Function at 0x4754a0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x124
mov eax, dword [0x4bacc0]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x134]
push edi
mov edi, dword [0x49e3a0]
push 0
push str.ExploreWClass
call edi
test eax, eax
mov dword [0x4bf6f4], eax
jne 0x475596
push eax
push str.CabinetWClass
call edi
test eax, eax
mov dword [0x4bf6f4], eax
jne 0x475596
push eax
push 5
lea eax, [esp + 0x38]
push eax
push esi
call dword [0x49e2d4]
push 5
push 0x49e5e0
push 0x49e5e0
lea ecx, [esp + 0x3c]
push ecx
push str.explore
push esi
call dword [0x49e2bc]
mov ebx, dword [0x49e128]
mov eax, dword [0x4bf6f4]
mov ebp, 0x32
lea esp, [esp]
test eax, eax
jne 0x47556d
push 0x64
call ebx
push 0
push str.ExploreWClass
call edi
test eax, eax
mov dword [0x4bf6f4], eax
jne 0x475557
push eax
push str.CabinetWClass
call edi
mov dword [0x4bf6f4], eax
sub ebp, 1
jne 0x475530
mov dword [0x4bf6d0], 0
xor eax, eax
jmp 0x475746
test ebp, ebp
jne 0x47557e
mov dword [0x4bf6d0], ebp
xor eax, eax
jmp 0x475746
push 0x1f4
call ebx
mov eax, dword [0x4bf6f4]
mov dword [0x4bf6d8], 1
jmp 0x4755a0
mov dword [0x4bf6d8], 0
cmp dword [0x4bf6d0], 0
mov edi, dword [0x49e2fc]
jne 0x4755bc
push eax
call edi
mov dword [0x4bf6d4], eax
mov eax, dword [0x4bf6f4]
push eax
call edi
test eax, eax
je 0x4755d0
mov edx, dword [0x4bf6f4]
push edx
call dword [0x49e2e4]
cmp dword [0x4bf6d0], 0
mov edi, dword [0x49e480]
jne 0x4755ec
mov eax, dword [0x4bf6f4]
push eax
call edi
mov dword [0x4bf6dc], eax
mov ecx, dword [0x4bf6f4]
push ecx
call edi
test eax, eax
mov ebp, dword [0x49e318]
je 0x47560a
mov edx, dword [0x4bf6f4]
push 9
push edx
call ebp
cmp dword [0x4bf6d0], 0
mov ebx, dword [0x49e47c]
jne 0x475626
mov eax, dword [0x4bf6f4]
push 0x4bf6e0
push eax
call ebx
push esi
call edi
test eax, eax
mov dword [0x4bf6f0], eax
je 0x475637
push 9
push esi
call ebp
cmp dword [0x4bf6d0], 0
jne 0x475648
push 0x4bf6c0
push esi
call ebx
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x30
call dword [0x49e478]
mov eax, dword [esp + 0x13c]
cmp eax, 1
jne 0x4756cc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov edi, dword [0x49e484]
sub eax, ecx
cdq
push 0
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push 0
push esi
call edi
lea eax, [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, ecx
sub esi, eax
push 4
sub esi, edx
add esi, dword [esp + 0x20]
sub eax, ecx
mov ecx, dword [0x4bf6f4]
push esi
mov esi, dword [esp + 0x18]
sub ebx, esi
push ebx
add eax, edx
push eax
push esi
push 0
push ecx
jmp 0x475735
cmp eax, 3
jne 0x475737
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push 0
sub eax, edi
sub edx, ecx
push edx
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
push edi
mov edi, dword [0x49e484]
push 0
push esi
call edi
lea eax, [esp + 0x20]
push eax
push esi
call ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x10]
push 4
sub edx, ecx
push edx
mov edx, dword [esp + 0x28]
mov ebx, edx
sub ebx, eax
sub ebx, esi
add ebx, dword [esp + 0x20]
sub eax, edx
push ebx
push ecx
add eax, esi
push eax
mov eax, dword [0x4bf6f4]
push 0
push eax
call edi
mov dword [0x4bf6d0], 1
mov eax, 1
mov ecx, dword [esp + 0x130]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004810ab
add esp, 0x124
ret