Function at 0x4500f0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x624e70
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x690a1c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x450138
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
lea ecx, [ebp - 0x1c]
call fcn.004086e0
mov dword [ebp - 4], 0
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4504cf
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
mov byte [ebp - 4], 1
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4504d9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push ebx
mov byte [ebp - 4], 2
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
lea ecx, [ebp - 0x28]
call fcn.004086e0
mov byte [ebp - 4], 3
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4504e3
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push str..lnk
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.004090c0
test al, al
jne 0x4501d6
push 4
push str..lnk
lea ecx, [ebp - 0x20]
call fcn.0040b220
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 5
test eax, eax
je 0x4504ed
mov esi, dword [ebp - 0x20]
push eax
push esi
call fcn.005f64cb
add esp, 8
mov byte [ebp - 4], 3
test eax, eax
lea edx, [esi - 0x10]
sete byte [ebp - 0xd]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x450216
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0xd], 0
je 0x4502cb
call fcn.00407410
mov ecx, eax
test ecx, ecx
je 0x4504f7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
mov byte [ebp - 4], 6
jge 0x450262
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00407e30
mov edi, dword [ebp - 0x18]
push 1
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0044d690
push dword [edi - 8]
push edi
call fcn.005e74c3
add esp, 0x1c
test eax, eax
js 0x450501
cmp eax, dword [edi - 8]
jg 0x450501
mov dword [edi - 0xc], eax
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp - 0x1c]
cmp dword [eax - 0xc], ecx
jne 0x4502ad
push ebx
lea ecx, [ebp - 0x1c]
call fcn.0040ba20
mov edx, dword [ebp - 0x20]
mov eax, esi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4502cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi - 0xc], 0
jne 0x450353
test ebx, ebx
jne 0x4502dd
xor ecx, ecx
jmp 0x4502f1
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4502e2
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040b220
mov edi, dword [ebp - 0x18]
mov esi, 1
mov ecx, esi
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x450324
push 0x104
lea ecx, [ebp - 0x18]
call fcn.00407e30
mov edi, dword [ebp - 0x18]
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [edi - 8]
push edi
call fcn.005e74c3
add esp, 8
test eax, eax
js 0x450501
cmp eax, dword [edi - 8]
jg 0x450501
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
jmp 0x450358
mov esi, 1
push ebx
lea ecx, [ebp - 0x14]
call fcn.004086e0
push dword [ebp - 0x14]
xorps xmm0, xmm0
mov byte [ebp - 4], 7
movlpd qword [ebp - 0x60], xmm0
movlpd qword [ebp - 0x58], xmm0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x64], 0x3c
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4503ec
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax - 8]
sub esi, dword [eax - 4]
sub ecx, 0x104
or ecx, esi
jge 0x4503c2
push 0x104
lea ecx, [ebp - 0x14]
call fcn.00407e30
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0x104
jl 0x450501
mov dword [eax - 0xc], 0x104
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov word [eax + 0x208], cx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, str.runas
cmove eax, ecx
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x50], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
mov dword [ebp - 0x20], eax
add edx, 0xfffffff0
mov byte [ebp - 4], 3
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x450447
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x450465
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x450480
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45049b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x4504ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
push 0x80004005
call fcn.00407120
push 0x80070057
call fcn.00407120
int3