Function at 0x4017fd
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x62ee56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x129c
call fcn.005b9360
push ebx
push esi
push edi
push 0x800
lea eax, [esp + 0xaac]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40185f
xor al, al
mov ecx, dword [esp + 0x12ac]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x78]
call fcn.0040345f
mov esi, eax
mov dword [esp + 0x12b4], ebx
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x20]
call fcn.0040345f
mov edi, eax
mov byte [esp + 0x12b4], 1
push 0x67663c
call fcn.005b30d0
pop ecx
push eax
mov eax, esi
call fcn.004024d5
push eax
push ebx
lea eax, [esp + 0x60]
push eax
mov ecx, edi
call fcn.004023d3
mov byte [esp + 0x12b4], 3
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x24]
call fcn.00403747
mov byte [esp + 0x12b4], 4
push ebx
push esi
lea ecx, [esp + 0x7c]
call fcn.00403747
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4018ed
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.00421580
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00512140
test al, al
jne 0x401920
or dword [esp + 0x12b4], 0xffffffff
push ebx
push esi
lea ecx, [esp + 0x60]
call fcn.00403747
jmp 0x401848
call fcn.0040105e
test eax, eax
je 0x401908
push 2
mov esi, 0x681180
push esi
call fcn.005b3173
pop ecx
pop ecx
test eax, eax
je 0x401943
push esi
call fcn.005b318b
pop ecx
mov esi, 0x104
push esi
lea eax, [esp + 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x298]
test eax, eax
je 0x4019d1
lea eax, [esp + 0x90]
test eax, eax
je 0x4019d1
lea edi, [esp + 0x298]
call fcn.00421160
cmp eax, ebx
jne 0x4019a1
xor eax, eax
movzx ecx, word [esp + eax + 0x298]
mov word [esp + eax + 0x90], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x4019cd
cmp esi, ebx
jne 0x401980
jmp 0x4019c3
add eax, 2
lea edx, [esp + 0x90]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x4019cd
cmp esi, ebx
jne 0x4019ad
xor eax, eax
mov word [esp + 0x296], ax
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x4a0]
lea edx, [esp + 0x90]
call fcn.00420b50
mov eax, esi
push eax
push 0x681180
push 0x68118c
lea eax, [esp + 0x6b4]
push 0x200
push eax
call fcn.004210f0
lea eax, [esp + 0x6bc]
add esp, 0x14
push eax
call fcn.005e12f0
pop ecx
lea esi, [esp + 0x38]
call fcn.00422550
mov byte [esp + 0x12b4], 5
mov eax, esi
push eax
lea ecx, [edi + 0xa4]
mov edx, edi
call fcn.00402080
test al, al
jne 0x401acf
push 0x681198
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 6
call fcn.00422910
push eax
lea ecx, [esp + 0x10]
call fcn.004034c3
mov byte [esp + 0x12b4], 7
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00539080
add esp, 0x18
mov byte [esp + 0x12b4], 6
lea ecx, [esp + 0xc]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0x10]
call fcn.00401017
call fcn.00403355
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00422560
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
jmp 0x401912
lea esi, [esp + 0x38]
call fcn.004225e0
lea eax, [edi + 0xf8]
cmp dword [eax + 0x18], 8
jb 0x401ae9
mov eax, dword [eax + 4]
jmp 0x401aec
add eax, 4
push eax
push ecx
call fcn.004031f6
pop ecx
push eax
lea ecx, [esp + 0x40]
call fcn.00405595
test al, al
jne 0x401b71
push 0x681198
lea ecx, [esp + 0x10]
call fcn.004034c3
mov byte [esp + 0x12b4], 8
lea esi, [esp + 0x38]
call fcn.00422910
push eax
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 9
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00539080
add esp, 0x18
mov byte [esp + 0x12b4], 8
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
jmp 0x401aa3
call fcn.004031f6
mov ecx, eax
call fcn.00405868
mov dword [esp + 0x10], 1
call fcn.00422c30
test eax, eax
jne 0x401d13
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push eax
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.004217b0
mov byte [esp + 0x12b4], 0xa
call fcn.00422e80
test eax, eax
jne 0x401c6f
push str.TORRENT_PATCH
push ecx
call fcn.004031f6
pop ecx
mov esi, eax
call fcn.004057ed
push eax
lea ecx, [esp + 0x10]
call fcn.004034c3
mov byte [esp + 0x12b4], 0xb
push str.NOT_SUPPORT_UAC
push ecx
call fcn.004031f6
pop ecx
mov esi, eax
call fcn.004057ed
push eax
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 0xc
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00539080
add esp, 0x18
mov byte [esp + 0x12b4], 0xb
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 0xa
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00403355
mov byte [esp + 0x12b4], 5
lea esi, [esp + 0x1c]
call fcn.00421760
jmp 0x401aad
cmp dword [esp + 0x24], ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [eax + ecx*2]
jle 0x401c88
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
jmp 0x401c8a
xor ecx, ecx
push 1
push ebx
push eax
push ecx
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x401c59
push str.TORRENT_PATCH
push ecx
call fcn.004031f6
pop ecx
mov esi, eax
call fcn.004057ed
push eax
lea ecx, [esp + 0x10]
call fcn.004034c3
mov byte [esp + 0x12b4], 0xd
push str.LAUNCH_ERROR_WITH_ADMIN_PRIVILEGES
push ecx
call fcn.004031f6
pop ecx
mov esi, eax
call fcn.004057ed
push eax
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 0xe
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00539080
add esp, 0x18
mov byte [esp + 0x12b4], 0xd
jmp 0x401c3a
push 0x18
call fcn.005b29ce
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0xf
cmp eax, ebx
je 0x401d34
mov ecx, eax
call fcn.004029ca
jmp 0x401d36
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0053b7b0
pop ecx
push 0x18
call fcn.005b29ce
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0x10
cmp eax, ebx
je 0x401d66
mov ecx, eax
call fcn.0040288b
jmp 0x401d68
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0053b7b0
pop ecx
lea esi, [esp + 0x38]
call fcn.004225e0
mov eax, esi
push eax
push str.LauncherSkin
call fcn.004031f6
mov esi, eax
call fcn.004057ed
push eax
call fcn.0040d66d
pop ecx
pop ecx
test eax, eax
jne 0x401e4b
push 0x681198
lea ecx, [esp + 0x10]
call fcn.004034c3
mov byte [esp + 0x12b4], 0x11
lea esi, [esp + 0x38]
call fcn.00422910
push eax
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 0x12
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00539080
add esp, 0x18
mov byte [esp + 0x12b4], 0x11
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00403355
mov byte [esp + 0x17], bl
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00422560
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x60]
call fcn.00403747
mov al, byte [esp + 0x17]
jmp 0x40184a
push 0x1a8
call fcn.005b29ce
pop ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0x12b4], 0x13
cmp eax, ebx
je 0x401ea5
push str.TORRENT_PATCH
push ecx
call fcn.004031f6
pop ecx
mov esi, eax
call fcn.004057ed
push eax
lea ecx, [esp + 0x14]
call fcn.004034c3
mov byte [esp + 0x12b4], 0x14
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0041cfcc
mov esi, eax
jmp 0x401ea7
xor esi, esi
mov dword [esp + 0x12b4], 5
test byte [esp + 0x18], 1
je 0x401ec7
and dword [esp + 0x18], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.00401017
mov ecx, esi
call fcn.0041d4e7
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x98]
mov dword [edi + 0x44], esi
mov byte [esp + 0x17], 1
jmp 0x401e1c