Function at 0x419ba0
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48bf27
mov eax, dword fs:[0]
push eax
sub esp, 0x1f8
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x26
lea ecx, [ebp - 0x11c]
push ecx
push ebx
mov dword [ebp - 0x1ac], eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x194], 0xf
mov dword [ebp - 0x198], ebx
mov byte [ebp - 0x1a8], bl
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x419c10
sub eax, esi
mov edi, eax
lea eax, [ebp - 0x11c]
lea esi, [ebp - 0x1a8]
call fcn.00402610
push 0x1f
mov eax, str.Internet_Exploreriexplore.exe
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00409fe0
mov dword [ebp - 0x128], ebx
mov byte [ebp - 0x138], bl
push eax
or eax, 0xffffffff
xor ebx, ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x124], 0xf
call fcn.00402020
mov byte [ebp - 4], 1
lea edi, [ebx + 5]
mov eax, 0x4bb994
lea esi, [ebp - 0x170]
mov dword [ebp - 0x15c], 0xf
mov dword [ebp - 0x160], ebx
mov byte [ebp - 0x170], bl
call fcn.00402610
mov esi, dword [ebp - 0x1ac]
mov byte [ebp - 4], 2
mov ecx, esi
mov dword [ebp - 0x140], 0xf
mov dword [ebp - 0x144], ebx
mov byte [ebp - 0x154], bl
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x419cb6
sub ecx, edi
mov eax, esi
mov edi, ecx
lea esi, [ebp - 0x154]
call fcn.00402610
mov edx, esi
push edx
lea eax, [ebp - 0x170]
push eax
lea ecx, [ebp - 0x18c]
push ecx
mov byte [ebp - 4], 3
call fcn.0041f450
xor eax, eax
push 0x44
mov byte [ebp - 4], 4
lea edx, [ebp - 0x204]
push ebx
push edx
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x1b8], eax
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
call sub.MSVCR100.dll_memset
mov esi, dword [ebp - 0x17c]
lea eax, [esi + 1]
push eax
call dword [sym.imp.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_]
add esp, 0x1c
xor ecx, ecx
cmp esi, ebx
jle 0x419d50
mov edi, edi
cmp dword [ebp - 0x178], 0x10
mov edi, dword [ebp - 0x18c]
jae 0x419d45
lea edi, [ebp - 0x18c]
mov dl, byte [edi + ecx]
mov byte [eax + ecx], dl
inc ecx
cmp ecx, esi
jl 0x419d30
mov byte [eax + esi], bl
mov ecx, dword [ebp - 0x138]
mov esi, 0x10
cmp dword [ebp - 0x124], esi
jae 0x419d6c
lea ecx, [ebp - 0x138]
lea edx, [ebp - 0x1bc]
push edx
lea edx, [ebp - 0x204]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 0x178], esi
jb 0x419da0
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov edi, 0xf
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x17c], ebx
mov byte [ebp - 0x18c], bl
cmp dword [ebp - 0x140], esi
jb 0x419dcf
mov ecx, dword [ebp - 0x154]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x140], edi
mov dword [ebp - 0x144], ebx
mov byte [ebp - 0x154], bl
cmp dword [ebp - 0x15c], esi
jb 0x419df9
mov edx, dword [ebp - 0x170]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x160], ebx
mov byte [ebp - 0x170], bl
cmp dword [ebp - 0x124], esi
jb 0x419e23
mov eax, dword [ebp - 0x138]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x128], ebx
mov byte [ebp - 0x138], bl
cmp dword [ebp - 0x194], esi
jb 0x419e4d
mov ecx, dword [ebp - 0x1a8]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret 4