Function at 0x455b10
Capabilities:
Create process on windows
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb30
mov eax, dword [0x6244f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
xor edi, edi
mov dword [ebp - 0xaf4], eax
push edi
push 0x5c6b38
call esi
mov dword [ebp - 0xaec], eax
test eax, eax
jne 0x455c60
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0xaf0]
mov dword [ebp - 0xaf0], edi
push eax
lea eax, [ebp - 0x414]
push eax
push 0x104
push edi
push 0x5c6b58
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x455bbe
push 0x10
push 0x5c6b70
push 0x5c6b80
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0056e41f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x414]
mov dword [ebp - 0xb28], edi
mov dword [ebp - 0xb20], eax
lea eax, [ebp - 0xb30]
push eax
mov dword [ebp - 0xb1c], edi
mov dword [ebp - 0xb18], edi
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xb0c], edi
mov dword [ebp - 0xb08], edi
mov dword [ebp - 0xb04], edi
mov dword [ebp - 0xb00], edi
mov dword [ebp - 0xafc], edi
mov dword [ebp - 0xaf8], edi
mov dword [ebp - 0xb30], 0x3c
mov dword [ebp - 0xb2c], 0x40
mov dword [ebp - 0xb24], 0x5be094
mov dword [ebp - 0xb14], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0xaf8]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push 0
push 0x5c6b38
call esi
mov dword [ebp - 0xaec], eax
test eax, eax
je 0x455db2
push 3
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 0xaec]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push 0x5c6bd4
push 0
push esi
call dword [sym.imp.USER32.dll_FindWindowExW]
mov esi, eax
test esi, esi
je 0x455db2
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x24
push 0x100
push esi
call edi
lea eax, [ebp - 0xae8]
push eax
push 0xffffffffffffffff
push 0
call dword [sym.imp.USER32.dll_EnumDisplaySettingsW]
cmp dword [ebp - 0xa40], 8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
jbe 0x455cca
push 0x32
call eax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, word [ebx]
test cx, cx
je 0x455d1a
cmp cx, 0x5c
jne 0x455cf0
cmp dword [ebp - 0xa40], 8
jbe 0x455ce5
push 0xa
call eax
push 0
push 0x27
push 0x100
jmp 0x455d04
movzx eax, cx
push 0
push eax
call fcn.0058885f
add esp, 4
push eax
push 0x102
push esi
call edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
jne 0x455cd2
mov esi, dword [ebp - 0xaf4]
test esi, esi
je 0x455dad
push 0
push 0x5c6bf0
push 0
push dword [ebp - 0xaec]
call dword [sym.imp.USER32.dll_FindWindowExW]
mov ebx, eax
test ebx, ebx
je 0x455dad
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_SetFocus]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0x24
push 0x100
push ebx
call edi
push esi
lea eax, [ebp - 0xa0c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ax, word [ebp - 0xa0c]
lea esi, [ebp - 0xa0c]
test ax, ax
je 0x455dad
movzx ecx, ax
movzx eax, cx
push 0
push eax
call fcn.0058885f
add esp, 4
push eax
push 0x102
push ebx
call edi
movzx eax, word [esi + 2]
lea esi, [esi + 2]
mov ecx, eax
test ax, ax
jne 0x455d88
mov edi, 1
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056e41f
mov esp, ebp
pop ebp
ret