Function at 0x4013f0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Set current directory

Disassembly:
sub esp, 0x78
push esi
mov esi, dword [esp + 0x80]
push 1
push 0x104
mov dword [0x40fa98], esi
call fcn.004059f7
push 1
push 0x104
mov dword [0x40fa94], eax
call fcn.004059f7
push 1
push 0x104
mov dword [0x40fa90], eax
call fcn.004059f7
push 1
push 0x2000
mov dword [0x40fa80], eax
call fcn.004059f7
mov ecx, dword [0x40fa94]
add esp, 0x20
test ecx, ecx
mov dword [0x40fa84], eax
je 0x401928
mov edx, dword [0x40fa90]
test edx, edx
je 0x401928
mov edx, dword [0x40fa80]
test edx, edx
je 0x401928
test eax, eax
je 0x401928
push ebp
push edi
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401250
mov edi, eax
test edi, edi
jne 0x40185b
push ebx
call fcn.00401950
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4016ac
mov eax, dword [0x40fa90]
mov ecx, dword [0x40fa84]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push str.__s_
push ecx
call ebx
mov edx, dword [esp + 0xa0]
add esp, 0xc
test edx, edx
je 0x401519
cmp byte [edx], 0
je 0x401519
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x40c060]
or ecx, 0xffffffff
mov word [edi - 1], ax
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x40fa84]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [str.__SF__]
dec edi
mov dword [edi], eax
mov cx, word [0x40c05c]
xor eax, eax
mov word [edi + 4], cx
mov dl, byte [0x40c05e]
or ecx, 0xffffffff
mov byte [edi + 6], dl
mov edi, dword [0x40fa94]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x40fa84]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40c054]
mov word [edi - 1], ax
mov ecx, dword [0x40fa8c]
mov edx, dword [0x40fa84]
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push str.__SO_d
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, edx
push ecx
call ebx
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
mov dword [esp + 0x24], edx
add esp, 0xc
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], edx
push eax
push ecx
push edx
push edx
push 0x20
push 1
push edx
mov dword [esp + 0x40], edx
push edx
mov edx, dword [0x40fa84]
push edx
push 0
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4016ac
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edi, edi
test edi, edi
jne 0x401664
push edi
push edi
push edi
lea eax, [esp + 0x34]
push edi
push eax
call esi
test eax, eax
je 0x401664
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
call ebp
test eax, eax
je 0x40164c
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401651
mov edi, 1
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
call esi
test eax, eax
jne 0x401623
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401698
push 0xff
push 0x3e8
push 0
push 0
push 0
call ebx
cmp dword [esp + 0x14], 0x103
je 0x401610
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [0x40fa94]
test eax, eax
je 0x4016e9
push 0x5c
push eax
call fcn.004059d0
add esp, 8
test eax, eax
je 0x4016e9
mov esi, dword [0x40fa94]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jae 0x4016d9
mov byte [eax + 1], 0
jmp 0x4016dc
mov byte [eax], 0
mov edx, dword [0x40fa94]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, dword [0x40fa88]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x4017a8
cmp byte [ebx], 0
je 0x40179f
xor esi, esi
push ebx
call fcn.00405aa8
add esp, 4
test eax, eax
je 0x40172d
cmp dword [0x40faa4], 2
je 0x40172d
push 0x3e8
call ebp
inc esi
cmp esi, 0xa
jl 0x401708
jmp 0x40177d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.004059f7
mov esi, eax
add esp, 8
test esi, esi
je 0x40177d
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40174f
push 0x5c
push esi
call fcn.004059d0
add esp, 8
test eax, eax
je 0x401774
push esi
mov byte [eax], 0
call fcn.00405ad2
add esp, 4
push esi
call fcn.00405893
add esp, 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebx + ecx + 1]
lea ebx, [ebx + ecx + 1]
test al, al
jne 0x401706
mov ebx, dword [0x40fa88]
push ebx
call fcn.00405893
add esp, 4
push 1
push 0x104
call fcn.004059f7
mov esi, eax
add esp, 8
test esi, esi
je 0x40181f
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401816
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x40fa80]
not ecx
dec ecx
push ecx
push eax
push esi
call fcn.0040a040
add esp, 0xc
test eax, eax
jne 0x401816
mov edx, dword [0x40fa80]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jbe 0x401816
push edx
call fcn.004012b0
add esp, 4
push esi
call fcn.00405893
add esp, 4
xor esi, esi
pop ebx
mov ecx, dword [0x40fa80]
push ecx
call fcn.00401040
mov edx, dword [0x40fa80]
push edx
call fcn.00405ad2
add esp, 8
test eax, eax
je 0x401857
cmp dword [0x40faa4], 2
je 0x401857
push 0x3e8
call ebp
inc esi
cmp esi, 0xa
jl 0x401822
mov edi, dword [esp + 0xc]
cmp edi, 0x40000000
jl case.default.0x40186e
lea eax, [edi - 0x40000001]
cmp eax, 3
ja case.default.0x40186e
jmp dword [eax*4 + 0x401934]
mov dword [esp + 0xc], 2
mov edi, dword [esp + 0xc]
jmp 0x4018a8
mov dword [esp + 0xc], 6
mov edi, dword [esp + 0xc]
jmp 0x4018a8
mov dword [esp + 0xc], 7
mov edi, dword [esp + 0xc]
jmp 0x4018a8
test edi, edi
jle 0x4018eb
cmp edi, 8
jge 0x4018eb
push 1
push 0x104
call fcn.004059f7
mov ecx, dword [esp + 0x90]
add esp, 8
mov esi, eax
movsx eax, byte [edi + 0x40c030]
push 0x104
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.00405893
add esp, 4
mov edx, dword [0x40fa84]
push edx
call fcn.00405893
mov eax, dword [0x40fa80]
push eax
call fcn.00405893
mov ecx, dword [0x40fa90]
push ecx
call fcn.00405893
mov edx, dword [0x40fa94]
push edx
call fcn.00405893
add esp, 0x10
xor eax, eax
pop edi
pop ebp
pop esi
add esp, 0x78
ret 0x10
or eax, 0xffffffff
pop esi
add esp, 0x78
ret 0x10