Function at 0x417ba0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x2e0
mov eax, dword [0x52e144]
xor eax, esp
mov dword [esp + 0x2dc], eax
push ebx
xor ebx, ebx
cmp byte [0x537551], bl
je 0x417bd7
xor al, al
pop ebx
mov ecx, dword [esp + 0x2dc]
xor ecx, esp
call fcn.004b6da3
add esp, 0x2e0
ret
push esi
push edi
push 0x5105ac
mov byte [0x537551], 1
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
call fcn.00411320
mov byte [0x53788c], bl
call fcn.00496aa0
cmp dword [0x5385cc], ebx
je 0x417c2d
mov eax, dword [0x5385d0]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [0x5385cc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
jmp 0x417c33
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x538658]
cmp eax, ebx
je 0x417c3f
push eax
call esi
mov eax, dword [0x53865c]
cmp eax, ebx
je 0x417c4b
push eax
call esi
mov eax, dword [0x538660]
cmp eax, ebx
je 0x417c57
push eax
call esi
push 1
push ebx
call fcn.004136f0
push 0x51059c
call fcn.004045b0
add esp, 0xc
push eax
push 0x51058c
call fcn.00404690
add esp, 4
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x417cc9
cmp dword [0x537c94], 1
push ebx
jne 0x417ca4
push 1
push 0x2b2c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x510564
jmp 0x417cb6
push ebx
push 0x2b2c
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x510550
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [0x537c60], ebx
je 0x417cd6
call fcn.0043f520
cmp byte [0x537f03], bl
je 0x417ce3
call fcn.0043def0
xor edi, edi
xor esi, esi
jmp 0x417cf0
mov ecx, dword [esi + 0x53970c]
cmp ecx, ebx
je 0x417d4c
call fcn.004052f0
cmp byte [eax], bl
je 0x417d4c
mov ecx, dword [esi + 0x53970c]
call fcn.004052f0
cmp byte [eax], bl
je 0x417d1f
mov ecx, dword [esi + 0x53970c]
call fcn.004052f0
jmp 0x417d24
mov eax, 0x50d147
push eax
push edi
push 0x510538
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0x10
lea ecx, [esi + 0x539708]
call fcn.0040a770
add esi, 0x6c
inc edi
cmp esi, 0x1518
jb 0x417cf0
cmp dword [0x538364], ebx
jne 0x417f61
cmp dword [0x53835c], ebx
jne 0x417d78
cmp dword [0x538360], ebx
je 0x417f1c
push ebp
push 0x103
lea edx, [esp + 0x69]
push ebx
push edx
mov byte [esp + 0x70], bl
call fcn.004b6dc0
push 0x103
lea eax, [esp + 0x1f9]
push ebx
push eax
mov byte [esp + 0x200], bl
call fcn.004b6dc0
add esp, 0x18
lea ebp, [esp + 0x64]
mov ecx, ebp
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x64]
mov byte [esp + eax + 0x1e8], cl
inc eax
cmp cl, bl
jne 0x417dc0
lea edx, [esp + 0x1e8]
push 0x5c
push edx
call fcn.004b6d8c
add esp, 8
cmp eax, ebx
je 0x417de8
mov byte [eax], bl
push 0x510524
call fcn.00404690
add esp, 4
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x417df7
lea edi, [esp + 0x64]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x417e05
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0x510524
rep movsb byte es:[edi], byte [esi]
call fcn.00404690
add esp, 4
mov ecx, eax
lea esp, [esp]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x417e30
lea edi, [esp + 0x1e8]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x417e43
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x64]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004ba516
add esp, 8
cmp eax, 0xffffffff
jne 0x417e73
lea ebp, [esp + 0x1e8]
push 0x44
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.004b6dc0
add esp, 0xc
xor eax, eax
push 0x53972c
push 0xead
push 0x510518
mov dword [esp + 0x2c], 0x44
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
call fcn.00404690
add esp, 4
push eax
lea edx, [esp + 0x174]
push edx
call fcn.004b79a8
add esp, 0x10
lea eax, [esp + 0x168]
push eax
push 0x51050c
call fcn.00404690
add esp, 4
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x188]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
pop ebp
push 0x5104f4
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
cmp dword [0x53866c], ebx
je 0x417f61
cmp byte [0x538d08], bl
je 0x417f61
call fcn.00414120
push 0x5104e4
call fcn.00404690
push eax
push 0x527e20
call fcn.00401350
add esp, 0xc
mov ecx, 0x527e20
call fcn.0040a1f0
mov ecx, 0x529268
call fcn.0040a1f0
mov ecx, dword [0x536dc0]
pop edi
pop esi
cmp ecx, ebx
je 0x417f89
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov eax, dword [0x537f04]
cmp eax, ebx
je 0x417fa1
push eax
call fcn.004b97a6
add esp, 4
mov dword [0x537f04], ebx
mov eax, dword [0x5385c0]
cmp eax, ebx
je 0x417fb1
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x2e0]
pop ebx
xor ecx, esp
mov al, 1
call fcn.004b6da3
add esp, 0x2e0
ret