Function at 0x404e00
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x43c0a6
mov eax, dword fs:[0]
push eax
mov eax, 0x1820
call fcn.00426290
mov eax, dword [0x44dc1c]
xor eax, esp
mov dword [esp + 0x1818], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44dc1c]
xor eax, esp
push eax
lea eax, [esp + 0x1834]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1844]
push 0x800
xor ebx, ebx
lea eax, [esp + 0x830]
push ebx
push eax
mov esi, ecx
call fcn.004260b0
add esp, 0xc
push 0x800
lea ecx, [esp + 0x2c]
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x30], ebx
call fcn.004260b0
add esp, 0xc
mov dword [esp + 0x183c], ebx
call fcn.00419116
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x404ea0
push 0x80004005
call fcn.00401e70
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov byte [esp + 0x183c], 1
cmp byte [esi + 0x1200], bl
je 0x40509a
cmp ebp, ebx
je 0x40506b
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404ed1
sub eax, edx
sar eax, 1
je 0x40506b
push 0x800
lea ecx, [esp + 0x1030]
push ebx
push ecx
call fcn.004260b0
lea edx, [esi + 0x800]
mov eax, edx
add esp, 0xc
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404f07
sub eax, edi
sar eax, 1
je 0x404f36
push edx
push ebp
push str._s_s
lea edx, [esp + 0x1038]
push 0x400
push edx
call fcn.0042482a
add esp, 0x14
jmp 0x404f51
push 0x3ff
push ebp
lea eax, [esp + 0x1034]
push 0x400
push eax
call fcn.0042400b
add esp, 0x10
lea edi, [esp + 0x102c]
call fcn.00409030
test al, al
je 0x40503d
push 0x800
lea ecx, [esp + 0x830]
push ebx
push ecx
call fcn.004260b0
add esp, 0xc
push str.start_here.htm
mov edx, edi
push edx
push str._s_s
lea eax, [esp + 0x838]
push 0x400
push eax
call fcn.0042482a
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea ecx, [esp + 0x82c]
push ecx
call esi
test eax, eax
jne 0x4050c9
push 0x800
lea edx, [esp + 0x830]
push ebx
push edx
call fcn.004260b0
add esp, 0xc
push str.troubleshooting.htm
mov eax, edi
push eax
push str._s_s
lea ecx, [esp + 0x838]
push 0x400
push ecx
call fcn.0042482a
add esp, 0x14
lea edx, [esp + 0x82c]
push edx
call esi
test eax, eax
jne 0x4050c9
mov eax, edi
push eax
push str.Target_manual_file_was_not_found_under___s_
mov ecx, 0x45a600
call fcn.00412540
add esp, 8
lea ecx, [esp + 0x14]
mov byte [esp + 0x183c], bl
call fcn.004023d0
lea eax, [esp + 0x1c]
mov dword [esp + 0x183c], 0xffffffff
call fcn.00412b90
jmp 0x405196
lea ecx, [esp + 0x102c]
push ecx
push esi
push str.Compress_the_file__s__to___s__fail__
mov ecx, 0x45a600
call fcn.00412540
mov byte [esp + 0x1848], bl
mov eax, dword [esp + 0x20]
add esp, 0xc
add eax, 0xfffffff0
jmp 0x40515d
push esi
push str.Temp_directory_is_invalid....._Open_Fail______s_
mov ecx, 0x45a600
call fcn.00412540
lea eax, [edi - 0x10]
add esp, 8
mov byte [esp + 0x183c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40516a
push str.manual_file_will_be_opend_by_saved_in_Local
mov ecx, 0x45a600
call fcn.00412540
add esp, 4
push 0x3ff
push esi
lea ecx, [esp + 0x834]
push 0x400
push ecx
call fcn.0042400b
add esp, 0x10
jmp 0x4050cd
mov edi, dword [esp + 0x14]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 1
push ebx
push ebx
lea edx, [esp + 0x838]
push edx
push str.opennew
push ebx
call esi
cmp eax, 0x20
jbe 0x405105
lea eax, [esp + 0x82c]
push eax
push str.open___s__success__
mov ecx, 0x45a600
call fcn.00412540
jmp 0x405150
push 1
push ebx
push ebx
lea ecx, [esp + 0x838]
push ecx
push str.open
push ebx
call esi
cmp eax, 0x20
jbe 0x405137
lea edx, [esp + 0x82c]
push edx
push str.open___s__success__
mov ecx, 0x45a600
call fcn.00412540
jmp 0x405150
lea ecx, [esp + 0x82c]
push ecx
push str.open___s__success__
mov ecx, eax
mov edx, 0x45a600
call fcn.00412400
add esp, 8
mov byte [esp + 0x183c], bl
lea eax, [edi - 0x10]
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x405176
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x183c], 0xffffffff
cmp byte [esp + 0x20], bl
je 0x405196
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x405196
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1834]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1818]
xor ecx, esp
call fcn.0042397a
add esp, 0x182c
ret 4