Function at 0x48ddc4
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x48ddcc
push ebx
push esi
push edi
mov byte [ebp - 0x19], dl
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x48e1ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1a], 0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
call fcn.0040cb4c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x48de0b
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x48e1cc
mov eax, dword [0x558a90]
cmp dword [eax], 6
jl 0x48def5
mov eax, dword [0x558ecc]
cmp dword [eax], 2
jl 0x48def5
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040615c
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040615c
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.0040615c
mov dl, 1
mov eax, dword [0x435d7c]
call fcn.00435eb8
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00435f58
mov edx, 0x48e220
mov eax, ebx
call fcn.00435fbc
test al, al
je 0x48de95
lea ecx, [ebp - 4]
mov edx, 0x48e2c8
mov eax, ebx
call fcn.00436208
lea ecx, [ebp - 8]
mov edx, 0x48e2e4
mov eax, ebx
call fcn.00436208
cmp dword [ebp - 4], 0
je 0x48deec
cmp dword [ebp - 8], 0
je 0x48deec
mov edx, 0x80000000
mov eax, ebx
call fcn.00435f58
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x48e2fc
call fcn.0048e740
mov edx, dword [ebp - 0x2c]
mov eax, ebx
call fcn.00435fbc
test al, al
je 0x48dee4
lea ecx, [ebp - 0xc]
xor edx, edx
mov eax, ebx
call fcn.00436208
cmp dword [ebp - 0xc], 0
setne byte [ebp - 0x1a]
mov eax, ebx
call fcn.00403d8c
jmp 0x48def9
mov byte [ebp - 0x1a], 1
cmp byte [ebp - 0x1a], 0
je 0x48df9a
mov eax, dword [0x558a90]
cmp dword [eax], 0xa
jl 0x48df9a
mov eax, dword [0x558b44]
cmp dword [eax], 0x295a
jl 0x48df9a
xor eax, eax
push ebp
push 0x48df90
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x435d7c]
call fcn.00435eb8
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00435f58
mov edx, 0x48e334
mov eax, ebx
call fcn.00436394
test al, al
jne 0x48df76
mov edx, 0x48e3cc
mov eax, ebx
call fcn.00436394
test al, al
jne 0x48df76
mov edx, 0x48e45c
mov eax, ebx
call fcn.00436394
test al, al
je 0x48df7a
xor eax, eax
jmp 0x48df7c
mov al, 1
mov byte [ebp - 0x1a], al
mov eax, ebx
call fcn.00403d8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48df9a
cmp byte [ebp - 0x1a], 0
je 0x48e015
xor edx, edx
push ebp
push 0x48e007
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x48dfdb
push 0
push 0
push 1
mov eax, dword [ebp - 0x18]
call fcn.00406194
mov ecx, eax
mov edx, 0x48e4cc
xor eax, eax
call fcn.0048dd50
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x48dffd
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
call fcn.00406194
push eax
push 0x48e4cc
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e015
cmp byte [ebp - 0x1a], 0
jne 0x48e0bf
mov eax, dword [0x558a90]
cmp dword [eax], 0xa
jl 0x48e0bf
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0x11
lea edx, [ebp - 0x34]
xor ecx, ecx
mov eax, 0x48e4e4
call fcn.0048e740
xor edx, edx
push ebp
push 0x48e0b1
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x48e085
push 0
push 0
push 1
mov eax, dword [ebp - 0x14]
call fcn.00406194
mov ecx, eax
mov edx, 0x48e4cc
xor eax, eax
call fcn.0048dd50
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x48e0a7
push 1
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00406194
push eax
push 0x48e4cc
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e0bf
cmp byte [ebp - 0x1a], 0
jne 0x48e1cc
lea eax, [ebp - 0x10]
xor edx, edx
call fcn.0040615c
lea eax, [ebp - 0x20]
push eax
push 0x26
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x48e122
mov eax, 0x104
call fcn.0040e520
mov ebx, eax
push ebx
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x48e11b
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.0040e4e0
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x10]
call fcn.00414d68
mov eax, ebx
call fcn.0040e57c
cmp dword [ebp - 0x10], 0
je 0x48e1cc
lea eax, [ebp - 0x10]
mov edx, 0x48e514
call fcn.0040651c
mov eax, dword [ebp - 0x10]
call fcn.0040d8bc
test al, al
je 0x48e1cc
xor edx, edx
push ebp
push 0x48e1be
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [ebp - 0x19], 0
je 0x48e18b
mov eax, dword [ebp - 0x18]
call fcn.00406194
push eax
push 0
push 1
mov eax, dword [ebp - 0x10]
call fcn.00406194
mov ecx, eax
mov edx, 0x48e4cc
xor eax, eax
call fcn.0048dd50
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0x1a], al
jmp 0x48e1b4
push 1
push 0
mov eax, dword [ebp - 0x18]
call fcn.00406194
push eax
mov eax, dword [ebp - 0x10]
call fcn.00406194
push eax
push 0x48e4cc
push 0
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta byte [ebp - 0x1a]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48e1cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e206
lea eax, [ebp - 0x38]
call fcn.004060f8
lea eax, [ebp - 0x2c]
call fcn.004060f8
lea eax, [ebp - 0x24]
call fcn.004060f8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00406100
ret