Function at 0x403970
Capabilities:
Create process on windows
Get common file path
Hide graphical window
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x45d1d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x403bda
call fcn.00405310
mov dword [ebp - 0x420], eax
test eax, eax
je 0x403bda
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x470000
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x41c], edi
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.00405490
add esp, 8
test eax, eax
je 0x403bda
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x403bda
cmp dword [0x46fff0], 0
je 0x403a9e
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.00405060
add esp, 0xc
test eax, eax
je 0x403bda
lea eax, [ebp - 0x108]
mov dword [ebp - 0x45c], 0x3c
mov dword [ebp - 0x44c], eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x448], eax
lea eax, [ebp - 0x45c]
push eax
mov dword [ebp - 0x458], 0x40
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x403bc7
mov edi, dword [ebp - 0x424]
jmp 0x403b16
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.004051a0
add esp, 8
test eax, eax
je 0x403bda
push 0x44
lea eax, [ebp - 0x4b0]
push 0
push eax
call fcn.0040bad0
add esp, 0xc
mov dword [ebp - 0x4b0], 0x44
mov eax, 5
mov word [ebp - 0x480], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x4b0]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403bed
mov edi, dword [ebp - 0x46c]
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403b85
cmp dword [0x46fffc], 0
jne 0x403b78
push 0x450808
push 0
push 0
push 0
call esi
test eax, eax
je 0x403b78
nop dword [eax]
cmp dword [0x45d0f8], eax
jne 0x403b5a
push 0x450808
push 0
push eax
push 0
call esi
test eax, eax
jne 0x403b40
jmp 0x403b78
push 5
push eax
call ebx
mov eax, dword [ebp - 0x420]
dec eax
cmp dword [ebp - 0x418], eax
jne 0x403b78
push 0
push dword [0x45d0f8]
call ebx
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x403b23
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
je 0x403bda
mov edi, dword [ebp - 0x418]
add dword [ebp - 0x41c], 0x100
inc edi
mov dword [ebp - 0x418], edi
cmp edi, dword [ebp - 0x420]
jae 0x403bf8
mov edi, dword [ebp - 0x41c]
jmp 0x4039d4
call fcn.00415d0b
push dword [eax]
push 0x13
push 7
call fcn.00403800
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040acca
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x18
jmp 0x403bd0
cmp dword [0x46fffc], 0
jne 0x403c0b
push 0
push dword [0x45d0f8]
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040acca
mov esp, ebp
pop ebp
ret