Function at 0x4dd860
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e7c88
mov eax, dword fs:[0]
push eax
sub esp, 0x3bc
mov eax, dword [0x52d4d0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c4], ecx
mov byte [ebp - 0xd], 0
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x240
call fcn.00405e90
movzx eax, al
cmp eax, 1
jne 0x4dd8dd
push 1
push 0
push 0
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
push str.explore
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xd], 1
jmp 0x4dde49
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
push ecx
lea ecx, [ebp - 0x38]
call fcn.004032b0
mov dword [ebp - 4], 0
push 0x5103e0
lea ecx, [ebp - 0x38]
call fcn.00409260
mov edx, dword [ebp - 0x3c4]
add edx, 0x240
push edx
lea ecx, [ebp - 0x38]
call fcn.00409230
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x39], 0
lea eax, [ebp - 0x14]
push eax
lea esi, [ebp - 0x40]
call fcn.00419a40
add esp, 4
movzx ecx, al
cmp ecx, 1
jne 0x4dd968
cmp dword [ebp - 0x40], 3
je 0x4dd952
cmp dword [ebp - 0x40], 2
je 0x4dd952
cmp dword [ebp - 0x40], 0
je 0x4dd952
cmp dword [ebp - 0x40], 1
jne 0x4dd958
mov byte [ebp - 0x15], 1
jmp 0x4dd968
cmp dword [ebp - 0x40], 8
je 0x4dd964
cmp dword [ebp - 0x40], 9
jne 0x4dd968
mov byte [ebp - 0x39], 1
mov edx, dword [ebp - 0x3c4]
mov eax, dword [edx + 0x27c]
mov dword [ebp - 0x3c8], eax
cmp dword [ebp - 0x3c8], 0
je 0x4dd99e
cmp dword [ebp - 0x3c8], 1
je 0x4ddbaa
cmp dword [ebp - 0x3c8], 2
je 0x4dd99e
jmp 0x4dde36
movzx ecx, byte [ebp - 0x39]
cmp ecx, 1
jne 0x4ddaef
push 0x44
push 0
lea edx, [ebp - 0x9c]
push edx
call fcn.004a7be0
add esp, 0xc
mov dword [ebp - 0x9c], 0x44
push 0x10
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.004a7be0
add esp, 0xc
lea ecx, [ebp - 0x50]
push ecx
lea edx, [ebp - 0x9c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea ecx, [ebp - 0x38]
call fcn.004032f0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4ddae1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x2e4
jne 0x4ddadb
push 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
push 0x5103e4
lea ecx, [ebp - 0x38]
call fcn.004032f0
push eax
push 0x5103e8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x20
jle 0x4dda68
mov byte [ebp - 0xd], 1
jmp 0x4ddad9
cmp dword [ebp - 0xa4], 0x1f
jne 0x4ddac6
mov eax, dword [0x510ad8]
push eax
push 0x5103f4
lea ecx, [ebp - 0x38]
call fcn.00409430
push eax
push 0
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0x38]
call fcn.00409490
push 1
push 0
push 0
lea ecx, [ebp - 0xc0]
call fcn.004032f0
push eax
push 0x5103f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0xc0]
call fcn.004012f0
jmp 0x4ddad9
cmp dword [ebp - 0xa4], 5
jne 0x4ddad5
mov byte [ebp - 0xd], 1
jmp 0x4ddad9
mov byte [ebp - 0xd], 0
jmp 0x4ddadf
mov byte [ebp - 0xd], 0
jmp 0x4ddae5
mov byte [ebp - 0xd], 1
jmp 0x4dde3a
push 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
push 0x510408
lea ecx, [ebp - 0x38]
call fcn.004032f0
push eax
push 0x51040c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x20
jle 0x4ddb33
mov byte [ebp - 0xd], 1
jmp 0x4ddba5
cmp dword [ebp - 0xc4], 0x1f
jne 0x4ddb92
mov edx, dword [0x510ad8]
push edx
push 0x510418
lea ecx, [ebp - 0x38]
call fcn.00409430
push eax
push 0
lea eax, [ebp - 0xe0]
push eax
lea ecx, [ebp - 0x38]
call fcn.00409490
push 1
push 0
push 0
lea ecx, [ebp - 0xe0]
call fcn.004032f0
push eax
push 0x51041c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 0xd], 1
lea ecx, [ebp - 0xe0]
call fcn.004012f0
jmp 0x4ddba5
cmp dword [ebp - 0xc4], 5
jne 0x4ddba1
mov byte [ebp - 0xd], 1
jmp 0x4ddba5
mov byte [ebp - 0xd], 0
jmp 0x4dde3a
lea ecx, [ebp - 0x334]
call fcn.00403280
mov byte [ebp - 4], 1
push 0x104
lea ecx, [ebp - 0x2f4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4ddbe1
push str.c:windows_system32_
lea ecx, [ebp - 0x334]
call fcn.00404ee0
jmp 0x4ddc03
lea edx, [ebp - 0x2f4]
push edx
call fcn.004a5a4a
add esp, 4
push eax
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x334]
call fcn.00401860
push str.msiexec.exe
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x310]
push edx
call fcn.00410310
add esp, 0xc
mov byte [ebp - 4], 2
push str._i__
lea ecx, [ebp - 0x314]
call fcn.004023f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.004032f0
push eax
lea ecx, [ebp - 0x314]
call fcn.00411ac0
push 0x510480
lea ecx, [ebp - 0x314]
call fcn.00411ac0
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x4ddca6
push 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
lea ecx, [ebp - 0x314]
call fcn.00402270
push eax
lea ecx, [ebp - 0x310]
call fcn.004032f0
push eax
push 0x510484
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x318], eax
jmp 0x4ddde5
lea ecx, [ebp - 0x335]
push ecx
call fcn.00419c70
add esp, 4
movzx edx, al
cmp edx, 1
jne 0x4ddd48
movzx eax, byte [ebp - 0x335]
cmp eax, 1
jne 0x4ddd04
push 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
push 0x510490
lea ecx, [ebp - 0x38]
call fcn.004032f0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x318], eax
jmp 0x4ddd43
push 1
mov ecx, dword [ebp - 0x3c4]
add ecx, 0x2a0
call fcn.004032f0
push eax
lea ecx, [ebp - 0x314]
call fcn.00402270
push eax
lea ecx, [ebp - 0x310]
call fcn.004032f0
push eax
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x318], eax
jmp 0x4ddde5
push 0
lea ecx, [ebp - 0x3bc]
call fcn.004e04e0
mov byte [ebp - 4], 4
push 0xa4
lea ecx, [ebp - 0x348]
call fcn.004027c0
push 0x96
lea ecx, [ebp - 0x344]
call fcn.004027c0
mov byte [ebp - 0x340], 1
lea ecx, [ebp - 0x3bc]
call fcn.00488ee0
mov byte [ebp - 0x3bd], 1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3bc]
call fcn.004e04a0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x314]
call fcn.00402e50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x310]
call fcn.004012f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.004012f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004012f0
mov al, byte [ebp - 0x3bd]
jmp 0x4dde4c
cmp dword [ebp - 0x318], 0x20
jle 0x4dddf4
mov byte [ebp - 0xd], 1
jmp 0x4dde07
cmp dword [ebp - 0x318], 5
jne 0x4dde03
mov byte [ebp - 0xd], 1
jmp 0x4dde07
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x314]
call fcn.00402e50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x310]
call fcn.004012f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x334]
call fcn.004012f0
jmp 0x4dde3a
mov byte [ebp - 0xd], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.004012f0
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a58c9
mov esp, ebp
pop ebp
ret 4