Function at 0x448fe0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x448fe9
mov eax, dword [ebp - 4]
add esp, 0xfffff13c
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], al
mov edi, 0x4ae85c
mov eax, 0x49dedc
call fcn.0048dd88
test esi, esi
jne 0x449065
mov eax, 0x4b98a4
call fcn.00463884
test eax, eax
jne 0x449065
push 0x30
mov eax, 0x65
call fcn.004116e8
push eax
mov eax, 0x14c
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
mov edx, dword [ebp - 0x22c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4498d5
xor eax, eax
call fcn.00452b10
mov dword [0x4bcb78], 0
mov dword [0x4bcb7c], 0
mov dword [0x4bcb70], 0
mov dword [0x4bcb74], 0
call fcn.0044a498
mov dword [ebp - 0x234], eax
mov word [ebp - 0x21c], 8
lea eax, [ebp - 0x110]
call fcn.00464f18
add dword [ebp - 0x210], 6
mov word [ebp - 0x21c], 0x14
mov word [ebp - 0x21c], 0x20
lea eax, [ebp - 0x208]
call fcn.0040ee0c
add dword [ebp - 0x210], 4
mov word [ebp - 0x21c], 0x14
test esi, esi
sete dl
and edx, 1
mov byte [ebp - 0x235], dl
mov word [ebp - 0x21c], 0x2c
cmp byte [ebp - 0x235], 0
je 0x44914f
lea esi, [ebp - 0x208]
mov eax, 0x4b98a4
xor ecx, ecx
xor edx, edx
call fcn.0046376c
jmp 0x449130
lea ecx, [ebp - 0xa78]
lea edx, [ebp - 0xe78]
mov eax, esi
call fcn.0040efdc
lea edx, [ebp - 0xe78]
mov eax, 0x4b98a4
xor ecx, ecx
call fcn.0046376c
test al, al
je 0x44914f
cmp dword [0x4bc224], 0
je 0x44911d
mov word [ebp - 0x21c], 0x14
jmp 0x4491d3
call fcn.0044a498
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x21c], 0x14
test esi, esi
je 0x4491f5
cmp dword [ebp + 0x14], 0
je 0x4491f5
xor ebx, ebx
jmp 0x4491fa
mov ebx, 1
push 1
push ebx
push 0
push 1
lea ecx, [ebp - 0x110]
mov edx, 2
mov eax, esi
call fcn.004689e4
and eax, 0xff
cmp eax, 1
sbb edx, edx
neg edx
mov ebx, edx
test bl, bl
jne 0x449296
cmp dword [ebp - 0xc], 0
jne 0x449296
cmp dword [esi + 0x30], 1
jne 0x449296
mov eax, esi
call fcn.0040f19c
lea ecx, [ebp - 0x244]
lea edx, [ebp - 0x240]
mov eax, esi
call fcn.0040f12c
test al, al
je 0x449296
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.0040a4fc
call fcn.0040a240
test al, al
jne 0x449296
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.00468bb4
lea eax, [ebp - 0x110]
call fcn.0046530c
mov esi, dword [ebp - 0xc]
test bl, bl
jne 0x4492af
test esi, esi
jne 0x449348
cmp dword [ebp + 0x10], 0
jne 0x449348
test bl, bl
jne 0x4492e3
call fcn.0044a498
cmp eax, dword [ebp - 0x23c]
jne 0x4492e3
push 0x30
mov eax, 0x35f
call fcn.004116e8
push eax
mov eax, 0x35e
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
mov eax, 0x4b9dfc
xor edx, edx
call fcn.00445460
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498d5
mov al, byte [ebp - 0x22e]
mov byte [edi + 0x21b6], al
xor edx, edx
mov dword [edi + 0x215c], edx
xor ecx, ecx
mov dword [edi + 0x2188], ecx
mov dword [edi + 0x2678], 1
call fcn.0043e446
cmp byte [ebp - 0x22e], 0
mov byte [0x4bd628], 0
jne 0x4494c5
mov byte [ebp - 0x245], 0
cmp esi, 1
jne 0x44940d
lea ecx, [ebp - 0x1aa8]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.00465240
lea ebx, [ebp - 0x1aa8]
push 1
push 0
lea ecx, [ebp - 0x3308]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.00465240
lea eax, [ebp - 0x3308]
lea ecx, [ebp - 0x26d8]
add eax, 0x400
xor edx, edx
push eax
lea eax, [ebp - 0x110]
call fcn.00465240
lea edx, [ebp - 0x26d8]
mov eax, 0x4ba5d4
pop ecx
call fcn.0045bd3c
mov eax, 0x4ba5d4
call fcn.0045d29c
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 0x245], dl
jmp 0x44942b
lea ecx, [ebp - 0x3708]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x3708]
call fcn.0040b578
mov ebx, eax
cmp byte [ebx], 0
jne 0x449435
mov ebx, 0x49cdc7
mov al, byte [ebp - 0x22d]
push eax
mov eax, 0x4bd628
mov dl, byte [ebp - 0x245]
push edx
mov edx, 0x49ca45
mov cl, byte [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.004498e0
cmp byte [ebp - 0x22d], 0
je 0x4494c5
mov eax, esi
call fcn.0043e337
test al, al
jne 0x4494c5
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498d5
cmp dword [ebp + 0x10], 0
je 0x4494db
push 0x4bd628
push dword [ebp + 0x10]
call fcn.0048d8e8
add esp, 8
test esi, esi
jne 0x449538
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498d5
mov dword [0x4bcb6c], esi
cmp dword [0x4bc21c], 0
jne 0x449551
mov dword [0x4bc21c], 2
xor ebx, ebx
jmp 0x449770
mov eax, dword [edi + 0x4ae4]
call fcn.0040efa4
mov eax, dword [edi + 0x4ad8]
call fcn.0040efa4
mov byte [ebp - 0x3b08], 0
cmp dword [ebp + 0x14], 0
je 0x44958e
lea edx, [ebp - 0x3b08]
mov ecx, 0x400
mov eax, dword [ebp + 0x14]
call fcn.0040f058
cmp byte [ebp - 0x3b08], 0
je 0x44959f
lea edx, [ebp - 0x3b08]
jmp 0x4495a4
mov edx, 0x49cbc1
mov eax, dword [edi + 0x4ad8]
call fcn.0040efd4
lea ecx, [ebp - 0x4738]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea eax, [ebp - 0x4738]
lea edx, [edi + 0x3ed8]
call fcn.0040a568
lea ecx, [ebp - 0x5368]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea eax, [ebp - 0x5368]
lea edx, [edi + 0x42d8]
add eax, 0x400
call fcn.0040a5b0
mov byte [ebp - 0x5768], 0
cmp byte [0x4bd628], 0
je 0x449678
cmp dword [edi + 0x20c0], 5
je 0x449678
push 0x4bd628
lea ecx, [ebp - 0x5b68]
push ecx
call fcn.0048d8e8
add esp, 8
lea eax, [ebp - 0x5768]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x5b68]
xor ecx, ecx
xor edx, edx
call fcn.00409c94
lea eax, [ebp - 0x5b68]
push eax
call fcn.0048f2ec
pop ecx
inc eax
jne 0x449678
lea edx, [ebp - 0x5b68]
mov eax, 0x1f7
push edx
call fcn.004116e8
push eax
call fcn.0044a224
add esp, 8
jmp 0x449781
lea eax, [edi + 0x3ed8]
call fcn.0040b578
push eax
cmp byte [edi + 0x21b6], 0
je 0x449694
mov eax, 0x20b
jmp 0x449699
mov eax, 0x20a
call fcn.004116e8
push eax
lea edx, [ebp - 0x6168]
push edx
call fcn.004908b8
add esp, 0xc
lea eax, [ebp - 0x6168]
call fcn.004779f4
call fcn.00476f7c
push 1
push 0
lea ecx, [edi + 0x42d8]
lea edx, [edi + 0x3ed8]
mov eax, 0x4ba5d4
call fcn.0045bd3c
mov edx, dword [0x4ba7dc]
xor ecx, ecx
mov dword [edi + 0x2a90], edx
xor edx, edx
mov eax, 0x4ba5d4
call fcn.004587a4
cmp byte [ebp - 0x5768], 0
je 0x449708
lea eax, [ebp - 0x5768]
push eax
call fcn.0048f2ec
pop ecx
lea edx, [ebx + 1]
push edx
push dword [ebp - 0xc]
mov eax, 0x35d
call fcn.004116e8
push eax
lea edx, [ebp - 0x6268]
push edx
call fcn.004908b8
add esp, 0x10
lea edx, [ebp - 0x6268]
mov eax, 0x4b9dfc
call fcn.00445460
lea ecx, [ebp - 0x6e98]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.00465240
lea ecx, [ebp - 0x6e98]
mov eax, dword [ecx + 0xc00]
mov edx, dword [ecx + 0xc04]
add dword [0x4bcb70], eax
adc dword [0x4bcb74], edx
call fcn.00477d00
inc ebx
cmp esi, ebx
jle 0x449781
cmp dword [0x4bc224], 0
je 0x449558
cmp dword [0x4bc21c], 2
jne 0x449791
xor eax, eax
mov dword [0x4bc21c], eax
cmp byte [ebp + 8], 0
je 0x4497a2
push dword [0x4b989c]
call sub.USER32.DLL_DestroyWindow
mov eax, 0x4b9dfc
xor edx, edx
call fcn.00445460
mov byte [0x4b9e28], 0
mov eax, 0x4b9dfc
call fcn.00445520
cmp byte [ebp - 0x22e], 0
je 0x44980b
cmp dword [0x4bc228], 0
jne 0x449881
call fcn.0044a498
cmp eax, dword [ebp - 0x234]
jne 0x449881
push 0x40
mov eax, 0x3a7
call fcn.004116e8
push eax
mov eax, 0x3a8
call fcn.004116e8
push eax
push dword [0x4b9890]
call sub.USER32.DLL_MessageBoxA
jmp 0x449881
cmp byte [ebp - 0x235], 0
je 0x449881
cmp dword [0x4bc228], 0
jne 0x449840
cmp byte [0x4bda2d], 0
je 0x449840
push 1
push 0x49ca45
push 0
push 0x4bd628
push 0x49d4ae
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov byte [ebp - 0x7298], 0
lea edx, [ebp - 0x7ec8]
mov eax, 0x4b98a4
call fcn.00463930
test al, al
je 0x449871
lea edx, [ebp - 0x7ec8]
push edx
lea ecx, [ebp - 0x7298]
push ecx
call fcn.0048d8e8
add esp, 8
lea edx, [ebp - 0x7298]
mov eax, 0x4b98a4
call fcn.0045e350
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef28
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004392b0
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef28
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10