Function at 0x539f34
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd50
push ebx
xor ebx, ebx
mov dword [ebp - 0x2b0], ebx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2a8], ebx
mov dword [ebp - 0x2a4], ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x294], ebx
mov byte [ebp - 1], cl
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
call fcn.00405fd0
lea eax, [ebp - 0xc]
call fcn.00405fd0
xor eax, eax
push ebp
push 0x53a25e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00405d3c
je 0x53a223
lea edx, [ebp - 0x294]
mov eax, dword [ebp - 8]
call fcn.0049a550
mov edx, dword [ebp - 0x294]
lea eax, [ebp - 8]
call fcn.00405a1c
lea edx, [ebp - 0x298]
mov eax, dword [ebp - 0xc]
call fcn.0049a550
mov edx, dword [ebp - 0x298]
lea eax, [ebp - 0xc]
call fcn.00405a1c
lea eax, [ebp - 0x29c]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405dc0
mov eax, dword [ebp - 0x29c]
mov edx, 0x53a270
call fcn.00405d3c
je 0x53a060
lea eax, [ebp - 0x2a0]
push eax
mov ecx, 8
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405dc0
mov eax, dword [ebp - 0x2a0]
mov edx, 0x53a284
call fcn.00405d3c
je 0x53a060
lea eax, [ebp - 0x2a4]
push eax
mov ecx, 6
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.00405dc0
mov eax, dword [ebp - 0x2a4]
mov edx, 0x53a29c
call fcn.00405d3c
jne 0x53a076
mov eax, dword [0x563384]
cmp dword [eax], 4
jg 0x53a076
push ebp
call fcn.00539e70
pop ecx
jmp 0x53a223
mov eax, dword [0x5631b4]
cmp byte [eax], 0
je 0x53a157
lea eax, [ebp - 0x84]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
mov dword [ebp - 0x84], 0x3c
mov dword [ebp - 0x80], 0x40
mov eax, 0x53a2ac
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 8]
call fcn.00405c10
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0xc]
call fcn.00405c10
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x28e]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
lea eax, [ebp - 0x28e]
mov dword [ebp - 0x6c], eax
cmp byte [ebp - 1], 0
je 0x53a0ee
mov dword [ebp - 0x68], 3
jmp 0x53a0f5
mov dword [ebp - 0x68], 1
or eax, 0xffffffff
call fcn.00403a58
mov dword [ebp - 0x7c], eax
mov ebx, dword [ebp - 0x7c]
test ebx, ebx
jbe 0x53a0f5
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x53a0f5
cmp dword [0x562e90], 0
je 0x53a223
lea eax, [ebp - 0x84]
push eax
call dword [0x562e90]
test eax, eax
je 0x53a223
cmp byte [ebp + 8], 0
je 0x53a223
cmp dword [ebp - 0x4c], 0
je 0x53a223
push 0xffffffffffffffff
mov eax, dword [ebp - 0x4c]
push eax
call sub.kernel32.dll_WaitForSingleObject
jmp 0x53a223
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00403a38
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x40
mov eax, 0x53a2b8
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x2a8]
mov edx, dword [ebp - 8]
call fcn.004054fc
mov eax, dword [ebp - 0x2a8]
call fcn.00405734
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x2ac]
mov edx, dword [ebp - 0xc]
call fcn.004054fc
mov eax, dword [ebp - 0x2ac]
call fcn.00405734
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2b0]
call fcn.0040d900
mov eax, dword [ebp - 0x2b0]
call fcn.00405734
mov dword [ebp - 0x30], eax
cmp byte [ebp - 1], 0
je 0x53a1dc
mov dword [ebp - 0x2c], 3
jmp 0x53a1e3
mov dword [ebp - 0x2c], 1
or eax, 0xffffffff
call fcn.00403a58
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
jbe 0x53a1e3
push ebx
call sub.user32.dll_IsWindow
test eax, eax
jne 0x53a1e3
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x53a223
cmp byte [ebp + 8], 0
je 0x53a223
cmp dword [ebp - 0x10], 0
je 0x53a223
push 0xffffffffffffffff
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53a265
lea eax, [ebp - 0x2b0]
mov edx, 3
call fcn.00405288
lea eax, [ebp - 0x2a4]
mov edx, 5
call fcn.004059d4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004059d4
ret