Function at 0x457764
Capabilities:
Check if file exists
Create process on windows
Hide graphical window
Set current directory
Terminate process

Disassembly:
sub esp, 8
jne 0x457727
and edi, 0x1e85053
add byte [eax], al
add byte [ecx + ebx*2 - 0x7efd82a7], bh
bnd ja 0x45772f
jae 0xe82dca7c
push ecx
push ebx
call fcn.00457715
mov ecx, 0x18244483
push es
invalid
add dword [esp + 0x18], 6
sub esp, 4
jne 0x45774a
or eax, 0xc181027d
jge 0x45773e
add ecx, 0x57be0177
ja 0x457741
mov esi, 0xe8515557
add eax, 0xbd000000
push edi
push ebp
push ecx
call 0x45774e
mov ebp, 0xa364ee73
jmp dword [esp + 0x2c]
jae 0x45773a
mov dword fs:[0x2c2464ff], eax
ror byte [edx + edi*4], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x10a3be9
add byte [eax], al
mov eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x90]
add ecx, 0x1d04
call fcn.0042b090
movzx ecx, al
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x84], ecx
cmp dword [0x59276c], 0
je 0x4577b8
mov dword [ebp - 0x84], 0
push 0x561654
push 1
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d6c]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d68]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov ecx, dword [ebp - 0x90]
add ecx, 0x1d24
push ecx
mov edx, 0x561668
call fcn.00447c80
cmp eax, 0xffffffff
je 0x457829
mov eax, dword [ebp - 0x90]
add eax, 0x1d24
call fcn.00421df0
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
test eax, eax
jne 0x4578b3
push 0x1a
lea esi, [ebp - 0x2c]
call fcn.00450b50
add esp, 4
mov dword [ebp - 0x32c], eax
mov edx, dword [ebp - 0x32c]
mov dword [ebp - 0x330], edx
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x90]
add esi, 0x1d24
mov edi, dword [ebp - 0x330]
call fcn.00421d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.00421d80
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x106
mov ecx, dword [ebp - 0x90]
add ecx, 0x1d24
push ecx
mov edx, eax
call fcn.00421dc0
mov edx, dword [ebp - 0x90]
add edx, 0x1d24
push edx
mov edx, 0x561194
call fcn.00421dc0
mov eax, dword [ebp - 0x90]
add eax, 0x1d24
call fcn.00421df0
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, dword [ebp - 0x90]
add esi, 0x48
call fcn.0044bf30
mov byte [ebp - 0x2a1], al
movzx eax, byte [ebp - 0x2a1]
test eax, eax
jne 0x4578ee
jmp 0x458151
mov dword [ebp - 0x9c], 0
call fcn.0045be70
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.0044bd10
movzx ecx, al
test ecx, ecx
jne 0x45794b
cmp dword [ebp - 0x2a8], 0
setne dl
movzx eax, dl
push eax
mov ecx, dword [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x90]
push edx
lea edx, [ebp - 0x98]
call fcn.00458be0
jmp 0x457973
lea eax, [ebp - 0x98]
push eax
cmp dword [ebp - 0x2a8], 0
setne cl
movzx edx, cl
push edx
mov eax, dword [ebp - 0x84]
push eax
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.004593c0
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
movzx edx, byte [eax + 5]
cmp edx, 1
jne 0x457a90
push 0x1a
lea esi, [ebp - 0x2c4]
call fcn.00450b50
add esp, 4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x106
lea ecx, [ebp - 0x2c4]
push ecx
mov edx, eax
call fcn.00421dc0
lea edx, [ebp - 0x2c4]
push edx
mov edx, 0x561194
call fcn.00421dc0
lea eax, [ebp - 0x2c4]
call fcn.00421df0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x4579ff
lea eax, [ebp - 0x2c4]
call fcn.00421df0
push eax
call dword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
push str.UserData_
mov eax, dword [ebp - 0x90]
add eax, 0x1d24
push eax
lea ecx, [ebp - 0x2e0]
push ecx
call fcn.004264f0
add esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2e0]
call fcn.00421df0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x457a6f
lea eax, [ebp - 0x2c4]
call fcn.00421df0
push eax
lea eax, [ebp - 0x2e0]
call fcn.00421df0
mov ecx, eax
call fcn.00458460
lea eax, [ebp - 0x2e0]
call fcn.00421df0
push eax
mov ecx, dword [ebp - 0x90]
call fcn.00458170
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2e0]
call fcn.00421d80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.00421d80
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
push 0x561678
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d6c]
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d68]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov edx, dword [ebp - 0x90]
push edx
call fcn.0045b3d0
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
push 0x56168c
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d6c]
push ecx
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d68]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x90]
push ecx
call fcn.0045a6e0
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
movzx eax, byte [eax + 3]
cmp eax, 1
jne 0x457b97
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
push 0x5616a4
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d6c]
push ecx
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d68]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x90]
call fcn.0045ac20
jmp 0x457be9
mov ecx, dword [ebp - 0x90]
cmp dword [ecx + 0x34], 1
jne 0x457be9
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
push 0x5616a4
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d6c]
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d68]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x90]
call fcn.0045ac20
mov edx, dword [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x98]
add eax, 1
mov dword [ebp - 0x98], eax
push 0x5616b8
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d6c]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d68]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x90]
call fcn.00459c40
mov eax, dword [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x59276c], 0
je 0x457cf4
mov ecx, dword [ebp - 0x90]
mov byte [ecx], 0
mov edx, dword [ebp - 0x90]
add edx, 4
push edx
mov eax, 0x560238
call fcn.004450a0
mov eax, dword [ebp - 0x90]
mov dword [eax + 0x40], 0
mov dword [ebp - 0x9c], 0
push 0
push 0
push 0xc95
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d68]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x90]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x457cc0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x457ca6
mov ecx, dword [ebp - 0x90]
add ecx, 4
mov edx, dword [ebp - 0x90]
push edx
call fcn.004566b0
push 0xc94
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d68]
push ecx
mov esi, dword [ebp - 0x90]
call fcn.00457050
jmp 0x457d11
push 0xc94
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d68]
push eax
mov esi, dword [ebp - 0x90]
call fcn.00457050
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
movzx ecx, byte [eax + 2]
cmp ecx, 1
jne 0x457d84
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
movzx edx, byte [eax + 4]
test edx, edx
jne 0x457d79
mov eax, dword [ebp - 0x98]
add eax, 1
mov dword [ebp - 0x98], eax
push 0x5616cc
mov ecx, dword [ebp - 0x98]
push ecx
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d6c]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d68]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 0x90]
call fcn.0045b7f0
call fcn.0045bee0
mov ecx, dword [ebp - 0x90]
mov dword [ecx + 0x1d20], eax
mov edx, dword [ebp - 0x98]
add edx, 1
mov dword [ebp - 0x98], edx
push 0x5616e4
mov eax, dword [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d6c]
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0x1d68]
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xac
call fcn.004bf242
add esp, 4
mov dword [ebp - 0x304], eax
mov dword [ebp - 4], 3
cmp dword [ebp - 0x304], 0
je 0x457e07
mov edx, dword [ebp - 0x304]
push edx
call fcn.00424300
mov dword [ebp - 0x334], eax
jmp 0x457e11
mov dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x300], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x300]
mov dword [ebp - 0x2a0], ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00452bf0
add esp, 4
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x33c], eax
mov dword [ebp - 4], 4
mov esi, dword [ebp - 0x2a0]
add esi, 0x54
mov edi, dword [ebp - 0x33c]
call fcn.00421d70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00421d80
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 6
mov ecx, dword [ebp - 0x2a0]
push ecx
mov edx, eax
call fcn.0041c4e0
mov eax, dword [ebp - 0x90]
add eax, 0x1ce8
mov ecx, dword [ebp - 0x2a0]
add ecx, 0x1c
call fcn.00422950
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x26
mov edx, dword [ebp - 0x2a0]
add edx, 0x38
push edx
mov edx, eax
call fcn.0041c4e0
mov ecx, dword [ebp - 0x90]
add ecx, 0x1d04
call fcn.0042b090
movzx eax, al
test eax, eax
je 0x457f2d
push 0x55c260
lea ecx, [ebp - 0x64]
call fcn.00421d10
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x344], ecx
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x30c]
or edx, 1
mov dword [ebp - 0x30c], edx
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x348], eax
jmp 0x457f74
mov eax, dword [ebp - 0x90]
add eax, 0x1d04
lea esi, [ebp - 0x80]
call fcn.00421cd0
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x350], ecx
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0x30c]
or edx, 2
mov dword [ebp - 0x30c], edx
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x348]
mov dword [ebp - 0x308], ecx
mov esi, dword [ebp - 0x2a0]
add esi, 0x70
mov edi, dword [ebp - 0x308]
call fcn.00421d70
mov dword [ebp - 4], 5
mov edx, dword [ebp - 0x30c]
and edx, 2
je 0x457fb5
and dword [ebp - 0x30c], 0xfffffffd
lea ecx, [ebp - 0x80]
call fcn.00421d80
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x30c]
and eax, 1
je 0x457fd6
and dword [ebp - 0x30c], 0xfffffffe
lea ecx, [ebp - 0x64]
call fcn.00421d80
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d20]
mov dword [ecx + 0xa8], eax
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x906
mov ecx, dword [ebp - 0x2a0]
add ecx, 0x8c
push ecx
mov edx, eax
call fcn.0041c4e0
mov edx, dword [ebp - 0x2a0]
push edx
call fcn.00421320
add esp, 4
mov byte [ebp - 0x29c], 0
push 0x1ff
push 0
lea eax, [ebp - 0x29b]
push eax
call fcn.004c5420
add esp, 0xc
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x246
push eax
mov eax, dword [ebp - 0x90]
add eax, 0x48
call fcn.00454ad0
add eax, 0x206
push eax
mov eax, dword [ebp - 0x90]
add eax, 0x1d24
call fcn.00421df0
push eax
push str._s_s_s
lea edx, [ebp - 0x29c]
call fcn.0045c3a0
add esp, 0x10
cmp dword [0x59276c], 0
je 0x4580b0
cmp dword [0x592978], 0
je 0x4580ae
push 5
lea ecx, [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4580f4
mov edx, dword [ebp - 0x90]
cmp dword [edx + 0x24], 0
je 0x4580d9
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0x20], 0
je 0x4580d7
push 5
lea ecx, [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4580f4
mov edx, dword [ebp - 0x90]
cmp dword [edx + 0x38], 0
je 0x4580f4
push 5
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + 0x1d68]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x90]
cmp dword [eax + 0x40], 0
jne 0x45812b
mov ecx, dword [ebp - 0x90]
cmp dword [ecx + 0x2c], 0
je 0x45812b
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x458109
push 0
push 0
push 0x12
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + 0x1d68]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004be8b8
mov esp, ebp
pop ebp
ret