dc
lea eax, [ebp - 0x70]
mov ecx, 0x63987c
mov edx, dword [ebp - 0x14]
call fcn.004041dc
mov edx, dword [ebp - 0x70]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x64]
push 0
lea eax, [ebp - 0x74]
push eax
mov eax, dword [0x644f6c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov edx, 0x63986c
call fcn.0050afe0
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x14]
mov ecx, 0x639898
call fcn.004041dc
lea eax, [ebp - 0x78]
mov ecx, 0x63987c
mov edx, dword [ebp - 0x14]
call fcn.004041dc
mov edx, dword [ebp - 0x78]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, edi
call fcn.00403170
mov edx, 0x80000001
mov eax, ebx
call fcn.004568c0
xor ecx, ecx
mov edx, 0x6398ac
mov eax, ebx
call fcn.00456a04
lea ecx, [ebp - 0x7c]
mov edx, 0x6398e0
mov eax, ebx
call fcn.00457068
mov eax, dword [ebp - 0x7c]
mov edx, 0x6398f4
call fcn.004042a0
je 0x6390c8
lea ecx, [ebp - 0x80]
mov edx, 0x6398e0
mov eax, ebx
call fcn.00457068
mov eax, dword [ebp - 0x80]
mov edx, 0x63992c
call fcn.004042a0
jne 0x6390d5
mov byte [ebp - 1], 1
mov byte [esi + 0x312], 1
jmp 0x639120
mov eax, 0x14
call fcn.00402dd8
cmp eax, 0x64
jge 0x639115
push 0x1024
mov ecx, 0x639388
mov edx, 0x639950
mov eax, dword [0x6454e4]
mov eax, dword [eax]
call fcn.004540b8
cmp eax, 6
jne 0x639115
mov ecx, 0x6398f4
mov edx, 0x6398e0
mov eax, ebx
call fcn.0045703c
mov byte [ebp - 1], 0
mov byte [esi + 0x312], 0
lea ecx, [ebp - 0x88]
mov edx, 0x6398e0
mov eax, ebx
call fcn.00457068
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.00408fbc
mov edx, dword [ebp - 0x84]
mov eax, 0x639990
call fcn.0040447c
test eax, eax
jle 0x639197
mov ecx, 0x6399a4
mov edx, 0x6398e0
mov eax, ebx
call fcn.0045703c
mov eax, ebx
call fcn.00456890
mov edx, 0x80000001
mov eax, ebx
call fcn.004568c0
xor ecx, ecx
mov edx, 0x6399b8
mov eax, ebx
call fcn.00456a04
xor ecx, ecx
mov edx, 0x6399fc
mov eax, ebx
call fcn.004570e0
mov eax, ebx
call fcn.00456890
mov edx, 0x80000001
mov eax, ebx
call fcn.004568c0
mov dl, 1
mov eax, dword [0x4111e4]
call fcn.00403140
mov esi, eax
xor ecx, ecx
mov edx, 0x639a10
mov eax, ebx
call fcn.00456a04
test al, al
je 0x6392a2
mov edx, esi
mov eax, ebx
call fcn.00456e10
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x6392a2
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x90]
mov edx, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x90]
lea edx, [ebp - 0x8c]
call fcn.00408fbc
mov edx, dword [ebp - 0x8c]
mov eax, 0x639a64
call fcn.0040447c
test eax, eax
jle 0x639244
lea ecx, [ebp - 0x94]
mov edx, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x94]
mov eax, ebx
call fcn.00456c10
lea ecx, [ebp - 0x9c]
mov edx, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.00408fbc
mov edx, dword [ebp - 0x98]
mov eax, 0x639a78
call fcn.0040447c
test eax, eax
jle 0x639296
lea ecx, [ebp - 0xa0]
mov edx, dword [ebp - 0x18]
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0xa0]
mov eax, ebx
call fcn.00456c10
inc dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x6391f2
mov eax, esi
call fcn.00403170
mov eax, ebx
call fcn.00403170
mov eax, dword [ebp - 8]
call fcn.00403170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x639307
lea eax, [ebp - 0xa0]
mov edx, 0x1b
call fcn.00403f34
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403f34
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00403f34
lea eax, [ebp - 0x14]
call fcn.00403f10
lea eax, [ebp - 0xc]
call fcn.00403f10
ret