Function at 0x45c341
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a3350
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x4d6674]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.004019f2
xor esi, esi
mov dword [esp + 0xc0], esi
push 0x3c
mov eax, SysReAllocString
pop ebx
push ebx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
xor edi, edi
lea eax, [esp + 0x34]
push esi
inc edi
push eax
mov dword [esp + 0x78], 0x44
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], edi
mov word [esp + 0xa8], 0xa
mov word [esp + 0xaa], si
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
call fcn.004887d0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], 0x440
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], str.runas
mov dword [esp + 0x60], edi
call fcn.0045f6f7
add esp, 0x14
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov byte [esp + 0xc0], 1
call fcn.004609f5
test eax, eax
jne 0x45c78f
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0046277b
pop ecx
pop ecx
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 2
call fcn.0040189c
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
mov edi, str._WINDIR_
push edi
push ebx
call fcn.004605b8
test eax, eax
pop ecx
pop ecx
je 0x45c526
call fcn.0046df20
push eax
lea ecx, [esp + 0x20]
call fcn.0046e14b
mov eax, 0x104
push eax
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xc8], 3
call fcn.0040177d
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00403370
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push edi
push ebx
push eax
call fcn.004622e2
add esp, 0x10
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 4
call fcn.0040189c
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
push 0x4b63e4
push 0x4badd8
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.004622e2
add esp, 0x10
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 5
call fcn.0040189c
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
lea ecx, [esp + 0x10]
call fcn.004609f5
test eax, eax
je 0x45c612
cmp dword [ebp + 0x10], esi
je 0x45c5cd
mov eax, dword [ebx]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x45c5cd
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0040174a
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.0040177d
mov edi, eax
mov eax, dword [ebx]
push dword [eax - 0xc]
mov ecx, ebx
call fcn.0040177d
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
push esi
push 0x20
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x45c7f5
mov esi, dword [esp + 0x20]
jmp 0x45c59d
mov edi, 0x4b72f0
lea eax, [esp + 0x10]
push edi
push eax
call fcn.0046050f
test eax, eax
pop ecx
pop ecx
jne 0x45c694
push edi
lea edi, [esp + 0x14]
call fcn.0046038c
test eax, eax
pop ecx
jne 0x45c694
mov edi, 0x4b72f0
lea eax, [esp + 0x1c]
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.00404da1
push edi
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xd4], 6
call fcn.0040145d
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 7
call fcn.0040189c
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [esp + 0x18]
push 0x4b606c
push eax
mov ecx, ebx
call fcn.00404da1
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 8
call fcn.0040157b
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
cmp dword [ebp + 0x10], esi
je 0x45c6f9
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45c599
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.0040177d
mov edi, eax
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.0040177d
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push esi
push 0x20
push esi
push esi
push esi
push esi
push eax
call edi
test eax, eax
jne 0x45c60c
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.0040177d
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
mov ecx, ebx
call fcn.0040177d
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
push dword [eax - 0xc]
call fcn.0040177d
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push dword [esp + 0x20]
push esi
push 0x20
push esi
push esi
push esi
push dword [esp + 0x3c]
push eax
call edi
jmp 0x45c604
cmp dword [ebp + 0x10], esi
je 0x45c7bb
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45c599
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.0040177d
mov edi, eax
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.0040177d
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
push esi
push 0x20
push esi
push esi
push esi
push esi
push eax
jmp 0x45c5fe
mov ecx, ebx
call fcn.004609f5
test eax, eax
jne 0x45c59d
lea eax, [esp + 0x18]
push 0x4b578c
push eax
call fcn.00461468
push dword [ebp + 0x10]
mov byte [esp + 0xcc], 9
push eax
push dword [ebp + 8]
call fcn.0045c341
mov ecx, dword [esp + 0x2c]
add esp, 0x14
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040174a
jmp 0x45c59d