Function at 0x405530
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4bac44
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x4ce028]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push esi
push edi
mov eax, dword [0x4ce028]
xor eax, esp
push eax
lea eax, [esp + 0x238]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
lea ecx, [esp + 0x20]
call dword [0x4bd7a8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x240], 0
call dword [0x4bd7a8]
lea ecx, [esp + 0x28]
call dword [0x4bd7a8]
lea ecx, [esp + 0x14]
call dword [0x4bd7a8]
mov ebx, 3
mov byte [esp + 0x240], bl
cmp esi, 1
jne 0x4055b9
push 0x4bee58
jmp 0x4055e1
cmp esi, 2
jne 0x4055c5
push 0x4bee64
jmp 0x4055e1
cmp esi, ebx
jne 0x4055d0
push 0x4bee70
jmp 0x4055e1
cmp esi, 4
jne 0x4055dc
push 0x4bee7c
jmp 0x4055e1
push 0x4bee88
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_2]
push 0
push 0
lea eax, [esp + 0x34]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp edi, 0x3e8
mov esi, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x20]
jge 0x40562e
push edi
push ecx
push 0x4beea0
push edx
call esi
push edi
lea eax, [esp + 0x30]
push 0x4beec8
push eax
call esi
add esp, 0x1c
jmp 0x405649
push ecx
push str._s__.lnk
push edx
call esi
add esp, 0xc
lea eax, [esp + 0x1c]
push 0x4bef10
push eax
call esi
add esp, 8
lea ecx, [esp + 0x18]
call fcn.00404270
mov byte [esp + 0x240], 4
mov ecx, dword [eax]
push str.KcLepExam.exe
push ecx
lea edx, [esp + 0x30]
push 0x4bdb98
push edx
call esi
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], bl
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
lea ecx, [esp + 0x20]
mov edi, eax
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
lea ecx, [esp + 0x28]
mov ebx, eax
call dword [sym.imp.mfc90u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov ecx, eax
call fcn.00405790
lea ecx, [esp + 0x24]
call dword [0x4bd7a8]
mov bl, 5
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], bl
call fcn.00404270
mov byte [esp + 0x240], 6
mov eax, dword [eax]
push str.KcLepExam.exe
push eax
lea ecx, [esp + 0x2c]
push 0x4bdb98
push ecx
call esi
add esp, 0x10
lea ecx, [esp + 0x18]
mov byte [esp + 0x240], bl
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push 1
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
lea eax, [esp + 0x20]
push eax
call fcn.00402790
mov ecx, dword [eax]
add esp, 8
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_char_class_StrTraitMFC_DLL_char_class_ATL::ChTraitsCRT_char_____::CStringT_char_class_StrTraitMF]
lea ecx, [esp + 0x24]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x28]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, 1
mov ecx, dword [esp + 0x238]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0042bebe
add esp, 0x234
ret