Function at 0x401250
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x40b782
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [0x4130c0]
xor eax, esp
mov dword [esp + 0x510], eax
push esi
mov eax, dword [0x4130c0]
xor eax, esp
push eax
lea eax, [esp + 0x520]
mov dword fs:[0], eax
cmp dword [ebp + 8], 3
jge 0x40129e
mov eax, 1
jmp 0x4015a2
lea eax, [esp + 0x30c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x3c
lea eax, [esp + 0x14]
push 0
push eax
call fcn.00408660
lea eax, [esp + 0x318]
push eax
lea eax, [esp + 0x114]
push 0x104
push eax
mov dword [esp + 0x28], 0x3c
call fcn.00403271
push str.RICOHDesktopAgentUXUpdater.exe
lea eax, [esp + 0x120]
push 0x104
push eax
call fcn.004031ba
add esp, 0x24
lea eax, [esp + 0x104]
push 1
mov dword [esp + 0x24], eax
xor eax, eax
push ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x68], 7
mov dword [esp + 0x64], 0
mov word [esp + 0x54], ax
call fcn.00401700
mov dword [esp + 0x528], 0
mov eax, dword [0x413f68]
lea edx, [esp + 0x4c]
push dword [eax + 4]
lea ecx, [esp + 0xe0]
call fcn.00401f70
lea ecx, [esp + 0x50]
push ecx
mov edx, eax
lea ecx, [esp + 0x9c]
mov byte [esp + 0x530], 1
call fcn.00402060
push 0x41138c
mov edx, eax
lea ecx, [esp + 0x88]
mov byte [esp + 0x534], 2
call fcn.004020e0
lea ecx, [esp + 0x58]
push ecx
mov edx, eax
lea ecx, [esp + 0xbc]
mov byte [esp + 0x538], 3
call fcn.00402060
mov byte [esp + 0x538], 4
mov ecx, dword [0x413f68]
mov edx, eax
push dword [ecx + 8]
lea ecx, [esp + 0xd8]
call fcn.004020e0
lea ecx, [esp + 0x60]
push ecx
mov edx, eax
lea ecx, [esp + 0x7c]
mov byte [esp + 0x540], 5
call fcn.00402060
add esp, 0x18
cmp dword [esp + 0xd8], 8
jb 0x4013f0
push dword [esp + 0xc4]
call fcn.00402ec3
add esp, 4
xor eax, eax
cmp dword [esp + 0xc0], 8
mov dword [esp + 0xd8], 7
mov dword [esp + 0xd4], 0
mov word [esp + 0xc4], ax
jb 0x401429
push dword [esp + 0xac]
call fcn.00402ec3
add esp, 4
xor eax, eax
cmp dword [esp + 0x90], 8
mov dword [esp + 0xc0], 7
mov dword [esp + 0xbc], 0
mov word [esp + 0xac], ax
jb 0x40145f
push dword [esp + 0x7c]
call fcn.00402ec3
add esp, 4
xor eax, eax
cmp dword [esp + 0xa8], 8
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], ax
jb 0x401495
push dword [esp + 0x94]
call fcn.00402ec3
add esp, 4
xor eax, eax
cmp dword [esp + 0xf0], 8
mov dword [esp + 0xa8], 7
mov dword [esp + 0xa4], 0
mov word [esp + 0x94], ax
jb 0x4014ce
push dword [esp + 0xdc]
call fcn.00402ec3
add esp, 4
cmp dword [esp + 0x78], 8
lea eax, [esp + 0x64]
cmovae eax, dword [esp + 0x64]
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x4c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test esi, esi
jne 0x401546
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
lea eax, [esp + 0xe0]
push 0x41133c
push eax
call fcn.00402180
add esp, 0xc
cmp esi, 0x4c7
je 0x40153f
cmp esi, 6
je 0x40153f
mov esi, 1
jmp 0x401559
mov esi, 0x64
jmp 0x401559
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [esp + 0xc]
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x78], 8
jb 0x401576
push dword [esp + 0x64]
call fcn.00402ec3
add esp, 4
xor eax, eax
cmp dword [esp + 0x60], 8
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], 0
mov word [esp + 0x64], ax
jb 0x4015a0
push dword [esp + 0x4c]
call fcn.00402ec3
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x520]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.00402577
mov esp, ebp
pop ebp
ret