Function at 0x4afe54
Capabilities:
Create process on windows
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2b
push 0
push 0
dec ecx
jne 0x4afe5c
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0857
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4b65f4]
mov eax, 0x4b086c
call fcn.004051ac
mov esi, eax
test esi, esi
jle 0x4aff08
mov eax, dword [ebx + 0x324]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4afea2
call fcn.004ad14c
mov eax, dword [0x4b65f4]
call fcn.00404e68
mov ecx, eax
sub ecx, esi
inc ecx
mov eax, 0x4b65f4
mov edx, esi
call fcn.00405108
push 1
push 0
push 0
mov eax, dword [0x4b65f4]
call fcn.00405068
push eax
push 0x4b0870
mov eax, ebx
call fcn.00449134
push eax
call sub.shell32.dll_ShellExecuteA
push 0x40
push 0x4b0878
push 0x4b08a0
mov eax, dword [0x4b9e88]
call fcn.00449134
push eax
call sub.user32.dll_MessageBoxA_1
mov eax, ebx
call fcn.0045edb8
jmp 0x4b0811
lea edx, [ebp - 0x110]
mov eax, dword [ebx + 0x328]
call fcn.00442934
mov eax, dword [ebp - 0x110]
mov edx, 0x4b0960
call fcn.00404fb4
jne 0x4aff39
mov edx, ebx
mov eax, ebx
call fcn.004ad4a8
jmp 0x4b0811
lea edx, [ebp - 0x114]
mov eax, dword [ebx + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x114]
call fcn.00409848
test al, al
jne 0x4aff77
push 0x10
push 0
push 0x4b0968
mov eax, ebx
call fcn.00449134
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4b0811
lea eax, [ebp - 4]
mov edx, 0x4b099c
call fcn.00404c40
inc dword [0x4b65e8]
cmp dword [0x4b65e8], 1
jne 0x4b00a3
mov eax, dword [ebx + 0x324]
mov edx, dword [eax]
call dword [edx + 0xc8]
test al, al
je 0x4affae
call fcn.004ad14c
mov dl, 1
mov eax, dword [ebx + 0x318]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x4b09cc
mov eax, dword [ebx + 0x358]
call fcn.00442964
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x30c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x32c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x330]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x320]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x338]
call fcn.0049ff54
xor edx, edx
mov eax, dword [ebx + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0x64]
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4ace44
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4b6b20]
mov eax, dword [eax]
call fcn.004623ac
cmp byte [0x4b6604], 1
jne 0x4b006f
mov dl, 1
mov eax, dword [ebx + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [0x4b9e88]
mov edx, dword [eax + 0x328]
mov eax, ebx
call fcn.004afe54
cmp dword [0x4b65e8], 2
jne 0x4b023a
mov eax, dword [0x4b660c]
mov edx, 0x4b09e8
call fcn.00404fb4
jne 0x4b00d3
mov edx, 0x4b09f8
mov eax, dword [ebx + 0x358]
call fcn.00442964
jmp 0x4b00e3
mov edx, 0x4b0a34
mov eax, dword [ebx + 0x358]
call fcn.00442964
mov edx, 0x4b0a70
mov eax, dword [ebx + 0x328]
call fcn.00442964
xor edx, edx
mov eax, dword [ebx + 0x318]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x31c]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x30c]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x314]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x338]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x310]
call fcn.00442854
mov edx, 0x4b0a84
mov eax, dword [ebx + 0x35c]
call fcn.00442964
mov edx, 0x4b0aa8
mov eax, dword [ebx + 0x33c]
call fcn.00442964
mov edx, 0x4b0acc
mov eax, dword [ebx + 0x344]
call fcn.00442964
mov eax, dword [0x4b660c]
mov edx, 0x4b09e8
call fcn.00404fb4
jne 0x4b01ab
mov dl, 1
mov eax, dword [ebx + 0x34c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x344]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x35c]
call fcn.00442854
jmp 0x4b0213
xor edx, edx
mov eax, dword [ebx + 0x34c]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x344]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x35c]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x360]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x364]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x368]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x36c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x33c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x340]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x348]
call fcn.00442854
cmp dword [0x4b65e8], 3
jne 0x4b0501
lea edx, [ebp - 0x118]
mov eax, dword [ebx + 0x34c]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
cmp dword [ebp - 0x118], 0
jne 0x4b028f
mov dword [0x4b65e8], 2
push 0x10
push 0x4b0ae4
push 0x4b0aec
mov eax, dword [0x4b9e88]
call fcn.00449134
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4b0811
lea edx, [ebp - 0x11c]
mov eax, dword [ebx + 0x34c]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
mov eax, dword [ebp - 0x11c]
mov edx, 0x4b0b0c
call fcn.00404fb4
je 0x4b04f3
push dword [ebp - 4]
lea edx, [ebp - 0x120]
mov eax, dword [ebx + 0x34c]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
push dword [ebp - 0x120]
push 0x4b0b1c
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
mov eax, dword [edx + eax + 1]
inc eax
lea edx, [ebp - 0x124]
call fcn.004093a8
push dword [ebp - 0x124]
push 0x4b0b28
push dword [0x4b9e94]
lea eax, [ebp - 4]
mov edx, 6
call fcn.00404f28
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x350]
mov ecx, dword [eax]
call dword [ecx + 0x58]
lea eax, [ebp - 8]
mov edx, dword [ebx + 0x350]
mov edx, dword [edx + 0x10120]
call fcn.00404c40
mov eax, dword [ebp - 8]
mov edx, 0x4b0b34
call fcn.00404fb4
jne 0x4b04c8
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
inc dword [edx + eax + 1]
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
mov esi, dword [edx + eax + 1]
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
movzx eax, byte [edx + eax]
cmp esi, eax
jl 0x4b03ce
mov dword [0x4b65e8], 3
mov edx, ebx
mov eax, ebx
call fcn.004afe54
jmp 0x4b0811
mov dword [0x4b65e8], 2
push 0x4b0b40
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
lea edx, [edx + eax + 0x205]
lea eax, [ebp - 0x12c]
call fcn.00404e0c
push dword [ebp - 0x12c]
push 0x4b0b64
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
lea edx, [edx + eax + 0x105]
lea eax, [ebp - 0x130]
call fcn.00404e0c
push dword [ebp - 0x130]
push 0x4b0b78
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
movzx eax, byte [edx + eax]
push eax
mov eax, dword [ebx + 0x348]
mov edx, dword [eax]
call dword [edx + 0xcc]
imul eax, eax, 0x305
mov edx, dword [0x4b9e90]
pop ecx
mov eax, dword [edx + eax + 1]
xchg ecx, eax
sub eax, ecx
lea edx, [ebp - 0x134]
call fcn.004093a8
push dword [ebp - 0x134]
push 0x4b0bb0
lea eax, [ebp - 0x128]
mov edx, 7
call fcn.00404f28
mov edx, dword [ebp - 0x128]
mov eax, dword [ebx + 0x340]
call fcn.00442964
jmp 0x4b0811
mov dword [0x4b65e8], 2
push 0x10
push 0x4b0ae4
push 0x4b0bb8
mov eax, dword [0x4b9e88]
call fcn.00449134
push eax
call sub.user32.dll_MessageBoxA_1
jmp 0x4b0811
mov edx, ebx
mov eax, ebx
call fcn.004afe54
jmp 0x4b0811
cmp dword [0x4b65e8], 4
jl 0x4b0811
xor edx, edx
mov eax, dword [ebx + 0x360]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x364]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x368]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x36c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x318]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov dl, 1
mov eax, dword [ebx + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov edx, 0x4b0bd8
mov eax, dword [ebx + 0x358]
call fcn.00442964
mov edx, 0x4b0960
mov eax, dword [ebx + 0x328]
call fcn.00442964
xor edx, edx
mov eax, dword [ebx + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x310]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x30c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x32c]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x330]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x320]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x324]
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor edx, edx
mov eax, dword [ebx + 0x338]
call fcn.0049ff54
xor edx, edx
mov eax, dword [ebx + 0x35c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x310]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x318]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x31c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x30c]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x314]
call fcn.00442854
mov dl, 1
mov eax, dword [ebx + 0x338]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x33c]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x340]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x344]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x348]
call fcn.00442854
xor edx, edx
mov eax, dword [ebx + 0x34c]
call fcn.00442854
lea eax, [ebp - 0x10c]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x138]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404e18
mov eax, dword [ebp - 0x138]
call fcn.00409a48
call fcn.00402f5c
mov eax, 0xc8
call fcn.004035ec
lea edx, [ebp - 0x13c]
call fcn.004093a8
push dword [ebp - 0x13c]
mov eax, 0xc8
call fcn.004035ec
lea edx, [ebp - 0x140]
call fcn.004093a8
push dword [ebp - 0x140]
mov eax, 0xc8
call fcn.004035ec
lea edx, [ebp - 0x144]
call fcn.004093a8
push dword [ebp - 0x144]
mov eax, 0xc8
call fcn.004035ec
lea edx, [ebp - 0x148]
call fcn.004093a8
push dword [ebp - 0x148]
mov eax, 0xc8
call fcn.004035ec
lea edx, [ebp - 0x14c]
call fcn.004093a8
push dword [ebp - 0x14c]
push 0x4b0c00
mov eax, 0x4b6608
mov edx, 6
call fcn.00404f28
mov eax, dword [0x4b6608]
call fcn.00405068
push eax
lea eax, [ebp - 0x10c]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.00404e18
mov eax, dword [ebp - 0x150]
call fcn.004acfa4
lea edx, [ebp - 0x154]
lea eax, [ebp - 0x10c]
call fcn.00409cac
push dword [ebp - 0x154]
push 0x4b0c10
push dword [0x4b9e98]
push 0x4b0c1c
lea edx, [ebp - 0x158]
mov eax, dword [ebx + 0x314]
mov ecx, dword [eax]
call dword [ecx + 0x11c]
push dword [ebp - 0x158]
push 0x4b0c30
mov eax, 0x4b9e98
mov edx, 6
call fcn.00404f28
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x4acb18
push 0xfff
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b085e
lea eax, [ebp - 0x158]
call fcn.00404ba8
lea eax, [ebp - 0x154]
mov edx, 0xd
call fcn.00404bcc
lea eax, [ebp - 0x120]
mov edx, 5
call fcn.00404bcc
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404bcc
ret