Function at 0x404f38
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x404f40
push ebx
push esi
push edi
mov eax, 0x404ee8
call fcn.00404160
xor eax, eax
push ebp
push 0x40550e
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
xor eax, eax
call fcn.004026dc
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
call fcn.00404964
mov edx, dword [ebp - 0x18]
pop eax
call fcn.004034ec
jne 0x404f8a
push 0
call sub.kernel32.dll_ExitProcess_1
lea eax, [ebp - 0x1c]
call fcn.00404610
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
call fcn.00404964
mov edx, dword [ebp - 0x20]
pop eax
call fcn.004034ec
jne 0x404fb0
push 0
call sub.kernel32.dll_ExitProcess_1
mov eax, 0x4079f8
mov edx, 0x405528
call fcn.004032cc
push 0x4079f8
mov ecx, 1
mov edx, 2
mov eax, dword [0x4079f8]
call fcn.004035f8
mov eax, 0x4079f8
mov edx, 0x405534
call fcn.004033a8
lea eax, [ebp - 0x24]
push eax
mov ecx, 1
mov edx, 2
mov eax, 0x405540
call fcn.004035f8
mov edx, dword [ebp - 0x24]
mov eax, 0x4079f8
call fcn.004033a8
mov eax, 0x4079f8
mov edx, 0x40554c
call fcn.004033a8
mov eax, 0x4079f8
mov edx, 0x405558
call fcn.004033a8
mov edx, dword [0x4060e8]
mov edx, dword [edx]
mov eax, dword [0x4079f8]
call fcn.00403638
dec eax
jge 0x405044
call fcn.00403184
mov eax, dword [0x40611c]
mov eax, dword [eax]
call fcn.004035a0
mov edx, eax
mov eax, 0x407650
call fcn.004048fc
mov ebx, eax
mov edx, dword [0x4060fc]
mov edx, dword [edx]
mov eax, 0x4079f4
call fcn.00403680
mov eax, 0x4079f4
call fcn.004035f0
mov edx, eax
mov ecx, dword [0x4060fc]
mov ecx, dword [ecx]
mov eax, ebx
call fcn.004025a0
mov eax, dword [0x4079f4]
call fcn.004033a0
mov esi, eax
test esi, esi
jle 0x4050be
mov ebx, 1
mov eax, 0x4079f4
call fcn.004035f0
mov edx, dword [0x4079f4]
movzx edx, byte [edx + ebx - 1]
dec edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x4050a0
call fcn.00404dc4
call fcn.00404b20
lea eax, [ebp - 0x28]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [0x4079f4]
call fcn.004035f8
mov eax, dword [ebp - 0x28]
call fcn.00404acc
mov edx, dword [0x4060f4]
mov dword [edx], eax
push 0x4079f4
mov ecx, 0x7fffffff
mov edx, 4
mov eax, dword [0x4079f4]
call fcn.004035f8
mov eax, dword [0x4060f4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4060e4]
mov ecx, 1
mov edx, dword [0x40442c]
call fcn.00403d74
add esp, 4
mov eax, dword [0x4060f4]
mov eax, dword [eax]
push eax
mov eax, dword [0x406110]
mov ecx, 1
mov edx, dword [0x40442c]
call fcn.00403d74
add esp, 4
mov eax, dword [0x4060f4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4060dc]
mov ecx, 1
mov edx, dword [0x40442c]
call fcn.00403d74
add esp, 4
mov eax, dword [0x4060f4]
mov eax, dword [eax]
push eax
mov eax, dword [0x406118]
mov ecx, 1
mov edx, dword [0x40440c]
call fcn.00403d74
add esp, 4
mov eax, dword [0x406104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
push 0x105
mov eax, dword [0x40610c]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x2c]
mov edx, dword [0x40610c]
mov ecx, 0x105
call fcn.00403388
mov edx, dword [ebp - 0x2c]
mov eax, dword [0x4060c8]
mov ecx, 0x405564
call fcn.004033ec
push 0x105
mov eax, dword [0x406120]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x30]
mov edx, dword [0x406120]
mov ecx, 0x105
call fcn.00403388
mov edx, dword [ebp - 0x30]
mov eax, dword [0x4060cc]
mov ecx, 0x405564
call fcn.004033ec
lea edx, [ebp - 0x34]
xor eax, eax
call fcn.004026dc
mov edx, dword [ebp - 0x34]
mov eax, 0x405564
call fcn.004047fc
mov ebx, eax
mov eax, dword [0x4060d4]
push eax
lea edx, [ebp - 0x38]
xor eax, eax
call fcn.004026dc
mov eax, dword [ebp - 0x38]
mov ecx, ebx
mov edx, 1
call fcn.004035f8
mov eax, dword [0x4060f4]
mov esi, dword [eax]
add esi, esi
add esi, esi
dec esi
test esi, esi
jl 0x40546b
inc esi
xor ebx, ebx
mov edx, dword [0x4079f4]
mov eax, 0x405570
call fcn.00403638
mov edi, eax
mov eax, dword [0x4060f4]
cmp ebx, dword [eax]
jge 0x40528f
mov eax, dword [0x4060e4]
mov eax, dword [eax]
lea eax, [eax + ebx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f4]
call fcn.004035f8
jmp 0x40544c
mov eax, dword [0x4060f4]
mov eax, dword [eax]
add eax, eax
cmp ebx, eax
jge 0x4053da
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
lea eax, [eax + edx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f4]
call fcn.004035f8
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x40557c
call fcn.004034ec
jne 0x40530d
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x406104]
mov ecx, 0x105
call fcn.00403388
jmp 0x40544c
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x405588
call fcn.004034ec
jne 0x405351
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060cc]
mov edx, dword [edx]
call fcn.004032cc
jmp 0x40544c
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x405594
call fcn.004034ec
jne 0x405395
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060c8]
mov edx, dword [edx]
call fcn.004032cc
jmp 0x40544c
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
mov edx, 0x4055a0
call fcn.004034ec
jne 0x40544c
mov eax, dword [0x4060f4]
mov edx, ebx
sub edx, dword [eax]
mov eax, dword [0x406110]
mov eax, dword [eax]
lea eax, [eax + edx*4]
mov edx, dword [0x4060d4]
mov edx, dword [edx]
call fcn.004032cc
jmp 0x40544c
mov eax, dword [0x4060f4]
mov eax, dword [eax]
lea eax, [eax + eax*2]
cmp ebx, eax
jge 0x405414
mov eax, dword [0x4060f4]
mov eax, dword [eax]
add eax, eax
mov edx, ebx
sub edx, eax
mov eax, dword [0x4060dc]
mov eax, dword [eax]
lea eax, [eax + edx*4]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f4]
call fcn.004035f8
jmp 0x40544c
lea eax, [ebp - 0x3c]
push eax
mov ecx, edi
dec ecx
mov edx, 1
mov eax, dword [0x4079f4]
call fcn.004035f8
mov eax, dword [ebp - 0x3c]
call fcn.00404acc
mov edx, dword [0x4060f4]
mov edx, dword [edx]
lea edx, [edx + edx*2]
mov ecx, ebx
sub ecx, edx
mov edx, dword [0x406118]
mov edx, dword [edx]
mov dword [edx + ecx*4], eax
push 0x4079f4
lea edx, [edi + 1]
mov ecx, 0x7fffffff
mov eax, dword [0x4079f4]
call fcn.004035f8
inc ebx
dec esi
jne 0x405252
mov esi, dword [0x4060f4]
mov esi, dword [esi]
test esi, esi
jle 0x40548c
mov ebx, 1
mov edx, ebx
mov eax, dword [0x407650]
call fcn.00404510
inc ebx
dec esi
jne 0x40547c
mov esi, dword [0x4060f4]
mov esi, dword [esi]
dec esi
test esi, esi
jl 0x4054f3
inc esi
xor ebx, ebx
mov eax, dword [0x4060dc]
mov eax, dword [eax]
mov eax, dword [eax + ebx*4]
mov edx, 0x405588
call fcn.004034ec
jne 0x4054ef
push 1
push 0x4055a4
push 0x4055a4
mov eax, dword [0x4060e4]
mov eax, dword [eax]
mov ecx, dword [eax + ebx*4]
mov eax, dword [0x406110]
mov eax, dword [eax]
mov edx, dword [eax + ebx*4]
lea eax, [ebp - 0x40]
call fcn.004033ec
mov eax, dword [ebp - 0x40]
call fcn.004035a0
push eax
push 0x4055a8
push 0
call sub.shell32.dll_ShellExecuteA
inc ebx
dec esi
jne 0x40549c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405515
lea eax, [ebp - 0x40]
mov edx, 0xc
call fcn.0040329c
ret