Function at 0x416c50
Capabilities:
Create process on windows
Get common file path
Get file system object information
Get startup folder

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [0x477b14]
push ebx
mov dword [esp + 0x35c], eax
mov eax, dword [0x4804f4]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jne 0x4177f4
push 0x4804ec
mov dword [0x47d150], ebx
mov dword [0x47cfb8], ebx
mov dword [0x4804f4], 1
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp dword [0x4804f0], ebx
jne 0x416cd6
push 0x4001
xor eax, eax
mov ecx, 0xad
lea edi, [esp + 0xac]
push 0x2b4
rep stosd dword es:[edi], eax
lea eax, [esp + 0xb0]
push eax
push ebx
push 0x4689f4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [0x4804f0], eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
xor eax, eax
mov ecx, 0x12c
mov edi, 0x47d158
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x47d608
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x47dab8
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x47df68
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x47e418
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x47e8c8
rep stosd dword es:[edi], eax
mov ecx, 0x12c
mov edi, 0x480038
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0x14]
cmp edi, 0xb
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
mov dword [0x4804f8], ebx
mov dword [esp + 0x14], ebx
jne 0x4174bd
mov dword [0x47e8c8], ebx
mov dword [0x47e418], ebx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea edx, [esp + 0x18]
push edx
push 2
push esi
mov dword [0x480038], eax
mov dword [0x47f6d8], ebx
mov dword [0x47f228], ebx
mov dword [0x47df68], ebx
call edi
push 0xc8
call fcn.00445884
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push eax
mov dword [0x47e8cc], eax
call fcn.00415e70
add esp, 8
mov dword [0x47e41c], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, dword [0x47e8cc]
push 0x47df6c
mov dword [0x48003c], eax
mov eax, dword [esp + 0x18]
push 0x469a3c
push ebx
mov dword [0x47f6dc], eax
mov eax, dword [esp + 0x28]
push edx
mov dword [0x47f22c], ebx
mov dword [0x47fb8c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test byte [0x49222c], 0x10
je 0x416e64
lea eax, [esp + 0x18]
push eax
push 0x17
push esi
call edi
mov eax, dword [esp + 0x18]
push eax
mov dword [0x47dabc], eax
call fcn.00415e70
mov edx, dword [0x47dabc]
add esp, 4
push 0x47d15c
push 0x469a3c
push ebx
mov dword [0x47d60c], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
lea eax, [esp + 0x18]
push eax
push 6
push esi
call edi
push 0xc8
call fcn.00445884
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push eax
mov dword [0x47e8d0], eax
call fcn.00415e70
add esp, 8
mov dword [0x47e420], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [esp + 0x14]
push 0x47df70
push 0x469a3c
mov dword [0x47f6e0], ecx
mov ecx, dword [0x47e8d0]
push ebx
mov dword [0x480040], eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [0x47f230], ebx
mov dword [0x47fb90], ebx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
lea edx, [esp + 0x18]
push edx
push 5
push esi
call edi
push 0xc8
call fcn.00445884
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
push eax
mov dword [0x47e8d4], eax
call fcn.00415e70
add esp, 8
mov dword [0x47e424], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, dword [0x47e8d4]
push 0x47df74
mov dword [0x480044], eax
mov eax, dword [esp + 0x18]
push 0x469a3c
push ebx
mov dword [0x47f6e4], eax
mov eax, dword [esp + 0x28]
push edx
mov dword [0x47f234], ebx
mov dword [0x47fb94], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
lea eax, [esp + 0x18]
push eax
push 8
push esi
call edi
push 0xc8
call fcn.00445884
mov esi, eax
mov eax, dword [esp + 0x1c]
push eax
mov dword [0x47e8d8], eax
call fcn.00415e70
add esp, 8
mov dword [0x47e428], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [0x480048], eax
mov eax, dword [esp + 0x1c]
push 0x47df78
mov dword [0x47f6e8], esi
mov dword [0x47f238], ebx
mov dword [0x47fb98], ebx
mov ecx, dword [eax]
push 0x469a3c
mov edx, dword [0x47e8d8]
push ebx
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [0x47f6dc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Programs
push eax
call ebx
push 1
push 3
call fcn.004218c0
mov ecx, dword [0x47f6dc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 8
push ecx
mov dword [esp + 0x50], eax
call esi
mov ecx, dword [0x47f6dc]
push ecx
lea edi, [ecx + eax*2 + 2]
call esi
mov edx, dword [0x47f6dc]
mov ecx, dword [esp + 0x4c]
mov dword [edx + eax*2 + 4], ecx
mov byte [edi], 2
mov edx, dword [0x47f6dc]
mov eax, dword [0x48003c]
mov ecx, dword [0x480038]
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
push edx
push eax
push 0x110
push ecx
call edi
mov edx, dword [0x47f6e0]
push str.Favorites
push edx
call ebx
push 1
push 0x2b
call fcn.004218c0
mov dword [esp + 0x64], eax
mov eax, dword [0x47f6e0]
add esp, 8
push eax
call esi
mov ecx, dword [0x47f6e0]
lea edx, [ecx + eax*2 + 2]
push ecx
mov dword [esp + 0x14], edx
call esi
mov ecx, dword [0x47f6e0]
mov edx, dword [esp + 0x5c]
mov dword [ecx + eax*2 + 4], edx
mov eax, dword [esp + 0x10]
mov byte [eax], 2
mov ecx, dword [0x47f6e0]
mov edx, dword [0x480040]
mov eax, dword [0x480038]
push ecx
push edx
push 0x110
push eax
call edi
mov ecx, dword [0x47f6e4]
push str.My_Documents
push ecx
call ebx
mov edx, dword [0x49222c]
and edx, 0x1011
neg edx
sbb edx, edx
and edx, 0x6a
add edx, 0x14
push 1
push edx
call fcn.004218c0
add esp, 8
mov dword [esp + 0x58], eax
mov eax, dword [0x47f6e4]
push eax
call esi
mov ecx, dword [0x47f6e4]
lea edx, [ecx + eax*2 + 2]
push ecx
mov dword [esp + 0x14], edx
call esi
mov ecx, dword [0x47f6e4]
mov edx, dword [esp + 0x58]
mov dword [ecx + eax*2 + 4], edx
mov eax, dword [esp + 0x10]
mov byte [eax], 2
mov ecx, dword [0x47f6e4]
mov edx, dword [0x480044]
mov eax, dword [0x480038]
push ecx
push edx
push 0x110
push eax
call edi
mov ecx, dword [0x47f6e8]
push str.Recent
push ecx
call ebx
push 1
push 0x14
call fcn.004218c0
mov edx, dword [0x47f6e8]
add esp, 8
push edx
mov dword [esp + 0x3c], eax
call esi
mov ecx, dword [0x47f6e8]
lea eax, [ecx + eax*2 + 2]
push ecx
mov dword [esp + 0x14], eax
call esi
mov ecx, dword [0x47f6e8]
mov edx, dword [esp + 0x38]
mov dword [ecx + eax*2 + 4], edx
mov eax, dword [esp + 0x10]
mov byte [eax], 2
mov ecx, dword [0x47f6e8]
mov edx, dword [0x480048]
mov eax, dword [0x480038]
push ecx
push edx
push 0x110
push eax
call edi
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push str.Control_panel
push 0x47cd48
mov dword [esp + 0x1c], eax
call ebx
push 1
push 0x15
call fcn.004218c0
add esp, 8
push 0x47cd48
mov dword [esp + 0x54], eax
call esi
push 0x47cd48
mov word [eax*2 + 0x47cd4a], 2
call esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
push 0x47cd48
push 9
push pe_nt_image_headers32
push edx
mov dword [eax*2 + 0x47cd4c], ecx
call edi
mov eax, dword [esp + 0x14]
push 0
push 0
push 0x800
push eax
call edi
push str.Network
push 0x47cc10
call ebx
push 1
push 0x11
call fcn.004218c0
add esp, 8
push 0x47cc10
mov dword [esp + 0x40], eax
call esi
push 0x47cc10
mov word [eax*2 + 0x47cc12], 2
call esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
push 0x47cc10
push 0xa
push pe_nt_image_headers32
push edx
mov dword [eax*2 + 0x47cc14], ecx
call edi
push str.Printers
push 0x47cce0
call ebx
mov eax, dword [0x49222c]
and eax, 0x1011
neg eax
sbb eax, eax
and eax, 3
add eax, 0x37
push 1
push eax
call fcn.004218c0
add esp, 8
push 0x47cce0
mov dword [esp + 0x34], eax
call esi
push 0x47cce0
mov word [eax*2 + 0x47cce2], 2
call esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
push 0x47cce0
push 0xb
push pe_nt_image_headers32
push edx
mov dword [eax*2 + 0x47cce4], ecx
call edi
push str.Display_properties
push 0x47cc78
call ebx
mov eax, dword [0x49222c]
and eax, 0x1011
neg eax
sbb eax, eax
and eax, 0x6a
add eax, 0x23
push 1
push eax
call fcn.004218c0
add esp, 8
push 0x47cc78
mov dword [esp + 0x38], eax
call esi
push 0x47cc78
mov word [eax*2 + 0x47cc7a], 2
call esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
push 0x47cc78
push 0xc
push pe_nt_image_headers32
push edx
mov dword [eax*2 + 0x47cc7c], ecx
call edi
push str.Settings
push 0x47cee8
call ebx
push 1
push 0x15
call fcn.004218c0
add esp, 8
push 0x47cee8
mov dword [esp + 0x48], eax
call esi
push 0x47cee8
mov word [eax*2 + 0x47ceea], 2
call esi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
push 0x47cee8
push edx
mov dword [eax*2 + 0x47ceec], ecx
mov eax, dword [0x480038]
push 0x110
push eax
call edi
push str.Find
push 0x47cf50
call ebx
push 1
push 0x16
call fcn.004218c0
add esp, 8
push 0x47cf50
mov dword [esp + 0x58], eax
call esi
lea ecx, [eax*2 + 0x47cf52]
push 0x47cf50
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [esp + 0x54]
mov ecx, dword [0x480038]
push 0x47cf50
push 0x11
mov dword [eax*2 + 0x47cf54], edx
mov eax, dword [esp + 0x18]
push pe_nt_image_headers32
push ecx
mov byte [eax], 2
call edi
push str.Windows_Guide
push 0x47ce80
call ebx
push 1
push 0x17
call fcn.004218c0
add esp, 8
push 0x47ce80
mov dword [esp + 0x44], eax
call esi
push 0x47ce80
mov word [eax*2 + 0x47ce82], 2
call esi
mov edx, dword [esp + 0x40]
push 0x47ce80
push 0x12
mov dword [eax*2 + 0x47ce84], edx
mov eax, dword [0x480038]
push pe_nt_image_headers32
push eax
call edi
push 0x4688f4
push 0x47ce18
call ebx
push 1
push 0x18
call fcn.004218c0
add esp, 8
push 0x47ce18
mov dword [esp + 0x30], eax
call esi
lea ecx, [eax*2 + 0x47ce1a]
push 0x47ce18
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [esp + 0x2c]
push 0x47ce18
mov dword [eax*2 + 0x47ce1c], edx
mov eax, dword [esp + 0x14]
push 0x13
mov byte [eax], 2
push pe_nt_image_headers32
mov ecx, dword [0x480038]
push ecx
call edi
mov edx, dword [0x480038]
push 0
push 0
push 0x800
push edx
call edi
push str.Shutdown
push 0x47cdb0
call ebx
push 1
push 0x1b
call fcn.004218c0
add esp, 8
push 0x47cdb0
mov dword [esp + 0x4c], eax
call esi
push 0x47cdb0
lea ebx, [eax*2 + 0x47cdb2]
call esi
mov ecx, dword [esp + 0x48]
mov edx, dword [0x480038]
push 0x47cdb0
push 0x14
push pe_nt_image_headers32
mov dword [eax*2 + 0x47cdb4], ecx
push edx
mov byte [ebx], 2
call edi
mov dword [0x4804e8], 6
xor ebx, ebx
jmp 0x4175cb
mov esi, dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4174e8
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push ebx
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x70]
push edx
mov edx, dword [ebp + 0xc]
push esi
push ebx
push edx
push eax
call dword [ecx + 0xc]
jmp 0x417502
cmp edi, ebx
je 0x4174fe
mov ecx, dword [ebp + 0xc]
lea eax, [esp + 0x18]
push eax
push edi
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
jmp 0x417502
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
push eax
mov dword [0x47e8c8], eax
call fcn.00415e70
add esp, 4
mov dword [0x47e418], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x47e8c8]
push 0x47df68
push 0x469a3c
push ebx
mov dword [0x480038], eax
mov eax, dword [esp + 0x28]
push ecx
mov dword [0x47ed78], ebx
mov dword [0x47f6d8], ebx
mov dword [0x47f228], ebx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
test byte [0x49222c], 0x10
mov dword [0x4804e8], 1
je 0x4175be
cmp edi, 2
jne 0x417571
mov eax, 0x17
jmp 0x41757b
cmp edi, 6
jne 0x4175be
mov eax, 0x1f
lea edx, [esp + 0x20]
push edx
push eax
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esp + 0x20]
push eax
mov dword [0x47dab8], eax
call fcn.00415e70
mov edx, dword [0x47dab8]
add esp, 4
push 0x47d158
push 0x469a3c
push ebx
mov dword [0x47d608], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
push eax
call fcn.00415ff0
add esp, 8
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
je 0x4175e1
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x64], edx
jmp 0x4175ec
lea eax, [esp + 0x60]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [ebp + 8]
mov ecx, dword [esp + 0x60]
mov edx, dword [esp + 0x64]
xor esi, esi
cmp edi, ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], edx
je 0x4176da
mov ecx, dword [edi + 0xb94]
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.0042ff20
cmp word [edi + 0x7cc], 0x31
jne 0x4176da
mov ax, word [edi + 0x7ce]
mov ecx, 0x30
cmp ax, cx
jne 0x41765c
mov edx, dword [esp + 0x24]
xor eax, eax
cmp word [edi + 0x7d2], cx
mov dword [esp + 0x20], edx
setne al
dec eax
and eax, 8
mov esi, eax
jmp 0x417694
cmp ax, 0x31
mov eax, dword [edi + 0x7b4]
jne 0x41767a
cdq
sub eax, edx
mov edx, dword [esp + 0x24]
sar eax, 1
add eax, edx
mov esi, 4
jmp 0x417690
add eax, dword [esp + 0x24]
xor edx, edx
cmp word [edi + 0x7d2], cx
setne dl
dec edx
and edx, 8
mov esi, edx
mov dword [esp + 0x20], eax
mov ax, word [edi + 0x7d0]
cmp ax, cx
jne 0x4176a6
mov eax, dword [esp + 0x28]
jmp 0x4176ca
cmp ax, 0x31
mov eax, dword [edi + 0x7b8]
jne 0x4176c6
mov ecx, dword [esp + 0x28]
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov dword [esp + 0x10], eax
or esi, 0x10
jmp 0x4176da
add eax, dword [esp + 0x28]
cmp word [edi + 0x7d4], cx
mov dword [esp + 0x10], eax
jne 0x4176da
or esi, 0x20
mov ecx, dword [ebp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push ebx
push ecx
mov ecx, dword [0x480038]
push ebx
push edx
push eax
or esi, 0x100
push esi
push ecx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp eax, ebx
je 0x41776b
mov edx, dword [0x47d150]
add eax, 0xffffffc3
cmp eax, ebx
jle 0x417719
nop
dec eax
mov edx, dword [edx + 0x198]
jne 0x417710
xor eax, eax
mov ecx, 0xf
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov dword [esp + 0x6c], 0x3c
mov dword [esp + 0x84], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x88], 0xa
mov dword [esp + 0x70], 0xc
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov edx, dword [edx]
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x94], edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [esp + 0x4c]
cmp eax, ebx
je 0x4177d0
mov esi, dword [sym.imp.USER32.dll_DestroyIcon]
push eax
call esi
mov ecx, dword [esp + 0x5c]
push ecx
call esi
mov edx, dword [esp + 0x58]
push edx
call esi
mov eax, dword [esp + 0x38]
push eax
call esi
mov ecx, dword [esp + 0x54]
push ecx
call esi
mov edx, dword [esp + 0x40]
push edx
call esi
mov eax, dword [esp + 0x2c]
push eax
call esi
mov ecx, dword [esp + 0x48]
push ecx
call esi
mov edx, dword [esp + 0x50]
push edx
call esi
mov eax, dword [esp + 0x30]
push eax
call esi
mov ecx, dword [esp + 0x34]
push ecx
call esi
mov edx, dword [esp + 0x3c]
push edx
call esi
mov eax, dword [esp + 0x44]
push eax
call esi
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x4177e9
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
call fcn.00416820
mov dword [0x4804f4], ebx
mov ecx, dword [esp + 0x364]
call fcn.00444c27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret