Function at 0x435bd1
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
push 0x44
pop edi
push edi
mov esi, eax
xor ebx, ebx
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.00456db0
xor eax, eax
inc eax
mov dword [esp + 0x7c], edi
add esp, 0xc
xor edi, edi
mov dword [esp + 0x9c], eax
mov word [esp + 0xa0], ax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
cmp byte [ebp + 0x10], bl
je 0x435c55
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
call fcn.00412c4e
cmp dword [esi + 8], 7
mov dword [esp + 0x5c], eax
jbe 0x435c87
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
call fcn.00412c4e
mov edi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
jmp 0x435c6e
cmp dword [esi + 8], 3
jbe 0x435c9a
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
call fcn.00412c4e
mov edi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
and edi, 0xffff0000
call fcn.00412c4e
and eax, 0xffff
mov dword [esp + 0x2c], eax
cmp byte [ebp + 0x10], bl
je 0x435c9a
cmp dword [esi + 8], 6
jbe 0x435c95
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x18]
jmp 0x435ca6
cmp byte [ebp + 0x10], bl
jne 0x435cb3
cmp dword [esi + 8], 2
jbe 0x435cb3
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
call fcn.00412c4e
mov word [esp + 0xa0], ax
test edi, 0x10000
je 0x435cc3
mov dword [esp + 0x30], 0x10
mov eax, dword [esi + 4]
mov eax, dword [eax]
call fcn.00412b6d
push eax
call fcn.0040f89b
pop ecx
cmp byte [ebp + 0x10], bl
je 0x435d7d
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
call fcn.00412b6d
push eax
call fcn.0040f89b
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
pop ecx
call fcn.00412b6d
push eax
call fcn.0040f89b
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x10]
pop ecx
call fcn.00412b6d
push eax
call fcn.0040f89b
cmp dword [esi + 8], 5
pop ecx
mov dword [esp + 0x24], eax
jbe 0x435d52
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x14]
call fcn.00412b6d
push eax
call fcn.0040f89b
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x435d52
push eax
call fcn.00455031
pop ecx
test eax, eax
jne 0x435ddb
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
push ebx
call edi
mov dword [esp + 0x28], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455447
pop ecx
push dword [esp + 0x28]
push eax
jmp 0x435dd5
cmp dword [esi + 8], 1
mov dword [esp + 0x24], eax
jbe 0x435dac
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
call fcn.00412b6d
push eax
call fcn.0040f89b
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x435dac
push eax
call fcn.00455031
pop ecx
test eax, eax
jne 0x435e0f
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebx
push ebx
call edi
mov dword [esp + 0x28], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455447
pop ecx
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
call edi
cmp byte [ebp + 0x10], bl
je 0x435e0f
mov eax, dword [esi + 4]
mov edi, dword [eax]
push 0x46df98
call fcn.004132c2
mov eax, dword [esi + 4]
mov edi, dword [eax + 4]
push 0x46df98
call fcn.004132c2
mov eax, dword [esi + 4]
mov edi, dword [eax + 8]
push 0x46df98
call fcn.004132c2
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x34], eax
test al, 8
je 0x435e45
or dword [esp + 0x34], 6
test byte [esp + 0x34], 0x10
je 0x435e54
mov dword [esp + 0x34], 0x10
cmp dword [esp + 0x2c], ebx
setne byte [esp + 0x12]
cmp byte [esp + 0x12], bl
je 0x435f26
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x48]
push eax
lea edi, [esp + 0x54]
lea eax, [esp + 0x40]
call fcn.00411e44
cmp eax, ebx
jne 0x435e9d
lea eax, [esp + 0x3c]
push eax
push 0xfffffffffffffff5
push 2
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x40]
call fcn.00411cc5
mov dword [esp + 0xac], eax
cmp eax, 0xffffffff
jne 0x435ead
mov byte [esp + 0x12], bl
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x50]
push eax
lea edi, [esp + 0x4c]
lea eax, [esp + 0x40]
call fcn.00411e44
cmp eax, ebx
jne 0x435ee3
lea eax, [esp + 0x44]
push eax
push 0xfffffffffffffff4
push 4
lea ecx, [esp + 0x54]
lea eax, [esp + 0x40]
call fcn.00411cc5
mov dword [esp + 0xb0], eax
cmp eax, 0xffffffff
jne 0x435ef3
mov byte [esp + 0x12], bl
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
lea eax, [esp + 0x38]
call fcn.00411d86
mov dword [esp + 0xa8], eax
cmp eax, 0xffffffff
jne 0x435f15
mov byte [esp + 0x12], bl
cmp byte [esp + 0x12], bl
je 0x435f26
or dword [esp + 0x9c], 0x100
cmp byte [ebp + 0x10], bl
je 0x435fee
call fcn.0040223d
test al, al
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x1c]
je 0x435f65
push dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x34]
push dword [esp + 0x70]
push dword [esp + 0x38]
push dword [esp + 0x34]
call fcn.00402399
jmp 0x435f82
push dword [esp + 0x30]
mov eax, dword [esp + 0x40]
push dword [esp + 0x6c]
push dword [esp + 0x34]
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.0040261a
push dword [esp + 0x1c]
mov byte [esp + 0x17], al
call fcn.00455031
pop ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ebx
je 0x435f9e
mov byte [ecx], bl
inc ecx
dec eax
jne 0x435f98
push dword [esp + 0x18]
call fcn.00455031
pop ecx
mov ecx, dword [esp + 0x18]
cmp eax, ebx
je 0x435fb6
mov byte [ecx], bl
inc ecx
dec eax
jne 0x435fb0
push dword [esp + 0x20]
call fcn.00455031
pop ecx
mov ecx, dword [esp + 0x20]
cmp eax, ebx
je 0x435fce
mov byte [ecx], bl
inc ecx
dec eax
jne 0x435fc8
push dword [esp + 0x1c]
call fcn.0045504c
pop ecx
push dword [esp + 0x18]
call fcn.0045504c
pop ecx
push dword [esp + 0x20]
call fcn.0045504c
pop ecx
jmp 0x43601b
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x1c]
movzx eax, byte [esp + 0x1e]
push ebx
push dword [esp + 0x40]
push eax
push ebx
push ebx
push dword [esp + 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne byte [esp + 0x13]
push dword [esp + 0x24]
call fcn.0045504c
pop ecx
push dword [esp + 0x14]
call fcn.0045504c
pop ecx
cmp byte [esp + 0x13], bl
jne 0x43607b
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [eax + 4]
lea eax, [edi + esi + 4]
call fcn.00418902
mov dword [eax + 0x14], 1
lea eax, [edi + esi + 4]
call fcn.00418902
push ebx
mov byte [eax + 0x18], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
call fcn.0041649e
mov esi, dword [ebp + 0x14]
push ebx
call fcn.0041315d
jmp 0x436104
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x12], bl
je 0x4360c7
lea esi, [esp + 0x50]
call fcn.00411c1a
lea esi, [esp + 0x40]
call fcn.00411c1a
lea esi, [esp + 0x48]
call fcn.00411c1a
mov eax, dword [esp + 0x68]
lea edi, [esp + 0x34]
mov dword [esp + 0x38], eax
call fcn.00411c72
mov esi, dword [ebp + 8]
add esi, 0x468
mov eax, edi
call fcn.00438089
cmp byte [ebp + 0xc], bl
je 0x4360db
mov eax, dword [esp + 0x60]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x450], eax
jmp 0x436104
mov eax, dword [esp + 0x68]
fild dword [esp + 0x68]
test eax, eax
jns 0x4360ed
fadd qword [0x475bd0]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.004132a6
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x34]
call fcn.00411a8a
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10