Function at 0x4417a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x578a21
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x138]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
push 0x5f3788
push eax
mov dword [esp + 0x134], 2
call esi
add esp, 8
test eax, eax
jne 0x44180d
mov esi, dword [esp + 0x134]
push 0x5f3788
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov ebx, 1
mov dword [esp + 0x10], ebx
jmp 0x441a1f
push str._SystemRoot_
lea ecx, [esp + 0x13c]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
je 0x441886
lea ecx, [esp + 0x20]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 0x20]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 8]
lea ecx, [esp + 0x138]
push eax
push str._SystemRoot__system32
mov byte [esp + 0x134], 3
call sub.MFC42.DLL_CString::Replace
mov ecx, dword [esp + 8]
push ecx
push str._SystemRoot_
lea ecx, [esp + 0x140]
call sub.MFC42.DLL_CString::Replace
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 2
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x138]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42.DLL_CString::CString_4
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 4
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::TrimRight
push 0x5e3734
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Find
cmp eax, 0xffffffff
je 0x4418d5
push str.shutdown
lea ecx, [esp + 0x13c]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [esp + 0x13c]
call sub.MFC42.DLL_CString::TrimLeft
mov eax, dword [esp + 0x13c]
push 0x5f3788
push eax
call esi
add esp, 8
mov ebx, 1
test eax, eax
push ebx
push 0
je 0x441911
mov ecx, dword [esp + 0x144]
mov edx, dword [esp + 0x140]
push ecx
push edx
jmp 0x44191b
mov eax, dword [esp + 0x140]
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4419f7
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
push 0x400
push eax
push 0
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 8]
push edx
call sub.MFC42.DLL_CString::CString_3
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 5
call sub.MFC42.DLL_CString::TrimRight
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x18]
push ecx
push 0x5e3714
push edx
call sub.MFC42.DLL_operator_2
push 0x5e3700
push eax
lea eax, [esp + 0x24]
mov byte [esp + 0x134], 6
push eax
call sub.MFC42.DLL_operator
mov esi, dword [esp + 0x134]
lea ecx, [esp + 8]
push ecx
push eax
push esi
mov byte [esp + 0x138], 7
call sub.MFC42.DLL_operator_1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x12c], 6
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x12c], 5
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 8]
mov byte [esp + 0x12c], 4
call sub.MFC42.DLL_CString::CString
jmp 0x441a0e
mov esi, dword [esp + 0x134]
push 0x5f3788
mov ecx, esi
call sub.MFC42.DLL_CString::CString_3
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x138]
mov byte [esp + 0x12c], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x13c]
mov byte [esp + 0x12c], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x124]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x128
ret