Function at 0x442204
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x44220c
push ecx
push ebx
push esi
push edi
mov eax, 0x4420a4
call fcn.00406210
xor eax, eax
push ebp
push 0x44265e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x440554]
call fcn.0044083c
mov dword [0x447900], eax
xor ebx, ebx
push 0x24
push 0x442670
lea edx, [ebp - 0x10]
mov eax, 2
call fcn.00441bd4
mov eax, dword [ebp - 0x10]
call fcn.00403dd8
push eax
push 0
call sub.user32.dll_MessageBoxA_1
sub ax, 6
jne 0x442643
push 0x104
push 0x4477e8
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, 0x4478f0
mov edx, 0x4477e8
mov ecx, 0x105
call fcn.00403bc4
mov eax, dword [0x4478f0]
call fcn.00403c14
mov edx, dword [0x4478f0]
cmp byte [edx + eax - 1], 0x5c
je 0x4422b9
mov eax, 0x4478f0
mov edx, 0x442684
call fcn.00403c1c
mov edx, 0x4478f4
xor eax, eax
call fcn.00402888
lea edx, [ebp - 0x14]
mov eax, dword [0x4478f4]
call fcn.00441e94
mov edx, dword [ebp - 0x14]
mov eax, 0x4478f4
call fcn.004039e8
lea edx, [ebp - 0x18]
mov eax, dword [0x4478f4]
call fcn.00441f10
mov edx, dword [ebp - 0x18]
mov eax, 0x4478f4
call fcn.004039e8
mov dl, 1
mov eax, dword [0x40c580]
call fcn.00402cf4
mov edi, eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00402888
mov eax, dword [ebp - 0x1c]
mov edx, edi
call fcn.00413048
xor ecx, ecx
mov dl, 1
mov eax, dword [0x43ea60]
call fcn.0043ec18
mov esi, eax
mov byte [esi + 0x24], 1
mov byte [esi + 0x25], 1
lea eax, [esi + 0x28]
mov edx, 0x442690
call fcn.004039e8
xor edx, edx
mov eax, edi
call fcn.0040f03c
mov edx, edi
mov eax, esi
call fcn.0043ed80
mov eax, edi
call fcn.0040f430
xor edx, edx
mov eax, edi
call fcn.0040f03c
mov ecx, edi
mov edx, 0x4426a8
mov eax, esi
call fcn.0043ecac
xor edx, edx
mov eax, edi
call fcn.0040f03c
mov dl, 1
mov eax, dword [0x40c580]
call fcn.00402cf4
mov dword [0x4477e0], eax
xor edx, edx
mov eax, dword [0x4477e0]
call fcn.0040f03c
mov ecx, dword [0x4477e0]
mov edx, 0x4426b8
mov eax, esi
call fcn.0043ecac
mov edx, dword [0x4477e0]
mov eax, dword [0x447900]
call fcn.004409a0
mov eax, dword [0x4478f4]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4426c8
mov edx, 0x4426a8
mov eax, dword [0x447900]
call fcn.00440d84
mov edx, dword [ebp - 0x20]
mov eax, 0x4478f4
call fcn.004039e8
mov eax, 0x4477e4
mov edx, dword [0x4478f0]
call fcn.004039e8
mov eax, dword [0x4477e4]
call fcn.00442020
test al, al
je 0x442430
push dword [0x4477e4]
push dword [0x4478f4]
push 0x4426d8
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403cd4
mov edx, dword [ebp - 0x24]
mov eax, edi
call fcn.0040f3ac
mov bl, 1
jmp 0x4424c4
xor eax, eax
mov dword [0x4478f8], eax
lea eax, [ebp - 0x28]
call fcn.00441da4
mov edx, dword [ebp - 0x28]
mov eax, 0x4477e4
call fcn.004039e8
mov eax, dword [0x4477e4]
call fcn.00442020
test al, al
je 0x442484
push dword [0x4477e4]
push dword [0x4478f4]
push 0x4426d8
lea eax, [ebp - 0x2c]
mov edx, 3
call fcn.00403cd4
mov edx, dword [ebp - 0x2c]
mov eax, edi
call fcn.0040f3ac
mov bl, 1
inc dword [0x4478f8]
test bl, bl
jne 0x442497
cmp dword [0x4478f8], 0x64
jle 0x442437
cmp dword [0x4478f8], 0x64
jle 0x4424c4
push 0
push 0x442670
lea edx, [ebp - 0x30]
mov eax, 3
call fcn.00441bd4
mov eax, dword [ebp - 0x30]
call fcn.00403dd8
push eax
push 0
call sub.user32.dll_MessageBoxA_1
test bl, bl
je 0x4425db
mov dl, 1
mov eax, dword [0x413450]
call fcn.004134fc
mov dword [0x4478fc], eax
mov edx, 0x80000002
mov eax, dword [0x4478fc]
call fcn.0041359c
lea eax, [ebp - 0x34]
mov ecx, dword [0x4478f4]
mov edx, 0x4426e8
call fcn.00403c60
mov edx, dword [ebp - 0x34]
mov cl, 1
mov eax, dword [0x4478fc]
call fcn.00413600
mov ecx, dword [0x4478f4]
mov edx, 0x442730
mov eax, dword [0x4478fc]
call fcn.00413724
push dword [0x4477e4]
push 0x442684
push dword [0x4478f4]
push 0x442744
push dword [0x4477e4]
push 0x44275c
push dword [0x4478f4]
push 0x442768
lea eax, [ebp - 0x38]
mov edx, 8
call fcn.00403cd4
mov ecx, dword [ebp - 0x38]
mov edx, 0x442774
mov eax, dword [0x4478fc]
call fcn.00413724
mov eax, dword [0x4478fc]
call fcn.0041356c
mov eax, dword [0x4478fc]
call fcn.00402d24
mov eax, edi
call fcn.0040f430
xor edx, edx
mov eax, edi
call fcn.0040f03c
mov ecx, edi
mov edx, 0x44278c
mov eax, esi
call fcn.0043ecac
push dword [0x4477e4]
push 0x442684
push dword [0x4478f4]
push 0x44279c
lea eax, [ebp - 0x3c]
mov edx, 4
call fcn.00403cd4
mov edx, dword [ebp - 0x3c]
mov eax, edi
call fcn.0040f3ac
mov eax, esi
call fcn.0043ebd8
mov eax, esi
call fcn.00402d24
test bl, bl
je 0x442643
push 0x40
mov eax, dword [0x4478f4]
call fcn.00403dd8
push eax
lea edx, [ebp - 0x40]
mov eax, 4
call fcn.00441bd4
mov eax, dword [ebp - 0x40]
call fcn.00403dd8
push eax
push 0
call sub.user32.dll_MessageBoxA_1
push 5
mov eax, dword [0x4477e4]
call fcn.00403dd8
push eax
push 0x4427a8
lea eax, [ebp - 0x44]
mov ecx, 0x4426d8
mov edx, dword [0x4478f4]
call fcn.00403c60
mov eax, dword [ebp - 0x44]
call fcn.00403dd8
push eax
push 0x4427ac
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x442665
lea eax, [ebp - 0x44]
mov edx, 0xe
call fcn.004039b8
ret