Function at 0x10507be
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xec8
mov eax, dword [0x111121c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
xor ebx, ebx
shr ecx, 0x10
test cx, cx
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xe20], ebx
jne 0x105081a
push 0x400
lea ecx, [ebp - 0xe1c]
push ecx
push eax
push dword [0x1112f58]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1050b3e
lea eax, [ebp - 0xe1c]
mov dword [ebp - 0xe24], eax
push esi
push edi
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x20019
push ebx
push 0x80000000
push 0x1007598
lea ecx, [ebp - 0xec8]
mov dword [ebp - 0xe2c], eax
call fcn.01064103
push 0x1001bc8
lea ecx, [ebp - 0xec8]
call fcn.01064159
mov esi, 0x104
push esi
push dword [ebp - 0xe24]
mov dword [ebp - 0xe28], eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
cmp dword [ebp + 0xc], ebx
pop ecx
jne 0x10509ea
push 0xffffffffffffffff
push 0x1008608
push 0xffffffffffffffff
push dword [ebp - 0xe28]
push 1
push 0x409
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x10509ea
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push 0x1007208
lea eax, [ebp - 0x61c]
push eax
call edi
test eax, eax
jne 0x10509ea
push 0x1007218
lea eax, [ebp - 0x61c]
push eax
call edi
test eax, eax
jne 0x10509ea
mov esi, dword [0x1113528]
lea edi, [esi + 0xe8]
cmp dword [edi], ebx
jne 0x1050919
push edi
push 0x1009b18
push 4
push ebx
push 0x1009ae8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x10509e5
cmp dword [esi + 0x30], ebx
jne 0x105093f
push 0x1004cf8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x30], eax
je 0x105093f
push 0x1007c40
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x34], eax
cmp dword [0x1112e38], 2
jne 0x1050954
mov esi, dword [esi + 0x34]
cmp esi, ebx
je 0x1050954
push ebx
push dword [edi]
call esi
push dword [ebp - 0xe24]
lea ecx, [ebp - 0xe30]
call fcn.01038399
mov esi, dword [ebp - 0xe30]
cmp esi, ebx
mov word [ebp - 0xe40], 3
mov dword [ebp - 0xe38], 1
mov word [ebp - 0xeac], bx
mov word [ebp - 0xe8c], bx
mov word [ebp - 0xe9c], bx
je 0x10509e5
mov edi, dword [edi]
mov eax, dword [edi]
lea ecx, [ebp - 0xe9c]
push ecx
lea ecx, [ebp - 0xe8c]
push ecx
lea ecx, [ebp - 0xeac]
push ecx
lea ecx, [ebp - 0xe40]
push ecx
push esi
push edi
call dword [eax + 0x2c]
test eax, eax
jl 0x10509ca
mov dword [ebp - 0xe20], 1
cmp esi, 0x1111298
je 0x10509d9
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp - 0xe20], ebx
jne 0x1050b1f
mov esi, 0x104
mov ecx, dword [0x1113528]
xor edi, edi
inc edi
push edi
push ebx
push ebx
push dword [ebp - 0xe24]
push ebx
call fcn.0104b05e
push eax
call fcn.01060869
cmp eax, 0x20
jbe 0x1050a18
mov dword [ebp - 0xe20], edi
jmp 0x1050b1f
cmp eax, 2
jne 0x1050b1f
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x1050a3a
mov word [ebp - 0x20c], bx
push esi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1050a53
mov word [ebp - 0x414], bx
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x414]
push eax
call esi
push dword [ebp - 0xe28]
lea ecx, [ebp - 0xe3c]
call fcn.010644d9
lea ecx, [ebp - 0xe3c]
call fcn.01064572
test eax, eax
je 0x1050afc
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0xe7c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x1113528]
mov dword [ebp - 0xe7c], 0x3c
mov dword [ebp - 0xe78], 0x441
call fcn.0104b05e
mov dword [ebp - 0xe74], eax
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0xe3c]
mov dword [ebp - 0xe64], eax
call fcn.01064572
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0xe24]
mov dword [ebp - 0xe6c], eax
lea eax, [ebp - 0xe7c]
push eax
mov dword [ebp - 0xe60], 0xa
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0xe20], eax
jmp 0x1050b02
mov dword [ebp - 0xe20], ebx
cmp word [ebp - 0x20c], bx
je 0x1050b14
lea eax, [ebp - 0x20c]
push eax
call esi
lea ecx, [ebp - 0xe3c]
call fcn.01064519
push dword [ebp - 0xe2c]
call dword [sym.imp.USER32.dll_SetCursor]
lea ecx, [ebp - 0xec8]
call fcn.0106413d
mov eax, dword [ebp - 0xe20]
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0105eca9
leave
ret 8