Function at 0x448f2c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x448f35
mov eax, dword [ebp - 4]
add esp, 0xfffff13c
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], al
mov edi, 0x4ae7ec
mov eax, 0x49de6c
call fcn.0048dbf8
test esi, esi
jne 0x448fb1
mov eax, 0x4b9834
call fcn.00463710
test eax, eax
jne 0x448fb1
push 0x30
mov eax, 0x65
call fcn.004116e0
push eax
mov eax, 0x14c
call fcn.004116e0
push eax
push dword [0x4b9820]
call sub.USER32.DLL_MessageBoxA
mov edx, dword [ebp - 0x22c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x449821
xor eax, eax
call fcn.004529e0
mov dword [0x4bcb08], 0
mov dword [0x4bcb0c], 0
mov dword [0x4bcb00], 0
mov dword [0x4bcb04], 0
call fcn.0044a3d0
mov dword [ebp - 0x234], eax
mov word [ebp - 0x21c], 8
lea eax, [ebp - 0x110]
call fcn.00464d88
add dword [ebp - 0x210], 6
mov word [ebp - 0x21c], 0x14
mov word [ebp - 0x21c], 0x20
lea eax, [ebp - 0x208]
call fcn.0040ee04
add dword [ebp - 0x210], 4
mov word [ebp - 0x21c], 0x14
test esi, esi
sete dl
and edx, 1
mov byte [ebp - 0x235], dl
mov word [ebp - 0x21c], 0x2c
cmp byte [ebp - 0x235], 0
je 0x44909b
lea esi, [ebp - 0x208]
mov eax, 0x4b9834
xor ecx, ecx
xor edx, edx
call fcn.004635f8
jmp 0x44907c
lea ecx, [ebp - 0xa78]
lea edx, [ebp - 0xe78]
mov eax, esi
call fcn.0040efd4
lea edx, [ebp - 0xe78]
mov eax, 0x4b9834
xor ecx, ecx
call fcn.004635f8
test al, al
je 0x44909b
cmp dword [0x4bc1b4], 0
je 0x449069
mov word [ebp - 0x21c], 0x14
jmp 0x44911f
call fcn.0044a3d0
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x21c], 0x14
test esi, esi
je 0x449141
cmp dword [ebp + 0x14], 0
je 0x449141
xor ebx, ebx
jmp 0x449146
mov ebx, 1
push 1
push ebx
push 0
push 1
lea ecx, [ebp - 0x110]
mov edx, 2
mov eax, esi
call fcn.00468854
and eax, 0xff
cmp eax, 1
sbb edx, edx
neg edx
mov ebx, edx
test bl, bl
jne 0x4491e2
cmp dword [ebp - 0xc], 0
jne 0x4491e2
cmp dword [esi + 0x30], 1
jne 0x4491e2
mov eax, esi
call fcn.0040f194
lea ecx, [ebp - 0x244]
lea edx, [ebp - 0x240]
mov eax, esi
call fcn.0040f124
test al, al
je 0x4491e2
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.0040a4fc
call fcn.0040a240
test al, al
jne 0x4491e2
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.00468a24
lea eax, [ebp - 0x110]
call fcn.0046517c
mov esi, dword [ebp - 0xc]
test bl, bl
jne 0x4491fb
test esi, esi
jne 0x449294
cmp dword [ebp + 0x10], 0
jne 0x449294
test bl, bl
jne 0x44922f
call fcn.0044a3d0
cmp eax, dword [ebp - 0x23c]
jne 0x44922f
push 0x30
mov eax, 0x35f
call fcn.004116e0
push eax
mov eax, 0x35e
call fcn.004116e0
push eax
push dword [0x4b9820]
call sub.USER32.DLL_MessageBoxA
mov eax, 0x4b9d8c
xor edx, edx
call fcn.004453ac
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef20
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00439274
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef20
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x449821
mov al, byte [ebp - 0x22e]
mov byte [edi + 0x21b6], al
xor edx, edx
mov dword [edi + 0x215c], edx
xor ecx, ecx
mov dword [edi + 0x2188], ecx
mov dword [edi + 0x2678], 1
call fcn.0043e40a
cmp byte [ebp - 0x22e], 0
mov byte [0x4be9b8], 0
jne 0x449411
mov byte [ebp - 0x245], 0
cmp esi, 1
jne 0x449359
lea ecx, [ebp - 0x1aa8]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.004650b0
lea ebx, [ebp - 0x1aa8]
push 1
push 0
lea ecx, [ebp - 0x3308]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.004650b0
lea eax, [ebp - 0x3308]
lea ecx, [ebp - 0x26d8]
add eax, 0x400
xor edx, edx
push eax
lea eax, [ebp - 0x110]
call fcn.004650b0
lea edx, [ebp - 0x26d8]
mov eax, 0x4ba564
pop ecx
call fcn.0045bbc8
mov eax, 0x4ba564
call fcn.0045d128
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 0x245], dl
jmp 0x449377
lea ecx, [ebp - 0x3708]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x3708]
call fcn.0040b578
mov ebx, eax
cmp byte [ebx], 0
jne 0x449381
mov ebx, 0x49cd57
mov al, byte [ebp - 0x22d]
push eax
mov eax, 0x4be9b8
mov dl, byte [ebp - 0x245]
push edx
mov edx, 0x49c9d5
mov cl, byte [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.0044982c
cmp byte [ebp - 0x22d], 0
je 0x449411
mov eax, esi
call fcn.0043e2fb
test al, al
jne 0x449411
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef20
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00439274
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef20
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x449821
cmp dword [ebp + 0x10], 0
je 0x449427
push 0x4be9b8
push dword [ebp + 0x10]
call fcn.0048d758
add esp, 8
test esi, esi
jne 0x449484
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef20
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00439274
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef20
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x449821
mov dword [0x4bcafc], esi
cmp dword [0x4bc1ac], 0
jne 0x44949d
mov dword [0x4bc1ac], 2
xor ebx, ebx
jmp 0x4496bc
mov eax, dword [edi + 0x4ae4]
call fcn.0040ef9c
mov eax, dword [edi + 0x4ad8]
call fcn.0040ef9c
mov byte [ebp - 0x3b08], 0
cmp dword [ebp + 0x14], 0
je 0x4494da
lea edx, [ebp - 0x3b08]
mov ecx, 0x400
mov eax, dword [ebp + 0x14]
call fcn.0040f050
cmp byte [ebp - 0x3b08], 0
je 0x4494eb
lea edx, [ebp - 0x3b08]
jmp 0x4494f0
mov edx, 0x49cb51
mov eax, dword [edi + 0x4ad8]
call fcn.0040efcc
lea ecx, [ebp - 0x4738]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650b0
lea eax, [ebp - 0x4738]
lea edx, [edi + 0x3ed8]
call fcn.0040a568
lea ecx, [ebp - 0x5368]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650b0
lea eax, [ebp - 0x5368]
lea edx, [edi + 0x42d8]
add eax, 0x400
call fcn.0040a5b0
mov byte [ebp - 0x5768], 0
cmp byte [0x4be9b8], 0
je 0x4495c4
cmp dword [edi + 0x20c0], 5
je 0x4495c4
push 0x4be9b8
lea ecx, [ebp - 0x5b68]
push ecx
call fcn.0048d758
add esp, 8
lea eax, [ebp - 0x5768]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x5b68]
xor ecx, ecx
xor edx, edx
call fcn.00409c94
lea eax, [ebp - 0x5b68]
push eax
call fcn.0048f15c
pop ecx
inc eax
jne 0x4495c4
lea edx, [ebp - 0x5b68]
mov eax, 0x1f7
push edx
call fcn.004116e0
push eax
call fcn.0044a170
add esp, 8
jmp 0x4496cd
lea eax, [edi + 0x3ed8]
call fcn.0040b578
push eax
cmp byte [edi + 0x21b6], 0
je 0x4495e0
mov eax, 0x20b
jmp 0x4495e5
mov eax, 0x20a
call fcn.004116e0
push eax
lea edx, [ebp - 0x6168]
push edx
call fcn.00490628
add esp, 0xc
lea eax, [ebp - 0x6168]
call fcn.00477864
call fcn.00476dec
push 1
push 0
lea ecx, [edi + 0x42d8]
lea edx, [edi + 0x3ed8]
mov eax, 0x4ba564
call fcn.0045bbc8
mov edx, dword [0x4ba76c]
xor ecx, ecx
mov dword [edi + 0x2a90], edx
xor edx, edx
mov eax, 0x4ba564
call fcn.00458638
cmp byte [ebp - 0x5768], 0
je 0x449654
lea eax, [ebp - 0x5768]
push eax
call fcn.0048f15c
pop ecx
lea edx, [ebx + 1]
push edx
push dword [ebp - 0xc]
mov eax, 0x35d
call fcn.004116e0
push eax
lea edx, [ebp - 0x6268]
push edx
call fcn.00490628
add esp, 0x10
lea edx, [ebp - 0x6268]
mov eax, 0x4b9d8c
call fcn.004453ac
lea ecx, [ebp - 0x6e98]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650b0
lea ecx, [ebp - 0x6e98]
mov eax, dword [ecx + 0xc00]
mov edx, dword [ecx + 0xc04]
add dword [0x4bcb00], eax
adc dword [0x4bcb04], edx
call fcn.00477b70
inc ebx
cmp esi, ebx
jle 0x4496cd
cmp dword [0x4bc1b4], 0
je 0x4494a4
cmp dword [0x4bc1ac], 2
jne 0x4496dd
xor eax, eax
mov dword [0x4bc1ac], eax
cmp byte [ebp + 8], 0
je 0x4496ee
push dword [0x4b982c]
call sub.USER32.DLL_DestroyWindow
mov eax, 0x4b9d8c
xor edx, edx
call fcn.004453ac
mov byte [0x4b9db8], 0
mov eax, 0x4b9d8c
call fcn.0044546c
cmp byte [ebp - 0x22e], 0
je 0x449757
cmp dword [0x4bc1b8], 0
jne 0x4497cd
call fcn.0044a3d0
cmp eax, dword [ebp - 0x234]
jne 0x4497cd
push 0x40
mov eax, 0x3a7
call fcn.004116e0
push eax
mov eax, 0x3a8
call fcn.004116e0
push eax
push dword [0x4b9820]
call sub.USER32.DLL_MessageBoxA
jmp 0x4497cd
cmp byte [ebp - 0x235], 0
je 0x4497cd
cmp dword [0x4bc1b8], 0
jne 0x44978c
cmp byte [0x4bedbd], 0
je 0x44978c
push 1
push 0x49c9d5
push 0
push 0x4be9b8
push 0x49d43e
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov byte [ebp - 0x7298], 0
lea edx, [ebp - 0x7ec8]
mov eax, 0x4b9834
call fcn.004637bc
test al, al
je 0x4497bd
lea edx, [ebp - 0x7ec8]
push edx
lea ecx, [ebp - 0x7298]
push ecx
call fcn.0048d758
add esp, 8
lea edx, [ebp - 0x7298]
mov eax, 0x4b9834
call fcn.0045e1dc
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040ef20
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00439274
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040ef20
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10