Function at 0x4414e3
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push 0x710
mov eax, 0x5b17a4
call fcn.0058f792
mov dword [ebp - 0x67c], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x6a8], eax
xor eax, eax
mov dword [ebp - 0x690], esi
mov dword [ebp - 0x630], 7
mov dword [ebp - 0x634], ebx
mov word [ebp - 0x644], ax
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x69c], ebx
call fcn.0041f47b
mov dword [ebp - 0x6a0], eax
xor eax, eax
mov dword [ebp - 0x698], ebx
inc eax
mov dword [ebp - 0x694], ebx
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], al
call fcn.0041f47b
mov dword [ebp - 0x698], eax
mov byte [ebp - 4], 2
test esi, esi
je 0x441586
xor eax, eax
cmp ax, word [esi]
je 0x441586
lea ebx, [eax + 1]
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.0058e700
xor eax, eax
push esi
mov word [ebp - 0x420], ax
xor esi, esi
lea eax, [ebp - 0x41e]
push esi
push eax
call fcn.0058e700
add esp, 0x18
call fcn.00474a71
mov eax, dword [eax + 4]
cmp dword [eax + 0x45b4], esi
je 0x4415d5
xor eax, eax
lea ebx, [eax + 1]
jmp 0x441618
mov eax, dword [ebp - 0x680]
cmp dword [eax + 0x38], esi
je 0x441616
cmp dword [eax + 0x20], esi
je 0x441616
call fcn.00474a71
mov ecx, dword [eax + 4]
lea ecx, [ecx + 0xcc]
call fcn.004137a9
test eax, eax
je 0x441616
call fcn.00474a71
mov ecx, dword [eax + 4]
lea ecx, [ecx + 0xcc]
call fcn.004137a9
xor ecx, ecx
cmp cx, word [eax]
jne 0x441620
mov ebx, esi
xor edi, edi
inc edi
jmp 0x441e5b
push 0x44
pop esi
push esi
lea eax, [ebp - 0x71c]
push 0
push eax
call fcn.0058e700
mov dword [ebp - 0x71c], esi
add esp, 0xc
xor esi, esi
inc esi
mov dword [ebp - 0x6f0], esi
call fcn.00474a71
mov ecx, dword [eax + 4]
lea ecx, [ecx + 0xcc]
call fcn.0041adf9
and eax, 0xf
cmp al, 2
jne 0x441669
xor eax, eax
mov word [ebp - 0x6ec], ax
jmp 0x441670
mov word [ebp - 0x6ec], si
lea eax, [ebp - 0x62c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, dword [ebp - 0x67c]
push dword [eax + 0x3c]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str.use_printui_I_F._n
push str.CInstallAction::InstallPrinterClassDriver
push 5
call fcn.00424dad
mov esi, str.rundll32
push esi
call fcn.0058edd4
add esp, 0x10
lea ecx, [ebp - 0x644]
push eax
push esi
call fcn.00404be0
call fcn.00474a71
mov ecx, dword [eax + 4]
lea ecx, [ecx + 0xcc]
call fcn.004137a9
mov esi, eax
xor eax, eax
cmp word [esi], ax
je 0x4416e0
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, str._PrintUIEntry
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
test ebx, ebx
mov eax, str._ia__q
mov esi, str._if__q
cmove esi, eax
xor eax, eax
cmp word [esi], ax
je 0x441723
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, str._m__
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, dword [ebp - 0x680]
add esi, 0x10
cmp dword [esi + 0x14], 8
jb 0x44175a
mov esi, dword [esi]
xor eax, eax
cmp word [esi], ax
je 0x441768
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, str.___f__
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, dword [ebp - 0x680]
add esi, 0x28
cmp dword [esi + 0x14], 8
jb 0x44179f
mov esi, dword [esi]
xor eax, eax
cmp word [esi], ax
je 0x4417ad
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov esi, 0x5d08d8
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
test ebx, ebx
je 0x441833
mov esi, str.__r__
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov ebx, dword [ebp - 0x690]
xor esi, esi
cmp word [ebx], si
jne 0x441801
mov eax, esi
jmp 0x441808
push ebx
call fcn.0058edd4
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x644]
call fcn.00404a83
push 0x5d08d8
call fcn.0058edd4
pop ecx
push eax
push 0x5d08d8
lea ecx, [ebp - 0x644]
call fcn.00404a83
jmp 0x44183b
mov ebx, dword [ebp - 0x690]
xor esi, esi
test edi, edi
je 0x441897
xor eax, eax
cmp ax, word [edi]
je 0x441897
mov esi, str.__b__
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x644]
call fcn.00404a83
xor esi, esi
cmp word [edi], si
jne 0x44186a
mov eax, esi
jmp 0x441871
push edi
call fcn.0058edd4
pop ecx
push eax
push edi
lea ecx, [ebp - 0x644]
call fcn.00404a83
mov edi, 0x5d08d8
push edi
call fcn.0058edd4
pop ecx
push eax
push edi
lea ecx, [ebp - 0x644]
call fcn.00404a83
cmp dword [ebp - 0x630], 8
lea eax, [ebp - 0x644]
mov edi, str.CInstallAction::InstallPrinterClassDriver
cmovae eax, dword [ebp - 0x644]
push eax
push str.CmdLine____1_s___n
push edi
push 4
call fcn.00424dad
add esp, 0x10
test ebx, ebx
je 0x4418f6
xor eax, eax
cmp ax, word [ebx]
je 0x4418f6
lea eax, [ebp - 0x6a0]
push eax
call fcn.00413869
pop ecx
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x104
push eax
lea eax, [ebp - 0x218]
push eax
call sub.WINSPOOL.DRV_Ordinal_203
cmp dword [ebp - 0x630], 8
lea ecx, [ebp - 0x6d4]
push ecx
lea ecx, [ebp - 0x71c]
push ecx
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x644]
cmovae eax, dword [ebp - 0x644]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebx, eax
test ebx, ebx
jne 0x441941
push str.CreateProcess_failed._n
push edi
push 2
call fcn.00424dad
add esp, 0xc
jmp 0x4419ee
push str.CreateProcess_success._n
push edi
push 4
call fcn.00424dad
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push dword [ebp - 0x6d0]
call esi
call fcn.00474a71
mov ecx, dword [eax + 4]
call fcn.0047605a
push 0x1f4
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x64
push dword [ebp - 0x6d4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x641aec], 0
mov edi, eax
jne 0x44199d
cmp dword [0x641af0], 0
je 0x4419b5
call fcn.00474a71
mov ecx, dword [eax + 4]
cmp dword [ecx + 0x45bc], 0
je 0x4419b5
call fcn.0040a8cf
jmp 0x4419ba
call fcn.00470341
lea ecx, [ebp - 0x675]
mov byte [ebp - 4], 2
call fcn.0040801f
cmp edi, 0x102
je 0x44195f
lea eax, [ebp - 0x6d8]
push eax
push dword [ebp - 0x6d4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x6d4]
call esi
xor esi, esi
mov eax, dword [ebp - 0x680]
xor edx, edx
mov edi, edx
mov dword [ebp - 0x688], esi
mov dword [ebp - 0x684], edi
cmp dword [eax + 0xb0], edx
je 0x441a3c
add eax, 0xa0
cmp dword [eax + 0x14], 8
jb 0x441a19
mov eax, dword [eax]
lea ecx, [ebp - 0x688]
push ecx
mov ecx, dword [ebp - 0x67c]
push 1
push eax
call fcn.0043b1ba
mov esi, dword [ebp - 0x688]
xor edx, edx
mov eax, dword [ebp - 0x680]
cmp dword [eax + 0xc8], edi
je 0x441a6b
add eax, 0xb8
cmp dword [eax + 0x14], 8
jb 0x441a51
mov eax, dword [eax]
lea ecx, [ebp - 0x684]
push ecx
mov ecx, dword [ebp - 0x67c]
push edx
push eax
call fcn.0043b1ba
mov edi, dword [ebp - 0x684]
test esi, esi
jne 0x441a73
test edi, edi
je 0x441a99
mov edi, dword [ebp - 0x67c]
mov eax, dword [edi + 0xb0]
or eax, 1
cmp dword [ebp + 0x18], 0
mov dword [edi + 0xb0], eax
je 0x441a9f
or eax, 2
mov dword [edi + 0xb0], eax
jmp 0x441a9f
mov edi, dword [ebp - 0x67c]
push 7
pop edx
xor ecx, ecx
mov dword [ebp - 0x648], edx
xor eax, eax
mov dword [ebp - 0x64c], ecx
mov word [ebp - 0x65c], ax
mov dword [ebp - 0x660], edx
mov dword [ebp - 0x664], ecx
mov word [ebp - 0x674], ax
lea eax, [ebp - 0x698]
mov byte [ebp - 4], 5
push eax
call fcn.00413869
lea eax, [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.0040a898
mov esi, dword [ebp - 0x680]
add esp, 0xc
add esi, 0x10
cmp dword [esi + 0x14], 8
jb 0x441b03
mov esi, dword [esi]
xor eax, eax
cmp word [esi], ax
je 0x441b11
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x65c]
call fcn.00404be0
test ebx, ebx
je 0x441e00
mov eax, dword [ebp - 0x6a8]
test eax, eax
je 0x441b6f
xor ecx, ecx
cmp cx, word [eax]
je 0x441b6f
push eax
xor eax, eax
cmp dword [ebp - 0x648], 8
push eax
push eax
lea eax, [ebp - 0x65c]
cmovae eax, dword [ebp - 0x65c]
push eax
push ecx
push ecx
mov ecx, esp
lea eax, [ebp - 0x675]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.00406b73
mov ecx, edi
call fcn.00449721
mov esi, dword [ebp - 0x690]
test esi, esi
je 0x441e00
xor eax, eax
cmp ax, word [esi]
je 0x441e00
lea eax, [ebp - 0x6a4]
mov dword [ebp - 0x6a4], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
call sub.WINSPOOL.DRV_Ordinal_203
lea eax, [ebp - 0x218]
test eax, eax
je 0x441d8b
xor eax, eax
cmp ax, word [ebp - 0x218]
je 0x441d8b
lea eax, [ebp - 0x420]
test eax, eax
je 0x441d8b
xor eax, eax
cmp ax, word [ebp - 0x420]
je 0x441d8b
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00591d24
pop ecx
pop ecx
test eax, eax
je 0x441d8b
push str.DefaultPrinter_has_been_changed_by_operating_system._n
push str.CInstallAction::InstallPrinterClassDriver
push 4
call fcn.00424dad
add esp, 0xc
lea ecx, [ebp - 0x6c4]
call fcn.0046d5d4
xor eax, eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x68c]
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], eax
call fcn.0041f47b
mov dword [ebp - 0x68c], eax
mov edi, dword [ebp - 0x6a0]
mov byte [ebp - 4], 7
mov esi, dword [edi]
mov dword [ebp - 0x684], esi
jmp 0x441d01
lea eax, [esi + 0x10]
cmp dword [eax + 0x14], 8
jb 0x441c62
mov ecx, dword [eax]
jmp 0x441c64
mov ecx, eax
test ecx, ecx
je 0x441cf0
cmp dword [eax + 0x14], 8
jb 0x441c76
mov ecx, dword [eax]
jmp 0x441c78
mov ecx, eax
xor edx, edx
cmp dx, word [ecx]
je 0x441cf0
cmp dword [eax + 0x14], 8
jb 0x441c87
mov eax, dword [eax]
push 0x5c
push eax
lea ecx, [ebp - 0x6c4]
call fcn.0046eb6a
xor edi, edi
lea ecx, [ebp - 0x6c4]
push edi
call fcn.0046dbf8
test eax, eax
je 0x441cea
xor eax, eax
lea ecx, [ebp - 0x6c4]
inc eax
push eax
call fcn.0046dbf8
test eax, eax
je 0x441cea
push 2
lea ecx, [ebp - 0x6c4]
call fcn.0046dbf8
test eax, eax
je 0x441cea
push edi
lea ecx, [ebp - 0x6c4]
call fcn.0046dbf8
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00591d24
pop ecx
pop ecx
test eax, eax
je 0x441d0b
mov edi, dword [ebp - 0x6a0]
lea ecx, [ebp - 0x684]
call fcn.004212e4
mov esi, dword [ebp - 0x684]
cmp esi, edi
jne 0x441c55
jmp 0x441d6b
movzx eax, byte [0x63ce88]
lea ecx, [ebp - 0x68c]
push eax
add esi, 0x10
lea eax, [ebp - 0x6ac]
push esi
push edi
push eax
call fcn.004064e0
xor esi, esi
lea ecx, [ebp - 0x6c4]
inc esi
push esi
push 2
call fcn.0046dbf8
push eax
push esi
lea ecx, [ebp - 0x6c4]
call fcn.0046dbf8
push eax
push ecx
push ecx
mov ecx, esp
lea eax, [ebp - 0x675]
push eax
lea eax, [ebp - 0x68c]
push eax
call fcn.00406b73
mov ecx, dword [ebp - 0x67c]
call fcn.0044900e
lea ecx, [ebp - 0x68c]
call fcn.00407a8b
lea ecx, [ebp - 0x6c4]
mov byte [ebp - 4], 5
call fcn.0046d690
mov esi, dword [ebp - 0x690]
xor edi, edi
cmp dword [ebp + 0x10], edi
je 0x441e02
cmp word [esi], di
jne 0x441d9b
mov eax, edi
jmp 0x441da2
push esi
call fcn.0058edd4
pop ecx
push eax
push esi
lea ecx, [ebp - 0x674]
call fcn.00404be0
cmp dword [ebp - 0x660], 8
lea eax, [ebp - 0x674]
push edi
cmovae eax, dword [ebp - 0x674]
cmp dword [ebp - 0x648], 8
push eax
lea eax, [ebp - 0x65c]
cmovae eax, dword [ebp - 0x65c]
push eax
push ecx
push ecx
mov ecx, esp
lea eax, [ebp - 0x675]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.00406b73
mov esi, dword [ebp - 0x67c]
mov ecx, esi
call fcn.0044900e
jmp 0x441e08
xor edi, edi
mov esi, dword [ebp - 0x67c]
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test ebx, ebx
je 0x441e28
cmp dword [esi + 0xb0], edi
je 0x441e28
mov dword [esi + 8], 0x64
xor edi, edi
inc edi
cmp dword [ebp + 0x14], 0
je 0x441e3f
push edi
push dword [ebp - 0x680]
mov ecx, esi
call fcn.0043f0d5
xor esi, esi
lea ecx, [ebp - 0x674]
push esi
push edi
call fcn.00404970
push esi
push edi
lea ecx, [ebp - 0x65c]
call fcn.00404970
lea ecx, [ebp - 0x698]
call fcn.00407a8b
lea ecx, [ebp - 0x6a0]
call fcn.00407a8b
push esi
push edi
lea ecx, [ebp - 0x644]
call fcn.00404970
mov eax, ebx
call fcn.0058f741
ret 0x1c