Function at 0x435da8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac
push ebx
push esi
push edi
push 0x44
pop edi
push edi
mov esi, eax
xor ebx, ebx
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.00456fd0
xor eax, eax
inc eax
mov dword [esp + 0x7c], edi
add esp, 0xc
xor edi, edi
mov dword [esp + 0x9c], eax
mov word [esp + 0xa0], ax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
cmp byte [ebp + 0x10], bl
je 0x435e2c
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
call fcn.00412c92
cmp dword [esi + 8], 7
mov dword [esp + 0x5c], eax
jbe 0x435e5e
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
call fcn.00412c92
mov edi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
jmp 0x435e45
cmp dword [esi + 8], 3
jbe 0x435e71
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
call fcn.00412c92
mov edi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0xc]
and edi, 0xffff0000
call fcn.00412c92
and eax, 0xffff
mov dword [esp + 0x2c], eax
cmp byte [ebp + 0x10], bl
je 0x435e71
cmp dword [esi + 8], 6
jbe 0x435e6c
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x18]
jmp 0x435e7d
cmp byte [ebp + 0x10], bl
jne 0x435e8a
cmp dword [esi + 8], 2
jbe 0x435e8a
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
call fcn.00412c92
mov word [esp + 0xa0], ax
test edi, 0x10000
je 0x435e9a
mov dword [esp + 0x30], 0x10
mov eax, dword [esi + 4]
mov eax, dword [eax]
call fcn.00412bb1
push eax
call fcn.0040f873
pop ecx
cmp byte [ebp + 0x10], bl
je 0x435f54
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
call fcn.00412bb1
push eax
call fcn.0040f873
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 8]
pop ecx
call fcn.00412bb1
push eax
call fcn.0040f873
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x10]
pop ecx
call fcn.00412bb1
push eax
call fcn.0040f873
cmp dword [esi + 8], 5
pop ecx
mov dword [esp + 0x24], eax
jbe 0x435f29
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x14]
call fcn.00412bb1
push eax
call fcn.0040f873
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x435f29
push eax
call fcn.00455251
pop ecx
test eax, eax
jne 0x435fb2
mov edi, dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryW]
push ebx
push ebx
call edi
mov dword [esp + 0x28], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455667
pop ecx
push dword [esp + 0x28]
push eax
jmp 0x435fac
cmp dword [esi + 8], 1
mov dword [esp + 0x24], eax
jbe 0x435f83
mov eax, dword [esi + 4]
mov eax, dword [eax + 4]
call fcn.00412bb1
push eax
call fcn.0040f873
pop ecx
mov dword [esp + 0x14], eax
cmp eax, ebx
je 0x435f83
push eax
call fcn.00455251
pop ecx
test eax, eax
jne 0x435fe6
mov edi, dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push ebx
push ebx
call edi
mov dword [esp + 0x28], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00455667
pop ecx
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
call edi
cmp byte [ebp + 0x10], bl
je 0x435fe6
mov eax, dword [esi + 4]
mov edi, dword [eax]
push 0x46df88
call fcn.0041345d
mov eax, dword [esi + 4]
mov edi, dword [eax + 4]
push 0x46df88
call fcn.0041345d
mov eax, dword [esi + 4]
mov edi, dword [eax + 8]
push 0x46df88
call fcn.0041345d
movzx eax, word [esp + 0x2c]
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x34], eax
test al, 8
je 0x43601c
or dword [esp + 0x34], 6
test byte [esp + 0x34], 0x10
je 0x43602b
mov dword [esp + 0x34], 0x10
cmp dword [esp + 0x2c], ebx
setne byte [esp + 0x12]
cmp byte [esp + 0x12], bl
je 0x4360fd
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x48]
push eax
lea edi, [esp + 0x54]
lea eax, [esp + 0x40]
call fcn.00411e88
cmp eax, ebx
jne 0x436074
lea eax, [esp + 0x3c]
push eax
push 0xfffffffffffffff5
push 2
lea ecx, [esp + 0x4c]
lea eax, [esp + 0x40]
call fcn.00411d09
mov dword [esp + 0xac], eax
cmp eax, 0xffffffff
jne 0x436084
mov byte [esp + 0x12], bl
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x50]
push eax
lea edi, [esp + 0x4c]
lea eax, [esp + 0x40]
call fcn.00411e88
cmp eax, ebx
jne 0x4360ba
lea eax, [esp + 0x44]
push eax
push 0xfffffffffffffff4
push 4
lea ecx, [esp + 0x54]
lea eax, [esp + 0x40]
call fcn.00411d09
mov dword [esp + 0xb0], eax
cmp eax, 0xffffffff
jne 0x4360ca
mov byte [esp + 0x12], bl
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
lea eax, [esp + 0x38]
call fcn.00411dca
mov dword [esp + 0xa8], eax
cmp eax, 0xffffffff
jne 0x4360ec
mov byte [esp + 0x12], bl
cmp byte [esp + 0x12], bl
je 0x4360fd
or dword [esp + 0x9c], 0x100
cmp byte [ebp + 0x10], bl
je 0x4361c5
call fcn.0040221a
test al, al
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x1c]
je 0x43613c
push dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
push dword [esp + 0x34]
push dword [esp + 0x70]
push dword [esp + 0x38]
push dword [esp + 0x34]
call fcn.00402376
jmp 0x436159
push dword [esp + 0x30]
mov eax, dword [esp + 0x40]
push dword [esp + 0x6c]
push dword [esp + 0x34]
push dword [esp + 0x30]
push dword [esp + 0x38]
call fcn.004025f7
push dword [esp + 0x1c]
mov byte [esp + 0x17], al
call fcn.00455251
pop ecx
mov ecx, dword [esp + 0x1c]
cmp eax, ebx
je 0x436175
mov byte [ecx], bl
inc ecx
dec eax
jne 0x43616f
push dword [esp + 0x18]
call fcn.00455251
pop ecx
mov ecx, dword [esp + 0x18]
cmp eax, ebx
je 0x43618d
mov byte [ecx], bl
inc ecx
dec eax
jne 0x436187
push dword [esp + 0x20]
call fcn.00455251
pop ecx
mov ecx, dword [esp + 0x20]
cmp eax, ebx
je 0x4361a5
mov byte [ecx], bl
inc ecx
dec eax
jne 0x43619f
push dword [esp + 0x1c]
call fcn.0045526c
pop ecx
push dword [esp + 0x18]
call fcn.0045526c
pop ecx
push dword [esp + 0x20]
call fcn.0045526c
pop ecx
jmp 0x4361f2
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x74]
push eax
push dword [esp + 0x1c]
movzx eax, byte [esp + 0x1e]
push ebx
push dword [esp + 0x40]
push eax
push ebx
push ebx
push dword [esp + 0x44]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
test eax, eax
setne byte [esp + 0x13]
push dword [esp + 0x24]
call fcn.0045526c
pop ecx
push dword [esp + 0x14]
call fcn.0045526c
pop ecx
cmp byte [esp + 0x13], bl
jne 0x436252
mov esi, dword [ebp + 8]
mov eax, dword [esi]
mov edi, dword [eax + 4]
lea eax, [edi + esi + 4]
call fcn.00418aa2
mov dword [eax + 0x14], 1
lea eax, [edi + esi + 4]
call fcn.00418aa2
push ebx
mov byte [eax + 0x18], bl
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add eax, esi
call fcn.00416639
mov esi, dword [ebp + 0x14]
push ebx
call fcn.004131a1
jmp 0x4362db
push dword [esp + 0x64]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [esp + 0x12], bl
je 0x43629e
lea esi, [esp + 0x50]
call fcn.00411c5e
lea esi, [esp + 0x40]
call fcn.00411c5e
lea esi, [esp + 0x48]
call fcn.00411c5e
mov eax, dword [esp + 0x68]
lea edi, [esp + 0x34]
mov dword [esp + 0x38], eax
call fcn.00411cb6
mov esi, dword [ebp + 8]
add esi, 0x468
mov eax, edi
call fcn.00438260
cmp byte [ebp + 0xc], bl
je 0x4362b2
mov eax, dword [esp + 0x60]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x450], eax
jmp 0x4362db
mov eax, dword [esp + 0x68]
fild dword [esp + 0x68]
test eax, eax
jns 0x4362c4
fadd qword [0x475bc0]
mov esi, dword [ebp + 0x14]
push ecx
push ecx
fstp qword [esp]
call fcn.00413441
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [esp + 0x34]
call fcn.00411ace
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10