Function at 0x413e46
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xd4
mov eax, 0x4755ce
call fcn.0044b825
mov eax, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xe0], ecx
cmp eax, esi
je 0x4140a9
xor ecx, ecx
cmp cx, word [eax]
je 0x4140a9
push 7
pop edi
xor eax, eax
push 0x493454
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa8], esi
mov word [ebp - 0xb8], ax
call fcn.004032e2
mov dword [ebp - 4], esi
xor eax, eax
push 0x493488
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x88], edi
mov dword [ebp - 0x8c], esi
mov word [ebp - 0x9c], ax
call fcn.004032e2
push 0x4033f5
push 0x40302a
push 4
xor ebx, ebx
push 0x1c
lea eax, [ebp - 0x80]
inc ebx
push eax
mov byte [ebp - 4], bl
call fcn.00450329
mov byte [ebp - 4], 2
cmp dword [ebp - 0xa4], 8
mov eax, dword [ebp - 0xb8]
jae 0x413eff
lea eax, [ebp - 0xb8]
push esi
push eax
mov edi, SysReAllocString
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403aed
add esp, 0x10
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 3
call fcn.0040336c
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.0040363d
cmp dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x9c]
jae 0x413f49
lea eax, [ebp - 0x9c]
push esi
push eax
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403aed
add esp, 0x10
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 4
call fcn.0040336c
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.0040363d
cmp dword [ebp - 0xa4], 8
mov eax, dword [ebp - 0xb8]
jae 0x413f8e
lea eax, [ebp - 0xb8]
push esi
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403aed
add esp, 0x10
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.0040336c
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.0040363d
cmp dword [ebp - 0x88], 8
mov eax, dword [ebp - 0x9c]
jae 0x413fd8
lea eax, [ebp - 0x9c]
push esi
push eax
lea eax, [ebp - 0xd4]
push edi
push eax
call fcn.00403aed
add esp, 0x10
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.0040336c
push esi
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 2
call fcn.0040363d
mov dword [ebp - 0xd8], esi
lea edi, [ebp - 0x80]
cmp dword [edi + 0x10], esi
je 0x414068
push 0x4934d0
mov ecx, edi
call fcn.00402da9
cmp dword [edi + 0x14], 8
jb 0x41402c
mov eax, dword [edi]
jmp 0x41402e
mov eax, edi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414068
cmp dword [edi + 0x14], 8
mov eax, dword [ebp - 0xe0]
mov byte [eax], bl
jb 0x41404b
mov eax, dword [edi]
jmp 0x41404d
mov eax, edi
push 5
push esi
push dword [ebp - 0xdc]
push eax
push 0x4936d0
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x4140b1
inc dword [ebp - 0xd8]
add edi, 0x1c
cmp dword [ebp - 0xd8], 4
jl 0x414011
push 0x4033f5
push 4
push 0x1c
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], bl
call fcn.004503fe
push esi
push ebx
lea ecx, [ebp - 0x9c]
call fcn.0040363d
push esi
push ebx
lea ecx, [ebp - 0xb8]
call fcn.0040363d
xor al, al
call fcn.0044b8a8
ret
push 0x4033f5
push 4
push 0x1c
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], bl
call fcn.004503fe
push esi
push ebx
lea ecx, [ebp - 0x9c]
call fcn.0040363d
push esi
push ebx
lea ecx, [ebp - 0xb8]
call fcn.0040363d
mov al, bl
jmp 0x4140ab