Function at 0x4ee32d
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push 0x3d0
mov eax, 0x66d6e7
call fcn.005b47af
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
xor eax, eax
mov dword [ebp - 0x234], 7
xor ebx, ebx
mov word [ebp - 0x248], ax
mov dword [ebp - 0x238], ebx
cmp word [ebp - 0x218], ax
je 0x4ee38c
lea eax, [ebp - 0x218]
push eax
call fcn.005ff18e
pop ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.0040a315
push str.cleaner_remove.cmd
lea eax, [ebp - 0x248]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.0040bca5
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 2
call fcn.00409de7
call fcn.0040afed
call fcn.0040afed
call fcn.0040afed
lea eax, [ebp - 0x3d4]
push eax
call fcn.004e258e
pop ecx
lea ecx, [ebp - 0x368]
mov byte [ebp - 4], 3
push ecx
mov ecx, eax
call fcn.00411c13
mov edi, eax
lea eax, [ebp - 0x3b0]
mov byte [ebp - 4], 4
push eax
call fcn.004e258e
pop ecx
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 5
push ecx
mov ecx, eax
call fcn.0040cff1
mov esi, eax
lea eax, [ebp - 0x38c]
mov byte [ebp - 4], 6
push eax
call fcn.004e258e
pop ecx
lea ecx, [ebp - 0x338]
mov byte [ebp - 4], 7
push ecx
mov ecx, eax
call fcn.0040cff1
push eax
lea eax, [ebp - 0x320]
mov byte [ebp - 4], 8
push str.:Repeat_r_ndel__
push eax
call fcn.00417d55
push str.__r_nif_exist__
push eax
lea eax, [ebp - 0x308]
mov byte [ebp - 4], 9
push eax
call fcn.0040bca5
push esi
push eax
lea eax, [ebp - 0x2f0]
mov byte [ebp - 4], 0xa
push eax
call fcn.00417c9a
push str.__goto_Repeat_r_nrmdir__Q__S__
push eax
lea eax, [ebp - 0x2d8]
mov byte [ebp - 4], 0xb
push eax
call fcn.0040bca5
push edi
push eax
lea eax, [ebp - 0x2c0]
mov byte [ebp - 4], 0xc
push eax
call fcn.00417c9a
push str.__r_ndel__
push eax
lea eax, [ebp - 0x2a8]
mov byte [ebp - 4], 0xd
push eax
call fcn.0040bca5
add esp, 0x48
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xe
push ecx
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.0042ab45
push str.__r_npause
push eax
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 0xf
push eax
call fcn.0040bca5
add esp, 0x18
xor esi, esi
lea ecx, [ebp - 0x290]
push ebx
inc esi
push esi
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x2a8]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x2c0]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x2d8]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x2f0]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x308]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x320]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x338]
call fcn.00409de7
lea ecx, [ebp - 0x374]
call fcn.00409ec4
push ebx
push esi
lea ecx, [ebp - 0x38c]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x350]
call fcn.00409de7
lea ecx, [ebp - 0x398]
call fcn.00409ec4
push ebx
push esi
lea ecx, [ebp - 0x3b0]
call fcn.00409de7
push ebx
push esi
lea ecx, [ebp - 0x368]
call fcn.00409de7
lea ecx, [ebp - 0x3bc]
call fcn.00409ec4
push ebx
push esi
lea ecx, [ebp - 0x3d4]
call fcn.00409de7
mov dword [ebp - 0x3dc], ebx
mov dword [ebp - 0x3d8], ebx
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ebx
cmovae eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x3dc]
push ebx
push 0x80
push 2
push 2
push 0x40000000
push eax
mov byte [ebp - 4], 0x1e
call fcn.004130cf
mov edi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
test eax, eax
je 0x4ee619
mov esi, dword [ebp - 0x3dc]
jmp 0x4ee699
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x260]
push eax
call fcn.004ee75d
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x260]
pop ecx
cmovae eax, dword [ebp - 0x260]
pop ecx
push ebx
push dword [ebp - 0x250]
lea ecx, [ebp - 0x3dc]
push eax
call fcn.00413b02
mov esi, dword [ebp - 0x3dc]
test esi, esi
je 0x4ee664
push esi
call edi
mov esi, ebx
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
push ebx
cmovae eax, dword [ebp - 0x230]
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 1
lea ecx, [ebp - 0x260]
mov bl, 1
call fcn.00409d92
test esi, esi
je 0x4ee6a0
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x278]
call fcn.00409de7
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00409de7
mov al, bl
call fcn.005b4759
ret