Function at 0x48abb4
Capabilities:
Create process on windows
Disable system features via registry on windows
Set current directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x5d
push 0
push 0
dec ecx
jne 0x48abbc
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x48bb84
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0x94]
mov edx, dword [edi + 0x314]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ac1c
push 0x48bba0
lea eax, [ebp - 0x10]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0x98]
mov edx, dword [edi + 0x318]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ac62
push 0x48bcac
lea eax, [ebp - 0x20]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x20]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0x9c]
mov edx, dword [edi + 0x31c]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48aca8
push 0x48bcc0
lea eax, [ebp - 0x30]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x30]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xa0]
mov edx, dword [edi + 0x320]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48acee
push 0x48bcd4
lea eax, [ebp - 0x40]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x40]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xa4]
mov edx, dword [edi + 0x324]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ad34
push 0x48bce8
lea eax, [ebp - 0x50]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x50]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xa8]
mov edx, dword [edi + 0x328]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ad7a
push 0x48bd00
lea eax, [ebp - 0x60]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x60]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xac]
mov edx, dword [edi + 0x32c]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48adc0
push 0x48bd14
lea eax, [ebp - 0x70]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x70]
push eax
push 0
mov ecx, 0x48bbb4
mov edx, 0x48bc0c
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xb0]
mov edx, dword [edi + 0x330]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ae06
push 0x48bd28
lea eax, [ebp - 0x80]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x80]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xb4]
mov edx, dword [edi + 0x334]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ae52
push 0x48be34
lea eax, [ebp - 0x90]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x90]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xb8]
mov edx, dword [edi + 0x338]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48ae9e
push 0x48be48
lea eax, [ebp - 0xa0]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0xa0]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xbc]
mov edx, dword [edi + 0x33c]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48aeea
push 0x48be60
lea eax, [ebp - 0xb0]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0xb0]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xc0]
mov edx, dword [edi + 0x340]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48af36
push 0x48be74
lea eax, [ebp - 0xc0]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0xc0]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xc4]
mov edx, dword [edi + 0x344]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48af82
push 0x48be90
lea eax, [ebp - 0xd0]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0xd0]
push eax
push 0
mov ecx, 0x48bd3c
mov edx, 0x48bd94
mov eax, esi
call fcn.00488080
mov esi, dword [edi + 0x3e8]
mov eax, dword [esi + 0xc8]
mov edx, dword [edi + 0x348]
mov bl, byte [edx + 0x218]
cmp al, bl
je 0x48afce
push 0x48beb0
lea eax, [ebp - 0xe0]
xor edx, edx
mov dl, bl
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0xe0]
push eax
push 0
mov ecx, 0x48becc
mov edx, 0x48bf0c
mov eax, esi
call fcn.00488080
lea edx, [ebp - 0xec]
mov eax, dword [edi + 0x350]
call fcn.0044aefc
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xe8]
call fcn.004088f8
mov eax, dword [ebp - 0xe8]
lea edx, [ebp - 0xe4]
call fcn.004086d0
mov eax, dword [ebp - 0xe4]
push eax
lea edx, [ebp - 0xf0]
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xcc]
call fcn.004086d0
mov edx, dword [ebp - 0xf0]
pop eax
call fcn.00404940
je 0x48b082
lea edx, [ebp - 0x104]
mov eax, dword [edi + 0x350]
call fcn.0044aefc
mov edx, dword [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.004142ac
lea eax, [ebp - 0x100]
push eax
push 1
mov edx, 0x48bf0c
lea ecx, [ebp - 0x108]
mov esi, dword [edi + 0x3e8]
mov eax, esi
call fcn.0048815c
mov edx, dword [ebp - 0x108]
mov ecx, 0x48beb0
mov eax, esi
call fcn.0048843c
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xd0]
mov edx, dword [edi + 0x358]
cmp al, byte [edx + 0x218]
je 0x48b0d9
push 0x48bf4c
lea eax, [ebp - 0x118]
mov edx, dword [edi + 0x358]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x118]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xd4]
mov edx, dword [edi + 0x35c]
cmp al, byte [edx + 0x218]
je 0x48b130
push 0x48c054
lea eax, [ebp - 0x128]
mov edx, dword [edi + 0x35c]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x128]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xd8]
mov edx, dword [edi + 0x360]
cmp al, byte [edx + 0x218]
je 0x48b187
push 0x48c064
lea eax, [ebp - 0x138]
mov edx, dword [edi + 0x360]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x138]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
push 0x48c07c
lea eax, [ebp - 0x148]
mov edx, dword [edi + 0x364]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x148]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
push 0x48c090
lea eax, [ebp - 0x158]
mov edx, dword [edi + 0x364]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x158]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
push 0x48c0ac
lea eax, [ebp - 0x168]
mov edx, dword [edi + 0x364]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x168]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
push 0x48c0c4
lea eax, [ebp - 0x178]
mov edx, dword [edi + 0x364]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x178]
push eax
push 0
mov ecx, 0x48c0e0
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xe0]
mov edx, dword [edi + 0x368]
cmp al, byte [edx + 0x218]
je 0x48b2d2
push 0x48c138
lea eax, [ebp - 0x188]
mov edx, dword [edi + 0x368]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x188]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xe4]
mov edx, dword [edi + 0x38c]
cmp al, byte [edx + 0x218]
je 0x48b329
push 0x48c14c
lea eax, [ebp - 0x198]
mov edx, dword [edi + 0x38c]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x198]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xe8]
mov edx, dword [edi + 0x390]
cmp al, byte [edx + 0x218]
je 0x48b380
push 0x48c25c
lea eax, [ebp - 0x1a8]
mov edx, dword [edi + 0x390]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1a8]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xec]
mov edx, dword [edi + 0x394]
cmp al, byte [edx + 0x218]
je 0x48b3d7
push 0x48c27c
lea eax, [ebp - 0x1b8]
mov edx, dword [edi + 0x394]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1b8]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xf0]
mov edx, dword [edi + 0x398]
cmp al, byte [edx + 0x218]
je 0x48b42e
push 0x48c298
lea eax, [ebp - 0x1c8]
mov edx, dword [edi + 0x398]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1c8]
push eax
push 0
mov ecx, 0x48c2b4
mov edx, 0x48c358
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xf4]
mov edx, dword [edi + 0x39c]
cmp al, byte [edx + 0x218]
je 0x48b485
push 0x48c3b4
lea eax, [ebp - 0x1d8]
mov edx, dword [edi + 0x39c]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1d8]
push eax
push 0
mov ecx, 0x48c3d0
mov edx, 0x48c424
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xf8]
mov edx, dword [edi + 0x374]
cmp al, byte [edx + 0x218]
je 0x48b4dc
push 0x48c4c0
lea eax, [ebp - 0x1e8]
mov edx, dword [edi + 0x374]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1e8]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0xfc]
mov edx, dword [edi + 0x370]
cmp al, byte [edx + 0x218]
je 0x48b533
push 0x48c4d8
lea eax, [ebp - 0x1f8]
mov edx, dword [edi + 0x370]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x1f8]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x100]
mov edx, dword [edi + 0x36c]
cmp al, byte [edx + 0x218]
je 0x48b58a
push 0x48c4f0
lea eax, [ebp - 0x208]
mov edx, dword [edi + 0x36c]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x208]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x104]
mov edx, dword [edi + 0x37c]
cmp al, byte [edx + 0x218]
je 0x48b5e1
push 0x48c50c
lea eax, [ebp - 0x218]
mov edx, dword [edi + 0x37c]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x218]
push eax
push 0
mov ecx, 0x48c528
mov edx, 0x48c580
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x108]
mov edx, dword [edi + 0x380]
cmp al, byte [edx + 0x218]
je 0x48b638
push 0x48c620
lea eax, [ebp - 0x228]
mov edx, dword [edi + 0x380]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x228]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x10c]
mov edx, dword [edi + 0x3b0]
cmp al, byte [edx + 0x218]
je 0x48b68f
push 0x48c634
lea eax, [ebp - 0x238]
mov edx, dword [edi + 0x3b0]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x238]
push eax
push 0
mov ecx, 0x48c16c
mov edx, 0x48c1c0
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x110]
mov edx, dword [edi + 0x378]
cmp al, byte [edx + 0x218]
je 0x48b6e6
push 0x48c654
lea eax, [ebp - 0x248]
mov edx, dword [edi + 0x378]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x248]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x114]
mov edx, dword [edi + 0x3a0]
cmp al, byte [edx + 0x218]
je 0x48b73d
push 0x48c66c
lea eax, [ebp - 0x258]
mov edx, dword [edi + 0x3a0]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x258]
push eax
push 0
mov ecx, 0x48c69c
mov edx, 0x48c6f4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x118]
mov edx, dword [edi + 0x3a4]
cmp al, byte [edx + 0x218]
je 0x48b794
push 0x48c794
lea eax, [ebp - 0x268]
mov edx, dword [edi + 0x3a4]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x268]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x11c]
mov edx, dword [edi + 0x3a8]
cmp al, byte [edx + 0x218]
je 0x48b7eb
push 0x48c7a8
lea eax, [ebp - 0x278]
mov edx, dword [edi + 0x3a8]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x278]
push eax
push 0
mov ecx, 0x48c69c
mov edx, 0x48c6f4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x120]
mov edx, dword [edi + 0x3ac]
cmp al, byte [edx + 0x218]
je 0x48b842
push 0x48c7d8
lea eax, [ebp - 0x288]
mov edx, dword [edi + 0x3ac]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x288]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x124]
mov edx, dword [edi + 0x384]
cmp al, byte [edx + 0x218]
je 0x48b899
push 0x48c7ec
lea eax, [ebp - 0x298]
mov edx, dword [edi + 0x384]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x298]
push eax
push 0
mov ecx, 0x48bf5c
mov edx, 0x48bfb4
mov eax, dword [edi + 0x3e8]
call fcn.00488080
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x128]
mov edx, dword [edi + 0x3bc]
cmp al, byte [edx + 0x218]
je 0x48b923
lea eax, [ebp - 0x2a8]
mov edx, dword [edi + 0x3bc]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x2a8]
push eax
push 0
mov ecx, 0x48c804
mov edx, 0x48c824
mov eax, dword [edi + 0x3e8]
call fcn.0048843c
lea eax, [ebp - 0x2b8]
mov edx, dword [edi + 0x3bc]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x2b8]
push eax
push 0
mov ecx, 0x48c804
mov edx, 0x48c87c
mov eax, dword [edi + 0x3e8]
call fcn.0048843c
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x12c]
mov edx, dword [edi + 0x3c0]
cmp al, byte [edx + 0x218]
je 0x48b975
lea eax, [ebp - 0x2c8]
mov edx, dword [edi + 0x3c0]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x2c8]
push eax
push 0
mov ecx, 0x48c91c
mov edx, 0x48c824
mov eax, dword [edi + 0x3e8]
call fcn.0048843c
mov eax, dword [edi + 0x3c8]
cmp byte [eax + 0x218], 0
je 0x48b9a2
mov eax, 0x48c938
call fcn.00408f34
mov eax, 0x48c988
call fcn.00408f34
mov eax, 0x48c9d4
call fcn.00408f34
xor edx, edx
mov eax, edi
call fcn.0048d428
mov edx, 1
mov eax, edi
call fcn.0048d428
push 0xc8
call sub.kernel32.dll_Sleep_1
mov esi, dword [edi + 0x3c4]
cmp byte [esi + 0x218], 0
je 0x48ba96
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x48ba96
push 0x34
push 0x48ca20
push 0x48ca28
mov eax, edi
call fcn.004516e4
push eax
call sub.user32.dll_MessageBoxA_1
cmp eax, 6
jne 0x48ba96
lea edx, [ebp - 0x2d0]
xor eax, eax
call fcn.00402e7c
mov eax, dword [ebp - 0x2d0]
lea edx, [ebp - 0x2cc]
call fcn.00408fd4
lea eax, [ebp - 0x2cc]
mov edx, 0x48ca98
call fcn.004047fc
mov eax, dword [ebp - 0x2cc]
call fcn.004049f4
push eax
call sub.kernel32.dll_SetCurrentDirectoryA
push 1
push 0
push 0
lea edx, [ebp - 0x2d8]
xor eax, eax
call fcn.00402e7c
mov eax, dword [ebp - 0x2d8]
lea edx, [ebp - 0x2d4]
call fcn.00408fd4
lea eax, [ebp - 0x2d4]
mov edx, 0x48caac
call fcn.004047fc
mov eax, dword [ebp - 0x2d4]
call fcn.004049f4
push eax
push 0x48cac4
mov eax, edi
call fcn.004516e4
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, dword [edi + 0x3e8]
mov eax, dword [eax + 0x14c]
mov edx, dword [edi + 0x3e4]
cmp al, byte [edx + 0x218]
je 0x48bae8
lea eax, [ebp - 0x2e8]
mov edx, dword [edi + 0x3e4]
movzx edx, byte [edx + 0x218]
mov cl, 4
call fcn.00414078
lea eax, [ebp - 0x2e8]
push eax
push 0
mov ecx, 0x48cad4
mov edx, 0x48cae8
mov eax, dword [edi + 0x3e8]
call fcn.0048843c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48bb8e
lea eax, [ebp - 0x2e8]
call fcn.0040fc7c
lea eax, [ebp - 0x2d8]
mov edx, 4
call fcn.00404558
lea eax, [ebp - 0x2c8]
mov edx, dword [0x4010e8]
mov ecx, 0x1c
call fcn.00404fec
lea eax, [ebp - 0x108]
call fcn.00404534
lea eax, [ebp - 0x104]
call fcn.00404534
lea eax, [ebp - 0x100]
call fcn.0040fc7c
lea eax, [ebp - 0xf0]
call fcn.00404534
lea eax, [ebp - 0xec]
call fcn.00404534
lea eax, [ebp - 0xe8]
mov edx, 2
call fcn.00404558
lea eax, [ebp - 0xe0]
mov edx, dword [0x4010e8]
mov ecx, 0xe
call fcn.00404fec
ret