Function at 0x4afe30
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10d4
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x506ef4]
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 0x106c], edi
test ebx, ebx
je 0x4b0282
lea eax, [ebp - 0x730]
push eax
push edi
push edi
push 5
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
je 0x4afe8c
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
push 0x58
lea ecx, [ebp - 0x10d0]
push 0
push ecx
call fcn.004d29c0
add esp, 0xc
lea edx, [ebp - 0x1068]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x105c]
movzx ecx, word [ebp - 0x105e]
movzx edx, word [ebp - 0x1060]
push eax
movzx eax, word [ebp - 0x1062]
push ecx
movzx ecx, word [ebp - 0x1066]
push edx
movzx edx, word [ebp - 0x1068]
push eax
push ecx
push edx
lea eax, [ebp - 0x628]
push str.WINPATROL_FILELIST__04d_02d_02d_02d_02d_02d.csv
push eax
call fcn.004d0d1c
lea edx, [ebp - 0x730]
mov dword [ebp - 0x10a4], edx
add esp, 0x20
mov dword [ebp - 0x10cc], esi
xor esi, esi
lea edx, [ebp - 0x10d0]
lea ecx, [ebp - 0x628]
xor eax, eax
push edx
mov dword [ebp - 0x10d0], 0x58
mov dword [ebp - 0x10c0], esi
mov dword [ebp - 0x10bc], esi
mov dword [ebp - 0x10b8], esi
mov dword [ebp - 0x10b4], ecx
mov dword [ebp - 0x10b0], 0x200
mov dword [ebp - 0x10ac], esi
mov dword [ebp - 0x10a8], esi
mov dword [ebp - 0x10a0], str.WinPatrol_Plus_:_Export_File_Size_List_To_CSV
mov dword [ebp - 0x1098], eax
mov dword [ebp - 0x109c], 0x280004
mov dword [ebp - 0x1094], 0x4e27f8
mov dword [ebp - 0x10c4], str.CSV_Files
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
test eax, eax
je 0x4b0282
mov eax, dword [ebp - 0x10b4]
cmp byte [eax], 0
je 0x4b0282
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x628]
call fcn.004010b0
mov eax, dword [ebp - 0x10b4]
push eax
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x428]
call fcn.004010b0
lea ecx, [ebp - 0x428]
push 0x5c
push ecx
call fcn.004d16c0
add esp, 8
cmp eax, esi
je 0x4b0282
lea edx, [ebp - 0x628]
push 0x4e6f30
push edx
mov byte [eax], 0
call fcn.004d00db
add esp, 8
mov dword [ebp - 0x1070], eax
cmp eax, esi
jne 0x4b0016
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
call fcn.004ca450
neg eax
sbb eax, eax
and eax, 0x7c6
add eax, 0xa
cmp byte [ebx], 0
mov dword [ebp - 0x1074], eax
je 0x4b025c
add ebx, 0x198
jmp 0x4b004c
mov eax, dword [ebp - 0x1074]
mov edi, dword [ebp - 0x106c]
cmp edi, eax
jge 0x4b025c
cmp edi, esi
jne 0x4b0081
mov ecx, 0x18
mov esi, str._FileName___Directory_Name___Extension___FileSize_in_Bytes___Date_Last_Accessed___Date_Created__n
lea edi, [ebp - 0x1058]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1070]
lea eax, [ebp - 0x1058]
push eax
push ecx
movsb byte es:[edi], byte [esi]
call fcn.004d00f2
add esp, 8
mov edx, dword [ebx + 8]
push edx
lea eax, [ebp - 0x838]
push 0x4f198c
push eax
call fcn.004d0d1c
mov ecx, dword [ebx]
xor edx, edx
mov eax, ecx
mov esi, 0x2710
div esi
mov edi, eax
mov esi, edx
xor edx, edx
mov eax, ecx
mov ecx, 0x64
div ecx
mov eax, 0x51eb851f
push edx
mul esi
shr edx, 5
push edx
push edi
lea edx, [ebp - 0x320]
push str._04d__02d__02d
push edx
call fcn.004d0d1c
mov ecx, dword [ebx + 4]
xor edx, edx
mov eax, ecx
mov esi, 0x64
div esi
mov eax, ecx
mov ecx, 0x2710
add esp, 0x20
mov esi, edx
xor edx, edx
div ecx
push esi
mov ecx, eax
mov eax, 0x51eb851f
mul edx
shr edx, 5
push edx
push ecx
push str._02d:_02d:_02d
cmp ecx, 0xc
jl 0x4b0110
lea edx, [ebp - 0x110]
push edx
jmp 0x4b0117
lea eax, [ebp - 0x110]
push eax
call fcn.004d0d1c
lea eax, [ebp - 0x110]
add esp, 0x14
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b0127
lea edi, [ebp - 0x320]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4b0137
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx - 8]
xor edx, edx
mov eax, ecx
mov esi, 0x2710
div esi
mov edi, eax
mov esi, edx
xor edx, edx
mov eax, ecx
mov ecx, 0x64
div ecx
mov eax, 0x51eb851f
push edx
mul esi
shr edx, 5
push edx
push edi
lea edx, [ebp - 0x218]
push str._04d__02d__02d
push edx
call fcn.004d0d1c
mov ecx, dword [ebx - 4]
xor edx, edx
mov eax, ecx
mov esi, 0x64
div esi
mov eax, ecx
mov ecx, 0x2710
add esp, 0x14
mov esi, edx
xor edx, edx
div ecx
push esi
mov ecx, eax
mov eax, 0x51eb851f
mul edx
shr edx, 5
push edx
push ecx
push str._02d:_02d:_02d
cmp ecx, 0xc
jl 0x4b01c8
lea edx, [ebp - 0x110]
push edx
jmp 0x4b01cf
lea eax, [ebp - 0x110]
push eax
call fcn.004d0d1c
lea eax, [ebp - 0x110]
add esp, 0x14
mov esi, eax
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b01e0
lea edi, [ebp - 0x218]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4b01f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x320]
push edx
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebx - 0x18]
push ecx
mov ecx, dword [ebp - 0x1070]
lea edx, [ebx - 0x118]
push edx
lea eax, [ebx - 0x198]
push eax
push str.__s____s____s____s____t_s____t_s__n
push ecx
call fcn.004d00f2
inc dword [ebp - 0x106c]
add ebx, 0x1ac
add esp, 0x20
xor esi, esi
cmp byte [ebx - 0x198], 0
jne 0x4b0040
mov edx, dword [ebp - 0x1070]
push edx
call fcn.004d039f
add esp, 4
push 1
push esi
push esi
lea eax, [ebp - 0x428]
push eax
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret