Function at 0x4c5680
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x4c5688
push ebx
push esi
push edi
mov byte [ebp - 0x19], dl
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4c5abf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1a], 0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.0040c1e0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4c56c7
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x4c5a8c
mov eax, dword [0x4d393c]
cmp dword [eax], 6
jl 0x4c57b1
mov eax, dword [0x4d3bb0]
cmp dword [eax], 2
jl 0x4c57b1
lea eax, [ebp - 4]
xor edx, edx
call fcn.00405d74
lea eax, [ebp - 8]
xor edx, edx
call fcn.00405d74
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00405d74
mov dl, 1
mov eax, dword [0x4c4750]
call fcn.004c48e4
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.004c4a5c
mov edx, 0x4c5ae0
mov eax, ebx
call fcn.004c4be8
test al, al
je 0x4c5751
lea ecx, [ebp - 4]
mov edx, 0x4c5b88
mov eax, ebx
call fcn.004c4e34
lea ecx, [ebp - 8]
mov edx, 0x4c5ba4
mov eax, ebx
call fcn.004c4e34
cmp dword [ebp - 4], 0
je 0x4c57a8
cmp dword [ebp - 8], 0
je 0x4c57a8
mov edx, 0x80000000
mov eax, ebx
call fcn.004c4a5c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x4c5bbc
call fcn.0040d8dc
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.004c4be8
test al, al
je 0x4c57a0
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.004c4e34
cmp dword [ebp - 0xc], 0
setne byte [ebp - 0x1a]
mov eax, ebx
call fcn.00403d4c
jmp 0x4c57b5
mov byte [ebp - 0x1a], 1
cmp byte [ebp - 0x1a], 0
je 0x4c5856
mov eax, dword [0x4d393c]
cmp dword [eax], 0xa
jl 0x4c5856
mov eax, dword [0x4d39c0]
cmp dword [eax], 0x295a
jl 0x4c5856
xor eax, eax
push ebp
push 0x4c584c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4c4750]
call fcn.004c48e4
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.004c4a5c
mov edx, 0x4c5bf4
mov eax, ebx
call fcn.004c5474
test al, al
jne 0x4c5832
mov edx, 0x4c5c8c
mov eax, ebx
call fcn.004c5474
test al, al
jne 0x4c5832
mov edx, 0x4c5d1c
mov eax, ebx
call fcn.004c5474
test al, al
je 0x4c5836
xor eax, eax
jmp 0x4c5838
mov al, 1
mov byte [ebp - 0x1a], al
mov eax, ebx
call fcn.00403d4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5856
cmp byte [ebp - 0x1a], 0
je 0x4c58d1
xor edx, edx
push ebp
push 0x4c58c3
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x4c5897
push 0
push 0
push 1
mov eax, dword [ebp - 0x18]
call fcn.00405dac
mov ecx, eax
mov edx, 0x4c5d8c
xor eax, eax
call fcn.004c560c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x4c58b9
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405dac
push eax
push 0x4c5d8c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c58d1
cmp byte [ebp - 0x1a], 0
jne 0x4c597b
mov eax, dword [0x4d393c]
cmp dword [eax], 0xa
jl 0x4c597b
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x4c5da4
call fcn.0040d8dc
xor edx, edx
push ebp
push 0x4c596d
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x4c5941
push 0
push 0
push 1
mov eax, dword [ebp - 0x14]
call fcn.00405dac
mov ecx, eax
mov edx, 0x4c5d8c
xor eax, eax
call fcn.004c560c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x4c5963
push 1
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00405dac
push eax
push 0x4c5d8c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c597b
cmp byte [ebp - 0x1a], 0
jne 0x4c5a8c
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.00405d74
lea eax, [ebp - 0x20]
push eax
push 0x26
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
neg al
sbb eax, eax
test eax, eax
je 0x4c59e2
mov eax, 0x104
call fcn.0040d784
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x4c59db
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0040d744
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x10]
call fcn.00412fac
mov eax, ebx
call fcn.0040d7e0
cmp dword [ebp - 0x10], 0
je 0x4c5a8c
lea eax, [ebp - 0x10]
mov edx, 0x4c5dd4
call fcn.00406134
mov eax, dword [ebp - 0x10]
call fcn.0040cc10
test al, al
je 0x4c5a8c
xor edx, edx
push ebp
push 0x4c5a7e
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x4c5a4b
mov eax, dword [ebp - 0x18]
call fcn.00405dac
push eax
push 0
push 1
mov eax, dword [ebp - 0x10]
call fcn.00405dac
mov ecx, eax
mov edx, 0x4c5d8c
xor eax, eax
call fcn.004c560c
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x4c5a74
push 1
push 0
mov eax, dword [ebp - 0x18]
call fcn.00405dac
push eax
mov eax, dword [ebp - 0x10]
call fcn.00405dac
push eax
push 0x4c5d8c
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c5a8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c5ac6
lea eax, [ebp - 0x38]
call fcn.00405d10
lea eax, [ebp - 0x2c]
call fcn.00405d10
lea eax, [ebp - 0x24]
call fcn.00405d10
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00405d18
ret