Function at 0x448b4c
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffff60
push ebx
push esi
push edi
mov byte [ebp - 2], cl
mov ebx, edx
mov byte [ebp - 1], al
mov eax, 0x4ba564
call fcn.00458ea8
test bl, bl
je 0x448b80
test al, 1
jne 0x448b80
xor eax, eax
jmp 0x448ee7
call fcn.0044a3d0
mov edi, eax
mov byte [0x4be9b8], 0
xor eax, eax
call fcn.004529e0
lea edx, [ebp - 0xa0]
mov eax, 0x4ba564
call fcn.0045d130
mov ecx, 0x4b2ac4
mov edx, 0x4b26c4
mov eax, 0x4ba564
call fcn.0045d0fc
mov edx, dword [ebp - 0x90]
mov dword [0x4b127c], edx
mov byte [0x4b09a2], bl
mov dword [0x4b0e64], 1
xor ecx, ecx
mov dword [0x4b0948], ecx
xor eax, eax
mov dword [0x4b0974], eax
call fcn.0043e40a
lea edx, [ebp - 0x4a0]
mov eax, 0x4ba564
xor ecx, ecx
call fcn.0045d0fc
lea edx, [ebp - 0x8a0]
mov eax, 0x4ba564
xor ecx, ecx
call fcn.0045d0d0
mov dl, byte [ebp - 1]
lea ecx, [ebp - 0x4a0]
push edx
cmp dword [ebp - 0x2c], 0
setne al
and eax, 1
push eax
mov eax, 0x4be9b8
mov dl, byte [ebp + 8]
push edx
mov edx, 0x49c9d5
call fcn.0044982c
cmp byte [ebp - 1], 0
je 0x448c50
mov eax, 1
call fcn.0043e2fb
test al, al
jne 0x448c50
xor eax, eax
jmp 0x448ee7
cmp byte [ebp - 0x8a0], 0
jne 0x448c83
mov eax, 0x4b9834
call fcn.00463710
mov esi, eax
mov eax, 0x4b9834
call fcn.00463744
cmp esi, eax
jne 0x448c83
cmp dword [ebp - 0x2c], 0
je 0x448c7f
cmp byte [ebp - 0xb], 0
je 0x448c83
mov byte [ebp - 2], 1
cmp byte [ebp - 2], 0
je 0x448c9a
mov edx, 0x49cb51
mov eax, dword [0x4b32c4]
call fcn.0040efcc
jmp 0x448d11
mov eax, 0x4b9834
xor ecx, ecx
mov edx, dword [0x4b32c4]
call fcn.00463858
test al, al
jne 0x448cb7
xor eax, eax
jmp 0x448ee7
mov edx, dword [0x4b32c4]
cmp dword [edx + 0x30], 0
jne 0x448d11
lea ecx, [ebp - 0x8a0]
push ecx
lea eax, [ebp - 0xca0]
push eax
call fcn.0048d758
add esp, 8
cmp byte [ebp - 0xca0], 0
je 0x448ced
lea eax, [ebp - 0xca0]
call fcn.0040ba60
push 0x49cb51
lea edx, [ebp - 0xca0]
push edx
call fcn.0048d67c
add esp, 8
lea edx, [ebp - 0xca0]
mov eax, dword [0x4b32c4]
call fcn.0040efcc
cmp dword [ebp - 0x2c], 0
je 0x448d93
cmp byte [ebp - 0xb], 0
jne 0x448d93
mov eax, 0x4b9834
call fcn.00463710
mov esi, eax
test esi, esi
je 0x448d44
cmp byte [ebp - 0x8a0], 0
jne 0x448d93
mov eax, 0x4b9834
call fcn.00463744
cmp esi, eax
jne 0x448d93
test esi, esi
jne 0x448d4f
mov edx, 1
jmp 0x448d71
push 0x4b26c4
push 0x43f319
push dword [0x4b9820]
push str.ASKPROCESSVOLDLG
push dword [0x4a6fb8]
call sub.USER32.DLL_DialogBoxParamA
mov edx, eax
sub edx, 0xffffffff
je 0x448d7d
sub edx, 2
je 0x448d84
jmp 0x448d93
xor eax, eax
jmp 0x448ee7
mov edx, 0x49cb51
mov eax, dword [0x4b32c4]
call fcn.0040efcc
mov byte [ebp - 0x10a0], 0
test bl, bl
jne 0x448dfc
cmp byte [0x4be9b8], 0
je 0x448dfc
cmp dword [0x4b08ac], 5
je 0x448dfc
lea ecx, [ebp - 0x10a0]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, 0x4be9b8
xor ecx, ecx
xor edx, edx
call fcn.00409c94
push 0x4be9b8
call fcn.0048f15c
pop ecx
inc eax
jne 0x448dfc
push 0x4be9b8
mov eax, 0x1f7
call fcn.004116e0
push eax
call fcn.0044a170
add esp, 8
xor eax, eax
jmp 0x448ee7
mov eax, 0x4ba564
xor ecx, ecx
xor edx, edx
call fcn.00458638
cmp byte [ebp - 0x10a0], 0
je 0x448e20
lea eax, [ebp - 0x10a0]
push eax
call fcn.0048f15c
pop ecx
call fcn.0044a3d0
cmp edi, eax
jne 0x448e32
cmp dword [0x4bc1b8], 0
je 0x448e36
xor edx, edx
jmp 0x448e3b
mov edx, 1
mov byte [ebp - 3], dl
cmp byte [ebp - 3], 0
je 0x448ea3
test bl, bl
je 0x448e6d
push 0x40
mov eax, 0x3a7
call fcn.004116e0
push eax
mov eax, 0x3a8
call fcn.004116e0
push eax
push dword [0x4b9820]
call sub.USER32.DLL_MessageBoxA
jmp 0x448ea3
cmp dword [0x4b1a8c], 0
je 0x448ea3
mov edx, 0x4b2ac4
mov eax, 0x4b26c4
call fcn.0040a0c8
test al, al
jne 0x448ea3
mov eax, 0x4b9834
call fcn.004639fc
test al, al
je 0x448ea3
mov eax, 0x4b9834
xor edx, edx
call fcn.0045e1dc
mov byte [0x4b9db8], 0
mov eax, 0x4b9d8c
call fcn.0044546c
test bl, bl
jne 0x448ee4
cmp dword [0x4bc1b8], 0
jne 0x448ee4
cmp byte [0x4bedbd], 0
je 0x448ee4
push 1
push 0x49c9d5
push 0
push 0x4be9b8
push 0x49d43e
push 0
call sub.SHELL32.DLL_ShellExecuteA
mov al, byte [ebp - 3]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4