Function at 0x461b30
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x380
mov eax, dword [0x5246a8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x104
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
push ebx
mov edi, ecx
mov dword [ebp - 0x284], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x24c], 7
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], cx
lea edx, [eax + 2]
jmp 0x461b90
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x461b90
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x260]
call fcn.00406040
push 1
push 0xffffffffffffffff
push 0x4e9370
lea ecx, [ebp - 0x260]
call fcn.0044e300
cmp eax, 0xffffffff
jne 0x461be4
cmp dword [ebp - 0x24c], 8
jb 0x462064
mov eax, dword [ebp - 0x260]
push eax
jmp 0x46205c
mov ecx, dword [ebp - 0x250]
inc eax
cmp eax, ecx
ja 0x461bff
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x260]
call fcn.00438a10
jmp 0x461c0e
sub eax, ecx
push ebx
push eax
lea ecx, [ebp - 0x260]
call fcn.0040c8a0
push ebx
lea ecx, [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x2dc]
mov dword [ebp - 0x33c], 0x4ed1c8
mov dword [ebp - 0x32c], 0x4e7ab8
mov dword [ebp - 0x2dc], 0x4ed0d4
mov dword [ebp - 0x334], ebx
mov dword [ebp - 0x330], ebx
call fcn.0045fc50
mov edx, dword [ebp - 0x32c]
mov eax, dword [edx + 4]
mov dword [ebp + eax - 0x32c], 0x4ed0d0
mov ecx, dword [ebp - 0x33c]
mov edx, dword [ecx + 4]
mov dword [ebp + edx - 0x33c], 0x4ed0d8
mov eax, dword [ebp - 0x33c]
mov ecx, dword [eax + 4]
mov dword [ebp + ecx - 0x33c], 0x4ed1ac
lea ecx, [ebp - 0x324]
call fcn.0045ef00
mov eax, dword [ebp - 0x32c]
mov edx, dword [edi]
mov dword [ebp - 0x324], 0x4ed14c
mov dword [ebp - 0x2e8], ebx
mov dword [ebp - 0x2e4], ebx
mov eax, dword [eax + 4]
mov ecx, dword [edx + 8]
mov edx, dword [ebp + eax - 0x318]
lea eax, [ebp + eax - 0x32c]
push esi
push 0x4ed1f4
push ecx
and edx, 0xfffff9ff
or edx, 0x800
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 0x32c]
mov eax, dword [eax + 4]
push 0x4ed1d0
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x32c]
lea eax, [ebp + eax - 0x32c]
push 0x4ec7c0
mov edi, 8
or dword [eax + 0x14], edi
push edx
call fcn.0045fcf0
add esp, 8
push eax
call fcn.0045ff50
add esp, 8
push eax
call fcn.0045fcf0
add esp, 8
mov ecx, eax
call fcn.00460720
push eax
call fcn.00460170
add esp, 8
mov ecx, eax
call fcn.00460720
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x324]
call fcn.00461a00
mov eax, dword [ebp - 0x27c]
cmp dword [ebp - 0x268], edi
jae 0x461d61
lea eax, [ebp - 0x27c]
push eax
call fcn.0040c957
add esp, 4
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x268], edi
jb 0x461d87
mov ecx, dword [ebp - 0x27c]
push ecx
call fcn.00406d09
add esp, 4
push 0x40
lea edx, [ebp - 0x37c]
push ebx
push edx
call fcn.004b7180
add esp, 0xc
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x380], 0x44
call fcn.00412cd0
push ebx
xor eax, eax
mov esi, 7
push 0x105
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
call fcn.0040c8a0
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x214], edi
jae 0x461ded
lea eax, [ebp - 0x228]
mov ecx, dword [ebp - 0x218]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
je 0x461ff8
cmp eax, dword [ebp - 0x218]
ja 0x461ff8
push ebx
xor edx, edx
push 0x105
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], dx
call fcn.0040c8a0
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x230], edi
jae 0x461e49
lea eax, [ebp - 0x244]
mov ecx, dword [ebp - 0x234]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x461fcc
cmp eax, dword [ebp - 0x234]
ja 0x461fcc
mov eax, dword [ebp - 0x244]
cmp dword [ebp - 0x230], edi
jae 0x461e7f
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x461ed1
lea ecx, [ebp - 0x244]
call fcn.00409ff0
lea ecx, [ebp - 0x228]
call fcn.00409ff0
lea ecx, [ebp - 0x294]
call fcn.00429650
lea ecx, [ebp - 0x280]
call fcn.0043a840
lea ecx, [ebp - 0x33c]
call fcn.0045f8e0
lea ecx, [ebp - 0x260]
call fcn.00409ff0
jmp 0x462064
mov esi, dword [ebp - 0x244]
cmp dword [ebp - 0x230], edi
jae 0x461ee5
lea esi, [ebp - 0x244]
lea ecx, [ebp - 0x294]
call fcn.00426a60
push eax
mov eax, dword [ebp - 0x280]
lea edx, [ebp - 0x380]
push edx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov eax, dword [ebp - 0x228]
cmp dword [ebp - 0x214], edi
jae 0x461f22
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp esi, ebx
je 0x461e8a
mov ecx, dword [ebp - 0x294]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea edx, [ebp - 0x284]
mov esi, eax
mov eax, dword [ebp - 0x294]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
setne al
cmp esi, 0x102
je 0x461e8a
cmp al, bl
je 0x461f75
cmp dword [ebp - 0x284], ebx
jne 0x461f75
mov bl, 1
lea ecx, [ebp - 0x244]
call fcn.00409ff0
lea ecx, [ebp - 0x228]
call fcn.00409ff0
lea ecx, [ebp - 0x294]
call fcn.00429650
lea ecx, [ebp - 0x280]
call fcn.0043a840
lea ecx, [ebp - 0x33c]
call fcn.0045f8e0
lea ecx, [ebp - 0x260]
call fcn.00409ff0
pop edi
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401306
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x230], edi
jb 0x461fe3
mov ecx, dword [ebp - 0x244]
push ecx
call fcn.00406d09
add esp, 4
xor edx, edx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], dx
cmp dword [ebp - 0x214], edi
jb 0x46200f
mov eax, dword [ebp - 0x228]
push eax
call fcn.00406d09
add esp, 4
xor ecx, ecx
mov word [ebp - 0x228], cx
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], ebx
call fcn.00429650
mov eax, dword [ebp - 0x280]
cmp eax, ebx
je 0x462042
push eax
call fcn.00402cee
add esp, 4
lea ecx, [ebp - 0x33c]
call fcn.0045f8e0
cmp dword [ebp - 0x24c], edi
jb 0x462064
mov edx, dword [ebp - 0x260]
push edx
call fcn.00406d09
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.00401306
mov esp, ebp
pop ebp
ret 4