Function at 0x448ff8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x449001
mov eax, dword [ebp - 4]
add esp, 0xfffff13c
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x22e], dl
mov byte [ebp - 0x22d], al
mov edi, 0x4ae7e4
mov eax, 0x49ddf8
call fcn.0048d8c4
test esi, esi
jne 0x44907d
mov eax, 0x4b982c
call fcn.0046374c
test eax, eax
jne 0x44907d
push 0x30
mov eax, 0x65
call fcn.004117b8
push eax
mov eax, 0x14c
call fcn.004117b8
push eax
push dword [0x4b9818]
call sub.USER32.DLL_MessageBoxA
mov edx, dword [ebp - 0x22c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4498ed
xor eax, eax
call fcn.00452aac
mov dword [0x4bcb00], 0
mov dword [0x4bcb04], 0
mov dword [0x4bcaf8], 0
mov dword [0x4bcafc], 0
call fcn.0044a49c
mov dword [ebp - 0x234], eax
mov word [ebp - 0x21c], 8
lea eax, [ebp - 0x110]
call fcn.00464dc4
add dword [ebp - 0x210], 6
mov word [ebp - 0x21c], 0x14
mov word [ebp - 0x21c], 0x20
lea eax, [ebp - 0x208]
call fcn.0040eedc
add dword [ebp - 0x210], 4
mov word [ebp - 0x21c], 0x14
test esi, esi
sete dl
and edx, 1
mov byte [ebp - 0x235], dl
mov word [ebp - 0x21c], 0x2c
cmp byte [ebp - 0x235], 0
je 0x449167
lea esi, [ebp - 0x208]
mov eax, 0x4b982c
xor ecx, ecx
xor edx, edx
call fcn.00463634
jmp 0x449148
lea ecx, [ebp - 0xa78]
lea edx, [ebp - 0xe78]
mov eax, esi
call fcn.0040f0ac
lea edx, [ebp - 0xe78]
mov eax, 0x4b982c
xor ecx, ecx
call fcn.00463634
test al, al
je 0x449167
cmp dword [0x4bc1ac], 0
je 0x449135
mov word [ebp - 0x21c], 0x14
jmp 0x4491eb
call fcn.0044a49c
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x21c], 0x14
test esi, esi
je 0x44920d
cmp dword [ebp + 0x14], 0
je 0x44920d
xor ebx, ebx
jmp 0x449212
mov ebx, 1
push 1
push ebx
push 0
push 1
lea ecx, [ebp - 0x110]
mov edx, 2
mov eax, esi
call fcn.004686b8
and eax, 0xff
cmp eax, 1
sbb edx, edx
neg edx
mov ebx, edx
test bl, bl
jne 0x4492ae
cmp dword [ebp - 0xc], 0
jne 0x4492ae
cmp dword [esi + 0x30], 1
jne 0x4492ae
mov eax, esi
call fcn.0040f26c
lea ecx, [ebp - 0x244]
lea edx, [ebp - 0x240]
mov eax, esi
call fcn.0040f1fc
test al, al
je 0x4492ae
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.0040a514
call fcn.0040a258
test al, al
jne 0x4492ae
lea edx, [ebp - 0x110]
push edx
push 0
push 0
push 0
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
call fcn.00468888
lea eax, [ebp - 0x110]
call fcn.004651b8
mov esi, dword [ebp - 0xc]
test bl, bl
jne 0x4492c7
test esi, esi
jne 0x449360
cmp dword [ebp + 0x10], 0
jne 0x449360
test bl, bl
jne 0x4492fb
call fcn.0044a49c
cmp eax, dword [ebp - 0x23c]
jne 0x4492fb
push 0x30
mov eax, 0x35f
call fcn.004117b8
push eax
mov eax, 0x35e
call fcn.004117b8
push eax
push dword [0x4b9818]
call sub.USER32.DLL_MessageBoxA
mov eax, 0x4b9d84
xor edx, edx
call fcn.00445478
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040eff8
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004393d4
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040eff8
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498ed
mov al, byte [ebp - 0x22e]
mov byte [edi + 0x21b6], al
xor edx, edx
mov dword [edi + 0x215c], edx
xor ecx, ecx
mov dword [edi + 0x2188], ecx
mov dword [edi + 0x2678], 1
call fcn.0043e51e
cmp byte [ebp - 0x22e], 0
mov byte [0x4be9b0], 0
jne 0x4494dd
mov byte [ebp - 0x245], 0
cmp esi, 1
jne 0x449425
lea ecx, [ebp - 0x1aa8]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.004650ec
lea ebx, [ebp - 0x1aa8]
push 1
push 0
lea ecx, [ebp - 0x3308]
lea eax, [ebp - 0x110]
xor edx, edx
call fcn.004650ec
lea eax, [ebp - 0x3308]
lea ecx, [ebp - 0x26d8]
add eax, 0x400
xor edx, edx
push eax
lea eax, [ebp - 0x110]
call fcn.004650ec
lea edx, [ebp - 0x26d8]
mov eax, 0x4ba55c
pop ecx
call fcn.0045bc70
mov eax, 0x4ba55c
call fcn.0045d1d0
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 0x245], dl
jmp 0x449443
lea ecx, [ebp - 0x3708]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x3708]
call fcn.0040b590
mov ebx, eax
cmp byte [ebx], 0
jne 0x44944d
mov ebx, 0x49cce4
mov al, byte [ebp - 0x22d]
push eax
mov eax, 0x4be9b0
mov dl, byte [ebp - 0x245]
push edx
mov edx, 0x49c965
mov cl, byte [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.004498f8
cmp byte [ebp - 0x22d], 0
je 0x4494dd
mov eax, esi
call fcn.0043e40f
test al, al
jne 0x4494dd
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040eff8
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004393d4
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040eff8
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498ed
cmp dword [ebp + 0x10], 0
je 0x4494f3
push 0x4be9b0
push dword [ebp + 0x10]
call fcn.0048d424
add esp, 8
test esi, esi
jne 0x449550
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040eff8
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004393d4
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040eff8
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
jmp 0x4498ed
mov dword [0x4bcaf4], esi
cmp dword [0x4bc1a4], 0
jne 0x449569
mov dword [0x4bc1a4], 2
xor ebx, ebx
jmp 0x449788
mov eax, dword [edi + 0x4ae4]
call fcn.0040f074
mov eax, dword [edi + 0x4ad8]
call fcn.0040f074
mov byte [ebp - 0x3b08], 0
cmp dword [ebp + 0x14], 0
je 0x4495a6
lea edx, [ebp - 0x3b08]
mov ecx, 0x400
mov eax, dword [ebp + 0x14]
call fcn.0040f128
cmp byte [ebp - 0x3b08], 0
je 0x4495b7
lea edx, [ebp - 0x3b08]
jmp 0x4495bc
mov edx, 0x49cae1
mov eax, dword [edi + 0x4ad8]
call fcn.0040f0a4
lea ecx, [ebp - 0x4738]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650ec
lea eax, [ebp - 0x4738]
lea edx, [edi + 0x3ed8]
call fcn.0040a580
lea ecx, [ebp - 0x5368]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650ec
lea eax, [ebp - 0x5368]
lea edx, [edi + 0x42d8]
add eax, 0x400
call fcn.0040a5c8
mov byte [ebp - 0x5768], 0
cmp byte [0x4be9b0], 0
je 0x449690
cmp dword [edi + 0x20c0], 5
je 0x449690
push 0x4be9b0
lea ecx, [ebp - 0x5b68]
push ecx
call fcn.0048d424
add esp, 8
lea eax, [ebp - 0x5768]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [ebp - 0x5b68]
xor ecx, ecx
xor edx, edx
call fcn.00409cac
lea eax, [ebp - 0x5b68]
push eax
call fcn.0048ee28
pop ecx
inc eax
jne 0x449690
lea edx, [ebp - 0x5b68]
mov eax, 0x1f7
push edx
call fcn.004117b8
push eax
call fcn.0044a23c
add esp, 8
jmp 0x449799
lea eax, [edi + 0x3ed8]
call fcn.0040b590
push eax
cmp byte [edi + 0x21b6], 0
je 0x4496ac
mov eax, 0x20b
jmp 0x4496b1
mov eax, 0x20a
call fcn.004117b8
push eax
lea edx, [ebp - 0x6168]
push edx
call fcn.004902f4
add esp, 0xc
lea eax, [ebp - 0x6168]
call fcn.004775b4
call fcn.00476b3c
push 1
push 0
lea ecx, [edi + 0x42d8]
lea edx, [edi + 0x3ed8]
mov eax, 0x4ba55c
call fcn.0045bc70
mov edx, dword [0x4ba764]
xor ecx, ecx
mov dword [edi + 0x2a90], edx
xor edx, edx
mov eax, 0x4ba55c
call fcn.004586e0
cmp byte [ebp - 0x5768], 0
je 0x449720
lea eax, [ebp - 0x5768]
push eax
call fcn.0048ee28
pop ecx
lea edx, [ebx + 1]
push edx
push dword [ebp - 0xc]
mov eax, 0x35d
call fcn.004117b8
push eax
lea edx, [ebp - 0x6268]
push edx
call fcn.004902f4
add esp, 0x10
lea edx, [ebp - 0x6268]
mov eax, 0x4b9d84
call fcn.00445478
lea ecx, [ebp - 0x6e98]
lea eax, [ebp - 0x110]
mov edx, ebx
call fcn.004650ec
lea ecx, [ebp - 0x6e98]
mov eax, dword [ecx + 0xc00]
mov edx, dword [ecx + 0xc04]
add dword [0x4bcaf8], eax
adc dword [0x4bcafc], edx
call fcn.004778c0
inc ebx
cmp esi, ebx
jle 0x449799
cmp dword [0x4bc1ac], 0
je 0x449570
cmp dword [0x4bc1a4], 2
jne 0x4497a9
xor eax, eax
mov dword [0x4bc1a4], eax
cmp byte [ebp + 8], 0
je 0x4497ba
push dword [0x4b9824]
call sub.USER32.DLL_DestroyWindow
mov eax, 0x4b9d84
xor edx, edx
call fcn.00445478
mov byte [0x4b9db0], 0
mov eax, 0x4b9d84
call fcn.00445538
cmp byte [ebp - 0x22e], 0
je 0x449823
cmp dword [0x4bc1b0], 0
jne 0x449899
call fcn.0044a49c
cmp eax, dword [ebp - 0x234]
jne 0x449899
push 0x40
mov eax, 0x3a7
call fcn.004117b8
push eax
mov eax, 0x3a8
call fcn.004117b8
push eax
push dword [0x4b9818]
call sub.USER32.DLL_MessageBoxA
jmp 0x449899
cmp byte [ebp - 0x235], 0
je 0x449899
cmp dword [0x4bc1b0], 0
jne 0x449858
cmp byte [0x4bedb5], 0
je 0x449858
push 1
push 0x49c965
push 0
push 0x4be9b0
push 0x49d3ca
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov byte [ebp - 0x7298], 0
lea edx, [ebp - 0x7ec8]
mov eax, 0x4b982c
call fcn.004637f8
test al, al
je 0x449889
lea edx, [ebp - 0x7ec8]
push edx
lea ecx, [ebp - 0x7298]
push ecx
call fcn.0048d424
add esp, 8
lea edx, [ebp - 0x7298]
mov eax, 0x4b982c
call fcn.0045e284
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.0040eff8
dec dword [ebp - 0x210]
dec dword [ebp - 0x210]
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.004393d4
sub dword [ebp - 0x210], 4
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.0040eff8
mov ecx, dword [ebp - 0x22c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10