Function at 0x1004b7e
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x43c
mov eax, dword [0x100d0ac]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
lea ecx, [ebp - 0x3d8]
mov dword [ebp - 4], eax
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3e4], edi
call fcn.0100a525
test esi, esi
mov dword [ebp - 0x3e0], 0x80004005
je 0x1004e11
test ebx, ebx
je 0x1004e11
test edi, edi
je 0x1004bdb
cmp byte [edi], 0
je 0x1004e11
lea ecx, [ebp - 0x3d8]
call fcn.0100a67c
test eax, eax
je 0x1004d04
xor eax, eax
push eax
lea ecx, [ebp - 0x3dc]
push ecx
push eax
push eax
push eax
push eax
mov dword [ebp - 0x3dc], eax
call fcn.010040fb
test eax, eax
je 0x1004e0a
mov ebx, 0x828
push ebx
call fcn.0100a087
mov esi, eax
test esi, esi
je 0x1004cef
xor eax, eax
push eax
push eax
mov ecx, 0x20a
mov edi, esi
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3ec]
push eax
push esi
push dword [ebp - 0x3e8]
mov dword [esi], ebx
push dword [ebp - 0x3e4]
mov dword [ebp - 0x3ec], ebx
call dword [ebp - 0x3dc]
test eax, eax
jne 0x1004cfa
lea ecx, [ebp - 0x3d8]
call fcn.0100a69a
test eax, eax
je 0x1004c9b
xor eax, eax
lea ecx, [ebp - 0x3dc]
push ecx
push eax
push eax
mov dword [ebp - 0x3dc], eax
call fcn.01003fe2
test eax, eax
je 0x1004ce9
lea eax, [esi + 0x710]
push eax
push 1
call dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], eax
jmp 0x1004ce9
xor eax, eax
push eax
push eax
mov dword [ebp - 0x3dc], eax
lea eax, [ebp - 0x3dc]
push eax
call fcn.01003fe2
test eax, eax
je 0x1004ce9
lea ecx, [ebp - 0x400]
call fcn.01007e91
lea ecx, [ebp - 0x400]
call fcn.01007fb3
lea eax, [esi + 0x710]
push eax
call dword [ebp - 0x3dc]
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x3e0], eax
call fcn.01007f43
push esi
call fcn.0100a0a7
mov eax, dword [ebp - 0x3e0]
jmp 0x1004e16
mov eax, 0x800704cd
jmp 0x1004e16
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x10c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x31c]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x214]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, 0x10016c8
push edi
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x10c]
push eax
call esi
push edi
lea eax, [ebp - 0x10c]
push eax
call esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1004e0a
cmp eax, esi
ja 0x1004e0a
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x31c]
push 0x10016b8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
xor eax, eax
push 0xf
pop ecx
lea edi, [ebp - 0x43c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x31c]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x43c]
push eax
mov dword [ebp - 0x43c], 0x3c
mov dword [ebp - 0x438], 0x400
mov dword [ebp - 0x420], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x1004cef
and dword [ebp - 0x3e0], 0
jmp 0x1004cef
mov eax, 0x8000ffff
jmp 0x1004e16
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009b9d
leave
ret 0x10