Function at 0x401b20
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x114dc
call fcn.0040eb80
mov eax, dword [0x416004]
xor eax, esp
mov dword [esp + 0x114d4], eax
push ebx
mov ebx, dword [esp + 0x114e4]
lea eax, [esp + 0x274]
push ebp
push esi
push edi
push 0x104
push eax
push 0
mov ebp, edx
mov dword [esp + 0x494], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x280]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401ba7
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x488], ecx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x401bf0
push 1
lea eax, [esp + 0x284]
lea eax, [eax + ecx*2]
push 0x413e10
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x494]
add esp, 0xc
inc ecx
mov dword [esp + 0x488], ecx
lea eax, [ecx + 3]
cmp eax, 0x104
jae 0x401c25
push 3
lea eax, [esp + 0x284]
lea eax, [eax + ecx*2]
push 0x413d08
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x494]
add esp, 0xc
add ecx, 3
mov dword [esp + 0x488], ecx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x401c58
push 1
lea eax, [esp + 0x284]
lea eax, [eax + ecx*2]
push 0x413e10
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x494]
add esp, 0xc
inc ecx
mov dword [esp + 0x488], ecx
lea eax, [ecx + 0xf]
cmp eax, 0x104
jae 0x401c84
push 0xf
lea eax, [esp + 0x284]
lea eax, [eax + ecx*2]
push str.w3x2lni_lua.exe
push eax
call fcn.00405e05
add esp, 0xc
add dword [esp + 0x488], 0xf
push 0x104
lea eax, [esp + 0x494]
mov dword [esp + 0x69c], 0
push eax
mov ecx, 0x83
lea esi, [esp + 0x288]
lea edi, [esp + 0x8b8]
rep movsd dword es:[edi], dword [esi]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x490]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x490]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x401d00
sub ecx, edx
sar ecx, 1
mov dword [esp + 0x698], ecx
lea eax, [ecx + 1]
cmp eax, 0x104
jae 0x401d49
push 1
lea eax, [esp + 0x494]
lea eax, [eax + ecx*2]
push 0x413e10
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x6a4]
add esp, 0xc
inc ecx
mov dword [esp + 0x698], ecx
lea eax, [ecx + 6]
cmp eax, 0x104
jae 0x401d75
push 6
lea eax, [esp + 0x494]
lea eax, [eax + ecx*2]
push str.script
push eax
call fcn.00405e05
add esp, 0xc
add dword [esp + 0x698], 6
lea eax, [esp + 0x8b0]
mov dword [esp + 0x114d8], 0
mov dword [esp + 0x10], eax
lea esi, [esp + 0x490]
mov eax, dword [esp + 0xab8]
lea edi, [esp + 0xac0]
mov ecx, 0x83
mov dword [esp + 0x14], eax
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x14dc]
call fcn.00402770
mov ecx, dword [esp + 0x114d8]
lea eax, [ecx + 0x10]
cmp eax, 0x8000
jae 0x401df8
push 0x10
lea eax, [esp + 0x14dc]
lea eax, [eax + ecx*2]
push str.__e___W2L_MODE
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x114e4]
add esp, 0xc
add ecx, 0x10
mov dword [esp + 0x114d8], ecx
lea eax, [ecx + 3]
cmp eax, 0x8000
jae 0x401e2d
push 3
lea eax, [esp + 0x14dc]
lea eax, [eax + ecx*2]
push 0x413e14
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x114e4]
add esp, 0xc
add ecx, 3
mov dword [esp + 0x114d8], ecx
lea eax, [ecx + 7]
cmp eax, 0x8000
jae 0x401e59
push 7
lea eax, [esp + 0x14dc]
lea eax, [eax + ecx*2]
push str.___E__
push eax
call fcn.00405e05
add esp, 0xc
add dword [esp + 0x114d8], 7
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x70]
push 0x104
push eax
push 0
mov dword [esp + 0x284], 0
call edi
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [esp + 0x70]
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401eb0
sub esi, ecx
sar esi, 1
mov dword [esp + 0x278], esi
lea eax, [esi + 1]
cmp eax, 0x104
jae 0x401ef6
push 1
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push 0x413e10
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
inc esi
mov dword [esp + 0x278], esi
lea eax, [esi + 6]
cmp eax, 0x104
jae 0x401f28
push 6
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push str.script
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
add esi, 6
mov dword [esp + 0x278], esi
lea eax, [esi + 1]
cmp eax, 0x104
jae 0x401f58
push 1
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push 0x413e10
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
inc esi
mov dword [esp + 0x278], esi
lea eax, [esi + 0xb]
cmp eax, 0x104
jae 0x401f8a
push 0xb
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push str.crashreport
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
add esi, 0xb
mov dword [esp + 0x278], esi
lea eax, [esi + 1]
cmp eax, 0x104
jae 0x401fba
push 1
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push 0x413e10
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
inc esi
mov dword [esp + 0x278], esi
lea eax, [esi + 8]
cmp eax, 0x104
jae 0x401fec
push 8
lea eax, [esp + 0x74]
lea eax, [eax + esi*2]
push str.init.lua
push eax
call fcn.00405e05
mov esi, dword [esp + 0x284]
add esp, 0xc
add esi, 8
mov dword [esp + 0x278], esi
mov ecx, dword [esp + 0x114d8]
lea eax, [esi + ecx]
cmp eax, 0x8000
jae 0x402026
push esi
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x14e0]
lea eax, [eax + ecx*2]
push eax
call fcn.00405e05
mov ecx, dword [esp + 0x114e4]
add esp, 0xc
add ecx, esi
mov dword [esp + 0x114d8], ecx
lea eax, [ecx + 1]
cmp eax, 0x8000
jae 0x402051
push 1
lea eax, [esp + 0x14dc]
lea eax, [eax + ecx*2]
push 0x413db4
push eax
call fcn.00405e05
add esp, 0xc
inc dword [esp + 0x114d8]
push 5
lea eax, [esp + 0xcd4]
mov dword [esp + 0x14d4], 0
push 0x413dbc
push eax
call fcn.00405e05
add dword [esp + 0x14dc], 5
lea eax, [esp + 0x6ac]
add esp, 0xc
mov dword [esp + 0x8a8], 0
push 0x104
push eax
push 0
call edi
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [esp + 0x6a0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea esi, [esp + 0x6a0]
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x4020e0
sub esi, ecx
sar esi, 1
mov dword [esp + 0x8a8], esi
lea eax, [esi + 1]
cmp eax, 0x104
jae 0x402129
push 1
lea eax, [esp + 0x6a4]
lea eax, [eax + esi*2]
push 0x413e10
push eax
call fcn.00405e05
mov esi, dword [esp + 0x8b4]
add esp, 0xc
inc esi
mov dword [esp + 0x8a8], esi
lea eax, [esi + 3]
cmp eax, 0x104
jae 0x40215e
push 3
lea eax, [esp + 0x6a4]
lea eax, [eax + esi*2]
push 0x413d08
push eax
call fcn.00405e05
mov esi, dword [esp + 0x8b4]
add esp, 0xc
add esi, 3
mov dword [esp + 0x8a8], esi
mov edi, dword [esp + 0x14d0]
lea eax, [esi + edi]
cmp eax, 0x400
jae 0x40219b
push esi
lea eax, [esp + 0x6a4]
push eax
lea eax, [esp + 0xcd8]
lea eax, [eax + edi*2]
push eax
call fcn.00405e05
mov edi, dword [esp + 0x14dc]
add esp, 0xc
add edi, esi
mov dword [esp + 0x14d0], edi
lea eax, [edi + 1]
cmp eax, 0x400
jae 0x4021ce
push 1
lea eax, [esp + 0xcd4]
lea eax, [eax + edi*2]
push 0x413dc8
push eax
call fcn.00405e05
mov edi, dword [esp + 0x14dc]
add esp, 0xc
inc edi
mov dword [esp + 0x14d0], edi
push 0x40
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0x44
xorps xmm0, xmm0
push 0
push eax
movups xmmword [esp + 0x24], xmm0
call fcn.004043b0
add esp, 0xc
mov dword [esp + 0x54], pe_nt_image_headers32
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x64], 0xffffffff
mov dword [esp + 0x68], 0xffffffff
test ebp, ebp
je 0x402221
mov eax, dword [ebp + 4]
mov dword [esp + 0x60], eax
mov dword [ebp + 4], 0
test ebx, ebx
je 0x402233
mov eax, dword [ebx + 4]
mov dword [esp + 0x68], eax
mov dword [ebx + 4], 0
mov eax, dword [esp + 0xcc8]
xor ecx, ecx
mov word [esp + eax*2 + 0xac0], cx
xor eax, eax
mov word [esp + edi*2 + 0xcd0], ax
mov eax, dword [esp + 0x114d8]
mov word [esp + eax*2 + 0x14d8], cx
mov eax, dword [esp + 0xab8]
mov word [esp + eax*2 + 0x8b0], cx
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xac8]
push eax
lea eax, [esp + 0xcdc]
push eax
push 0x8000420
push 1
push ecx
push ecx
lea eax, [esp + 0x14f8]
push eax
lea eax, [esp + 0x8d4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4022ad
xor al, al
jmp 0x4022d3
push dword [esp + 0x60]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x64]
call esi
push dword [esp + 0x68]
call esi
push dword [esp + 0x1c]
call esi
push dword [esp + 0x18]
call esi
mov al, 1
mov ecx, dword [esp + 0x114e4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00402e4d
add esp, 0x114dc
ret