Function at 0x4aad70
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
call fcn.004a2500
test eax, eax
je 0x4aaff8
lea ecx, [esi + 0x1d0]
test ecx, ecx
je 0x4aad9f
lea ecx, [esi + 0x1d4]
jmp 0x4aada1
xor ecx, ecx
mov edx, dword [ecx]
push eax
push edx
lea ecx, [esp + 0x2c]
call fcn.00510f50
mov eax, dword [0x554e0c]
mov ecx, 0x81
mov dword [esp + 0x2c], eax
xor eax, eax
lea edi, [esp + 0x30]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x2c]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [esp + 0x2c]
push edx
call fcn.004f1b70
mov eax, dword [0x547570]
mov ecx, str.tmp_byte_file.txt
add esp, 4
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x4aae48
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x4aae48
push esi
lea ecx, [esp + 0x14]
call fcn.00405530
test eax, eax
je 0x4aae48
mov ecx, dword [esp + 0x10]
lea eax, [esi + 1]
test eax, eax
mov esi, ecx
jne 0x4aae1f
test ecx, ecx
jne 0x4aae3d
push eax
push ecx
push 0xffffffffffffffff
push str.tmp_byte_file.txt
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x4aae3d
mov word [esi + eax*2 - 2], 0
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405bb0
mov edx, dword [0x547570]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], edx
test eax, eax
je 0x4aaeb2
lea ecx, [esp + 0x2c]
shr ecx, 0x10
jne 0x4aae7e
xor edx, edx
lea eax, [esp + 0x2c]
mov dx, ax
lea ecx, [esp + 0x14]
push edx
call fcn.00413ae0
jmp 0x4aaeb2
lea ecx, [esp + 0x2c]
push ecx
call ebp
mov esi, eax
test esi, esi
je 0x4aaeb2
push esi
lea ecx, [esp + 0x18]
call fcn.00405530
test eax, eax
je 0x4aaeb2
mov edi, dword [esp + 0x14]
lea ecx, [esi + esi]
mov edx, ecx
lea esi, [esp + 0x2c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x547570]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax - 8]
mov eax, dword [esp + 0x18]
push ecx
push eax
mov edx, dword [eax - 8]
lea ecx, [esp + 0x28]
push edx
call fcn.004059f0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
call fcn.00405440
lea ecx, [esp + 0x1c]
call fcn.00405700
mov eax, dword [esp + 0x14]
mov edx, dword [0x547574]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4aaf1e
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4aaf1e
mov edx, dword [esp + 0x14]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x10]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4aaf49
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4aaf49
mov edx, dword [esp + 0x10]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
mov eax, dword [esp + 0x18]
push ecx
mov esi, esp
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x4aaf69
mov dword [esi], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4aaf87
mov ecx, dword [0x547570]
mov dword [esi], ecx
mov eax, dword [esp + 0x1c]
test eax, eax
mov edi, eax
je 0x4aaf7e
push eax
call ebp
push edi
push eax
mov ecx, esi
call fcn.00405870
push str.AAAAA
push ecx
mov edx, esp
push 0x8000
push edx
lea ecx, [esp + 0x38]
call fcn.005111f0
call fcn.004421e0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [ecx + 4]
push 1
push 0
push 0
push eax
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 0x18]
mov edx, dword [0x547574]
lea ecx, [eax - 0xc]
cmp ecx, edx
je 0x4aafef
add eax, 0xfffffff4
push eax
call ebx
test eax, eax
jg 0x4aafef
mov edx, dword [esp + 0x18]
add edx, 0xfffffff4
push edx
call fcn.00532222
add esp, 4
lea ecx, [esp + 0x24]
call fcn.00510740
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret