Function at 0x401baf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e4
mov eax, dword [0x40a020]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x1e0]
push esi
push eax
mov ebx, ecx
mov dword [ebp - 0x1e4], esi
call fcn.00402330
xor eax, eax
mov dword [ebp - 0x184], esi
lea edi, [ebp - 0x180]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x44
stosd dword es:[edi], eax
pop edi
push edi
lea eax, [ebp - 0x1e4]
push esi
push eax
call fcn.00402330
push 0x10
lea eax, [ebp - 0x184]
push esi
push eax
call fcn.00402330
push dword [ebx + 0x153c]
xor eax, eax
push dword [ebx + 0x1538]
mov word [ebp - 0x1b2], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1e4], edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push str.__IRAOFF:_I64u
push eax
mov dword [ebp - 0x1e0], esi
mov dword [ebp - 0x1b0], esi
mov dword [ebp - 0x1dc], esi
mov dword [ebp - 0x1b8], esi
call edi
add esp, 0x34
lea eax, [ebx + 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x401c7e
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebx + 0x1120]
push eax
lea eax, [ebp - 0x128]
push str.___IRAFN:_s_
push eax
call edi
add esp, 0xc
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
movzx eax, byte [ebx + 0x1114]
push eax
lea eax, [ebp - 0x128]
push str.___IRCT:_d_
push eax
call edi
add esp, 0xc
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
push dword [ebx + 0x111c]
lea eax, [ebp - 0x128]
push dword [ebx + 0x1118]
push str.___IRTSS:_I64u_
push eax
call edi
add esp, 0x10
push 0x4074e0
lea eax, [ebx + 0x808]
push eax
call esi
lea eax, [ebp - 0x128]
push eax
lea eax, [ebx + 0x808]
push eax
call esi
and dword [ebp - 0x134], 0
lea eax, [ebp - 0x134]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x401e0b
and dword [ebp - 0x138], 0
push 0x4000
call fcn.004027bc
pop ecx
mov dword [ebp - 0x130], eax
test eax, eax
je 0x401e0b
lea ecx, [ebp - 0x138]
push ecx
push 0x4000
push eax
push 1
push dword [ebp - 0x134]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x401e0b
and dword [ebp - 0x12c], 0
lea eax, [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x130]
push dword [eax]
mov ecx, ebx
call fcn.00401844
test eax, eax
je 0x401dff
cmp dword [ebp - 0x12c], 0
je 0x401dff
push dword [ebp - 0x12c]
lea eax, [ebp - 0x128]
push str.___IRSID:_s_
push eax
call edi
add esp, 0xc
push 0x4074e0
lea edi, [ebx + 0x808]
push edi
call esi
lea eax, [ebp - 0x128]
push eax
push edi
call esi
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x130]
call fcn.00402782
pop ecx
xor ecx, ecx
cmp dword [0x40ab80], ecx
je 0x401e2b
push ecx
lea eax, [ebx + 0x1224]
push eax
lea eax, [ebx + 0x808]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x174]
push 0
push eax
call fcn.00402330
lea eax, [ebx + 0x1224]
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x174], esi
lea eax, [ebx + 0x808]
mov dword [ebp - 0x160], eax
add esp, 0xc
xor edi, edi
xor esi, esi
lea eax, [ebp - 0x174]
inc esi
push eax
mov dword [ebp - 0x170], 0x40
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], str.open
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], esi
mov dword [ebp - 0x154], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x401eda
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c7
je 0x401ecb
push str.Could_not_start_the_setup
add ebx, 8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x12c], 0x37
jmp 0x401f73
mov dword [ebp - 0x12c], 5
jmp 0x401f73
cmp dword [ebx + 0x110c], edi
je 0x401f2d
jmp 0x401f13
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
push edi
push edi
push edi
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jg 0x401ee4
push 0xff
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x13c]
push eax
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
cmp eax, esi
je 0x401efe
lea eax, [ebx + 0x1548]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebx + 0x1548]
mov dword [ebp - 0x12c], eax
mov dword [ebx + 0x1110], esi
cmp eax, 0x103
jne 0x401f67
cmp dword [ebx + 0x110c], edi
jne 0x401f67
mov dword [ebp - 0x12c], edi
push dword [ebp - 0x13c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x12c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004023aa
leave
ret