Function at 0x4847e4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2e
push 0
push 0
dec ecx
jne 0x4847ec
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x484c24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, 0x484c3c
call fcn.0047d160
mov dl, 1
mov eax, dword [0x417700]
call fcn.004037d4
mov ebx, eax
xor eax, eax
push ebp
push 0x4848b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x488f60]
mov esi, dword [eax + 0x2fc]
mov eax, esi
call fcn.00471150
add eax, 0x24
mov edx, 0x484c4c
call fcn.00404748
mov eax, esi
call fcn.00471150
add eax, 0x70
mov edx, 0x484c78
call fcn.00404748
push ebx
mov ecx, dword [0x488f7c]
mov edx, 0x484cb8
mov eax, esi
call fcn.0046f880
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x484890
cmp eax, 0
jne 0x484890
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484b5a
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x98]
mov edx, 0x484ce4
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4848ca
xor eax, eax
push ebp
push 0x484b49
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4173ec]
call fcn.004037d4
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x12c]
lea ecx, [ebp - 4]
mov edx, 0x484cf4
mov esi, dword [eax]
call dword [esi + 0x38]
cmp dword [ebp - 4], 0
je 0x484b3f
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x130]
lea ecx, [ebp - 0xc]
mov edx, 0x484d08
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x138]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
call fcn.0040497c
mov eax, dword [ebp - 0x134]
call fcn.00409190
mov byte [0x488f68], al
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x13c]
lea ecx, [ebp - 0xc]
mov edx, 0x484d20
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x144]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
call fcn.0040497c
mov eax, dword [ebp - 0x140]
call fcn.00409190
mov byte [0x488f6a], al
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x148]
lea ecx, [ebp - 8]
mov edx, 0x484d38
mov esi, dword [eax]
call dword [esi + 0x38]
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax]
call dword [edx + 0xc]
mov esi, eax
dec esi
test esi, esi
jl 0x484a77
inc esi
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x150]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x150]
push eax
lea eax, [ebp - 0x160]
mov edx, dword [ebp - 0x20]
mov cl, 0xfc
call fcn.004142a0
lea edx, [ebp - 0x160]
lea ecx, [ebp - 0xc]
pop eax
mov edi, dword [eax]
call dword [edi + 0x10]
lea edx, [ebp - 0x16c]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x16c]
lea edx, [ebp - 0x168]
call fcn.00408c7c
mov edx, dword [ebp - 0x168]
lea eax, [ebp - 0x164]
call fcn.0040497c
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc dword [ebp - 0x20]
dec esi
jne 0x4849ff
cmp byte [0x488f6a], 0
je 0x484b37
lea eax, [ebp - 0x125]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x484b37
inc esi
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, ebx
call fcn.0041ca38
mov eax, dword [ebp - 0x18]
call fcn.004840f0
mov ebx, eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.004842a8
lea eax, [ebp - 0x170]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.00404964
mov edx, dword [ebp - 0x170]
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
call fcn.00404a00
mov edx, dword [ebp - 0x14]
mov eax, ebx
call fcn.0041c9b4
push 5
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404bb4
push eax
push 0x484d4c
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
call fcn.0041ca38
inc dword [ebp - 0x20]
dec esi
jne 0x484ab0
mov eax, dword [ebp - 0x1c]
call fcn.00403804
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x484b5a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x484c2e
lea eax, [ebp - 0x170]
call fcn.004046f4
lea eax, [ebp - 0x16c]
mov edx, 2
call fcn.00404e18
lea eax, [ebp - 0x164]
call fcn.004046f4
lea eax, [ebp - 0x160]
call fcn.004100f0
lea eax, [ebp - 0x150]
mov edx, dword [0x47b43c]
mov ecx, 3
call fcn.004053c4
lea eax, [ebp - 0x144]
call fcn.00404e00
lea eax, [ebp - 0x140]
call fcn.004046f4
lea eax, [ebp - 0x13c]
call fcn.004063fc
lea eax, [ebp - 0x138]
call fcn.00404e00
lea eax, [ebp - 0x134]
call fcn.004046f4
lea eax, [ebp - 0x130]
mov edx, dword [0x47b43c]
mov ecx, 2
call fcn.004053c4
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404718
lea eax, [ebp - 0x10]
call fcn.004063fc
lea eax, [ebp - 0xc]
mov edx, dword [0x47b40c]
mov ecx, 3
call fcn.004053c4
ret