Function at 0x4a9e10
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
call fcn.004a15b0
test eax, eax
je 0x4aa098
lea ecx, [esi + 0x1d0]
test ecx, ecx
je 0x4a9e3f
lea ecx, [esi + 0x1d4]
jmp 0x4a9e41
xor ecx, ecx
mov edx, dword [ecx]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00510650
mov eax, dword [0x553d9c]
mov ecx, 0x81
mov dword [esp + 0x2c], eax
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x2c]
push edx
call fcn.004f0fb0
mov eax, dword [0x546560]
mov ecx, str.tmp_byte_file.txt
add esp, 4
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x4a9ee8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4a9ee8
push esi
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x4a9ee8
mov ecx, dword [esp + 0x10]
lea eax, [esi + 1]
test eax, eax
mov esi, ecx
jne 0x4a9ebf
test ecx, ecx
jne 0x4a9edd
push eax
push ecx
push 0xffffffffffffffff
push str.tmp_byte_file.txt
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x4a9edd
mov word [esi + eax*2 - 2], 0
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405bb0
mov edx, dword [0x546560]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], edx
test eax, eax
je 0x4a9f52
lea ecx, [esp + 0x2c]
shr ecx, 0x10
jne 0x4a9f1e
xor edx, edx
lea eax, [esp + 0x2c]
mov dx, ax
lea ecx, [esp + 0x14]
push edx
call fcn.00413c90
jmp 0x4a9f52
lea ecx, [esp + 0x2c]
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x4a9f52
push esi
lea ecx, [esp + 0x18]
call fcn.00405530
test eax, eax
je 0x4a9f52
mov edi, dword [esp + 0x14]
lea ecx, [esi + esi]
mov edx, ecx
lea esi, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x546560]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x28]
push edx
call fcn.004059f0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
call fcn.00405440
lea ecx, [esp + 0x1c]
call fcn.00405700
mov eax, dword [esp + 0x14]
mov edx, dword [0x546564]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4a9fbe
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4a9fbe
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4a9fe9
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4a9fe9
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
mov eax, dword [esp + 0x18]
push ecx
mov esi, esp
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x4aa009
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4aa027
mov ecx, dword [0x546560]
mov dword [esi], ecx
mov eax, dword [esp + 0x1c]
test eax, eax
mov edi, eax
je 0x4aa01e
push eax
call ebp
push edi
push eax
mov ecx, esi
call fcn.00405870
push str.AAAAA
push ecx
mov edx, esp
push 0x8000
push edx
lea ecx, [esp + 0x38]
call fcn.005108f0
call fcn.00441f60
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [ecx + 4]
push 1
push 0
push 0
push eax
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
mov edx, dword [0x546564]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4aa08f
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4aa08f
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00531732
add esp, 4
lea ecx, [esp + 0x24]
call fcn.0050fe40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret