Function at 0x45c99b
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4a3f4c
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x4d6674]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
push dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.00401a17
xor esi, esi
mov dword [esp + 0xc0], esi
push 0x3c
mov eax, SysReAllocStringLen
pop ebx
push ebx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
xor edi, edi
lea eax, [esp + 0x34]
push esi
inc edi
push eax
mov dword [esp + 0x78], 0x44
mov dword [esp + 0x7c], esi
mov dword [esp + 0x80], esi
mov dword [esp + 0x84], esi
mov dword [esp + 0x98], esi
mov dword [esp + 0x9c], esi
mov dword [esp + 0xa0], esi
mov dword [esp + 0xa4], edi
mov word [esp + 0xa8], 0xa
mov word [esp + 0xaa], si
mov dword [esp + 0xac], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0xb4], esi
mov dword [esp + 0xb8], esi
call fcn.004890f0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], 0x440
mov dword [esp + 0x4c], esi
mov dword [esp + 0x50], str.runas
mov dword [esp + 0x60], edi
call fcn.0045fd54
add esp, 0x14
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
mov byte [esp + 0xc0], 1
call fcn.00461052
test eax, eax
jne 0x45cde9
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.00462dd8
pop ecx
pop ecx
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 2
call fcn.004018c1
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
mov edi, str._WINDIR_
push edi
push ebx
call fcn.00460c15
test eax, eax
pop ecx
pop ecx
je 0x45cb80
call fcn.0046e7df
push eax
lea ecx, [esp + 0x20]
call fcn.00401764
mov eax, 0x104
push eax
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0xc8], 3
call fcn.004017a2
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00403395
push dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push edi
push ebx
push eax
call fcn.0046293f
add esp, 0x10
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 4
call fcn.004018c1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
push 0x4b63e4
push 0x4badd8
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.0046293f
add esp, 0x10
push eax
mov ecx, ebx
mov byte [esp + 0xc4], 5
call fcn.004018c1
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
lea ecx, [esp + 0x10]
call fcn.00461052
test eax, eax
je 0x45cc6c
cmp dword [ebp + 0x10], esi
je 0x45cc27
mov eax, dword [ebx]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x45cc27
mov esi, dword [esp + 0x68]
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffff0
call fcn.0040174a
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.0040174a
mov eax, esi
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.004017a2
mov edi, eax
mov eax, dword [ebx]
push dword [eax - 0xc]
mov ecx, ebx
call fcn.004017a2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
push esi
push 0x20
push esi
push esi
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
test eax, eax
je 0x45ce4f
mov esi, dword [esp + 0x20]
jmp 0x45cbf7
mov edi, 0x4b72f0
lea eax, [esp + 0x10]
push edi
push eax
call fcn.00460b6c
test eax, eax
pop ecx
pop ecx
jne 0x45ccee
push edi
lea edi, [esp + 0x14]
call fcn.004609e9
test eax, eax
pop ecx
jne 0x45ccee
mov edi, 0x4b72f0
lea eax, [esp + 0x1c]
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.00404dd4
push edi
push eax
lea eax, [esp + 0x28]
push eax
mov byte [esp + 0xd4], 6
call fcn.0040145d
add esp, 0x14
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 7
call fcn.004018c1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x1c]
add ecx, 0xfffffff0
call fcn.0040174a
lea eax, [esp + 0x18]
push 0x4b606c
push eax
mov ecx, ebx
call fcn.00404dd4
pop ecx
pop ecx
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 8
call fcn.0040157b
mov byte [esp + 0xc0], 1
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0040174a
cmp dword [ebp + 0x10], esi
je 0x45cd53
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45cbf3
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.004017a2
mov edi, eax
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.004017a2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_CreateProcessA]
push esi
push 0x20
push esi
push esi
push esi
push esi
push eax
call edi
test eax, eax
jne 0x45cc66
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.004017a2
mov dword [esp + 0x18], eax
mov eax, dword [ebx]
push dword [eax - 0xc]
mov ecx, ebx
call fcn.004017a2
mov ecx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
push dword [eax - 0xc]
call fcn.004017a2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push dword [esp + 0x20]
push esi
push 0x20
push esi
push esi
push esi
push dword [esp + 0x3c]
push eax
call edi
jmp 0x45cc5e
cmp dword [ebp + 0x10], esi
je 0x45ce15
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x48], eax
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x48], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x45cbf3
mov eax, dword [esp + 0x14]
push dword [eax - 0xc]
lea ecx, [esp + 0x18]
call fcn.004017a2
mov edi, eax
mov eax, dword [esp + 0x10]
push dword [eax - 0xc]
lea ecx, [esp + 0x14]
call fcn.004017a2
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x70]
push ecx
push edi
push esi
push 0x20
push esi
push esi
push esi
push esi
push eax
jmp 0x45cc58
mov ecx, ebx
call fcn.00461052
test eax, eax
jne 0x45cbf7
lea eax, [esp + 0x18]
push 0x4b578c
push eax
call fcn.00461ac5
push dword [ebp + 0x10]
mov byte [esp + 0xcc], 9
push eax
push dword [ebp + 8]
call fcn.0045c99b
mov ecx, dword [esp + 0x2c]
add esp, 0x14
add ecx, 0xfffffff0
mov esi, eax
call fcn.0040174a
jmp 0x45cbf7