Function at 0x4cfea4
Capabilities:
Create process on windows
Get common file path
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4cfeac
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4d00f1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x487374]
call fcn.0040332c
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x14]
mov eax, dword [esi + 0xc]
call fcn.004876d0
mov ebx, eax
mov eax, dword [ebp - 0x14]
call fcn.0040335c
cmp byte [esi + 8], 0
je 0x4cff47
test ebx, ebx
je 0x4cff47
push ebx
push 1
push 6
push ebx
call sub.user32.dll_PostMessageA
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
je 0x4d00c9
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoA
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoA
push ebx
call sub.user32.dll_GetLastActivePopup
push eax
call sub.user32.dll_SetForegroundWindow
push 1
push ebx
call sub.user32.dll_ShowWindow
jmp 0x4d00c9
cmp dword [esi + 4], 0
je 0x4d00c9
lea eax, [ebp - 0xc]
mov edx, dword [esi + 4]
call fcn.004041c8
mov edx, dword [ebp - 0xc]
mov eax, 0x4d0108
call fcn.00404734
mov ebx, eax
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 1
call fcn.00404690
mov edx, dword [ebp - 0xc]
mov eax, 0x4d0108
call fcn.00404734
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.00404650
cmp dword [ebp - 4], 0
jne 0x4cffb8
lea eax, [ebp - 4]
mov edx, dword [esi + 4]
call fcn.004041c8
lea eax, [ebp - 0xc]
call fcn.00404130
jmp 0x4cffe9
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, 1
call fcn.00404690
jmp 0x4cffdb
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.00404690
cmp dword [ebp - 0xc], 0
je 0x4cffe9
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x20
je 0x4cffc9
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004041c8
mov eax, 0xff
call fcn.00409158
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 8]
call fcn.00404648
mov dl, byte [ebx]
mov byte [eax], dl
mov eax, dword [ebp - 8]
call fcn.00408ba0
cmp al, 1
jne 0x4d002e
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004041c8
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408e60
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.00408330
mov eax, dword [ebp - 0x18]
mov edx, 0x4d0114
call fcn.0040453c
je 0x4d00b9
mov eax, dword [ebp - 0x18]
mov edx, 0x4d0124
call fcn.0040453c
jne 0x4d0074
push 1
mov eax, dword [esi + 4]
call fcn.004045f0
push eax
call sub.kernel32.dll_WinExec
jmp 0x4d00c9
push 1
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00408df4
mov eax, dword [ebp - 0x20]
call fcn.004045f0
push eax
mov eax, dword [ebp - 0xc]
call fcn.004045f0
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00408e28
mov eax, dword [ebp - 0x24]
call fcn.004045f0
push eax
push 0x4d012c
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4d00c9
push 1
mov eax, dword [ebp - 4]
call fcn.004045f0
push eax
call sub.winmm.dll_sndPlaySoundA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d00f8
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.00404154
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404154
ret