Function at 0x439ca0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564d42
mov eax, dword fs:[0]
push eax
mov eax, 0x63b8
call fcn.00528110
mov eax, dword [0x5c5ebc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x63bc], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x63c0], eax
cmp dword [ebp - 0x63c0], 0x3e9
ja 0x439d2d
cmp dword [ebp - 0x63c0], 0x3e9
je 0x439e86
mov ecx, dword [ebp - 0x63c0]
sub ecx, 0x8e
mov dword [ebp - 0x63c0], ecx
cmp dword [ebp - 0x63c0], 0x64
ja case.0x439d26.2
mov edx, dword [ebp - 0x63c0]
movzx eax, byte [edx + 0x43a10c]
jmp dword [eax*4 + 0x43a0f4]
cmp dword [ebp - 0x63c0], 0x4be
ja 0x439d6a
cmp dword [ebp - 0x63c0], 0x4be
je 0x439d8f
cmp dword [ebp - 0x63c0], 0x3f2
je 0x439ee8
cmp dword [ebp - 0x63c0], 0x3fe
je 0x439efd
jmp case.0x439d26.2
cmp dword [ebp - 0x63c0], 0x800d
je 0x43a047
cmp dword [ebp - 0x63c0], 0x800e
je 0x43a090
jmp case.0x439d26.2
call fcn.004382f0
test eax, eax
jne 0x439da2
mov eax, 1
jmp 0x43a0d8
xor ecx, ecx
mov word [ebp - 0x201c], cx
push 0x2000
push 0
lea edx, [ebp - 0x201a]
push edx
call fcn.005281f0
add esp, 0xc
push 0x5785e8
push str._s_v
lea eax, [ebp - 0x201c]
push eax
call fcn.00527b98
add esp, 0xc
cmp dword [0x5cd184], 0
je 0x439e30
lea ecx, [ebp - 0x201c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
movzx edx, ax
push edx
mov eax, dword [ebp - 0x63bc]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UnregisterHotKey]
mov edx, dword [0x5cd180]
push edx
push 3
lea eax, [ebp - 0x201c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx ecx, ax
push ecx
mov edx, dword [ebp - 0x63bc]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.USER32.dll_RegisterHotKey]
jmp 0x439e51
lea ecx, [ebp - 0x201c]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
movzx edx, ax
push edx
mov eax, dword [ebp - 0x63bc]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UnregisterHotKey]
push 0
push 0x4be
mov ecx, dword [ebp - 0x63bc]
add ecx, 0x18d0
call fcn.0043b4d0
push 1
push 0x3e9
mov ecx, dword [ebp - 0x63bc]
add ecx, 0x18d0
call fcn.0043b4d0
jmp case.0x439d26.2
call fcn.004382f0
test eax, eax
jne 0x439e99
mov eax, 1
jmp 0x43a0d8
push 0
push 0
push 0x806b
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 1
push 0x4be
mov ecx, dword [ebp - 0x63bc]
add ecx, 0x18d0
call fcn.0043b4d0
push 0
push 0x3e9
mov ecx, dword [ebp - 0x63bc]
add ecx, 0x18d0
call fcn.0043b4d0
mov eax, 1
jmp 0x43a0d8
mov ecx, dword [ebp - 0x63bc]
call fcn.00438f30
mov eax, 1
jmp 0x43a0d8
mov ecx, dword [ebp - 0x63bc]
call fcn.00439870
mov eax, 1
jmp 0x43a0d8
lea ecx, [ebp - 0x2194]
call fcn.004362d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2194]
call fcn.004df976
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2194]
call fcn.0043a360
mov eax, 1
jmp 0x43a0d8
push 0
push 0
push 0x4cc
mov ecx, dword [ebp - 0x63bc]
call fcn.0043b070
mov eax, 1
jmp 0x43a0d8
call fcn.004382f0
test eax, eax
jne 0x439f7c
mov eax, 1
jmp 0x43a0d8
push 1
mov ecx, dword [ebp - 0x63bc]
call fcn.004384c0
mov eax, 1
jmp 0x43a0d8
mov dword [0x5cd150], 0
push 2
mov ecx, dword [ebp - 0x63bc]
call fcn.004e72f5
mov eax, 1
jmp 0x43a0d8
xor edx, edx
mov word [ebp - 0x23a4], dx
push 0x208
push 0
lea eax, [ebp - 0x23a2]
push eax
call fcn.005281f0
add esp, 0xc
lea ecx, [ebp - 0x63b8]
push ecx
call fcn.0042d9b0
add esp, 4
mov dword [ebp - 0x63c4], eax
mov edx, dword [ebp - 0x63c4]
mov eax, dword [edx]
push eax
push str._sLanguageccproxy.pdf
lea ecx, [ebp - 0x23a4]
push ecx
call fcn.00527b98
add esp, 0xc
lea ecx, [ebp - 0x63b8]
call fcn.00415e20
lea edx, [ebp - 0x23a4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43a045
push 5
push 0
push 0
lea eax, [ebp - 0x23a4]
push eax
push 0x578634
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
jmp 0x43a0d8
jmp case.0x439d26.2
xor ecx, ecx
mov word [ebp - 0x43ac], cx
push 0x2000
push 0
lea edx, [ebp - 0x43aa]
push edx
call fcn.005281f0
add esp, 0xc
lea eax, [ebp - 0x43ac]
push eax
push 0x5cb910
push 0x5cb110
push 0x578640
push 0x5ca910
call fcn.0045ef00
add esp, 0x14
mov eax, 1
jmp 0x43a0d8
xor ecx, ecx
mov word [ebp - 0x63b4], cx
push 0x2000
push 0
lea edx, [ebp - 0x63b2]
push edx
call fcn.005281f0
add esp, 0xc
lea eax, [ebp - 0x63b4]
push eax
call fcn.0045ed20
add esp, 4
mov eax, 1
jmp 0x43a0d8
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x63bc]
call fcn.00497940
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00527aad
mov esp, ebp
pop ebp
ret 8