Function at 0x403d55
Capabilities:
Create process on windows
Terminate process

Disassembly:
push 0x84
mov eax, 0x408354
call fcn.004077de
xor eax, eax
lea ecx, [ebp - 0x3c]
mov word [0x40e788], ax
mov word [0x40eb9c], ax
mov word [0x40e992], ax
mov word [0x40eda6], ax
call fcn.004023ae
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.004017ed
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 1
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
or ebx, 0xffffffff
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
mov esi, str.7z.exe
lea ecx, [ebp - 0x24]
push esi
call fcn.004050f8
push 2
pop edi
lea edx, [ebp - 0x24]
mov dword [ebp - 4], edi
xor ecx, ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push esi
lea ecx, [ebp - 0x24]
call fcn.004050f8
xor edx, edx
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x24]
call fcn.00402696
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
lea ecx, [ebp - 0x3c]
call fcn.004023ae
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 4
push ecx
mov ecx, eax
call fcn.004017ed
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 5
mov ecx, edi
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], ebx
call fcn.0040197a
push str.FBNeo.zip
lea ecx, [ebp - 0x24]
call fcn.004050f8
lea edx, [ebp - 0x24]
mov dword [ebp - 4], 6
mov ecx, edi
call fcn.00402476
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push ecx
push 0x40eb9c
lea ecx, [ebp - 0x24]
call fcn.00405653
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 7
call fcn.004022ab
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
call fcn.0040274d
lea ecx, [ebp - 0x24]
test eax, eax
je 0x403eb2
push str.https:__github.com_finalburnneo_FBNeo_releases_download_latest_Windows.x64.zip
call fcn.004050f8
mov dword [ebp - 4], 8
jmp 0x403ec3
push str.https:__github.com_finalburnneo_FBNeo_releases_download_latest_Windows.x32.zip
call fcn.004050f8
mov dword [ebp - 4], 9
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.00402714
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], ebx
call fcn.0040197a
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x90]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x4190d0], ebx
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e0], 0x40e788
mov dword [0x4190e4], 0x40ae08
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x403f48
push 0xffffffffffffffff
push eax
call ebx
lea ecx, [ebp - 0x3c]
call fcn.004023ae
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0xa
push ecx
mov ecx, eax
call fcn.004017ed
xor ecx, ecx
mov byte [ebp - 4], 0xb
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
lea ecx, [ebp - 0x24]
call fcn.0040197a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.0040197a
push str.fbneo64.exe
lea ecx, [ebp - 0x24]
call fcn.004050f8
xor ecx, ecx
mov dword [ebp - 4], 0xc
lea edx, [ebp - 0x24]
inc ecx
call fcn.00402476
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040197a
push 0x3c
lea eax, [ebp - 0x90]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea esi, [ebp - 0x90]
mov eax, 0x4190d0
mov edi, eax
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [0x4190d0], 0x3c
mov dword [0x4190d4], 0x40
mov dword [0x4190ec], 5
mov dword [0x4190e0], 0x40e992
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov eax, dword [0x419108]
test eax, eax
je 0x404012
push 0xffffffffffffffff
push eax
call ebx
push ecx
push 0x40e788
lea ecx, [ebp - 0x24]
call fcn.00405653
lea ecx, [ebp - 0x24]
mov dword [ebp - 4], 0x10
call fcn.004022ab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040197a
push ecx
push 0x40eb9c
lea ecx, [ebp - 0x54]
call fcn.00405653
lea ecx, [ebp - 0x54]
mov dword [ebp - 4], 0x11
call fcn.004022ab
lea ecx, [ebp - 0x54]
call fcn.0040197a
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3