Function at 0x402740
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x465eb8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
call fcn.004356a0
test al, al
jne 0x4029ca
mov al, byte [edi + 0x210]
test al, al
je 0x402812
push str.Unable_to_re_spawn_cleanup_in_admin_user_
push edi
call fcn.00438440
add esp, 8
mov ecx, edi
call fcn.00437480
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [edi + 0x250]
push eax
call fcn.00433640
lea ecx, [ebp - 0x28]
movzx eax, ax
push ecx
push eax
push 0x6a
call fcn.00434e90
add esp, 0x10
test al, al
je 0x4027fa
cmp dword [ebp - 0x14], 8
lea eax, [edi + 0xc78]
push 0x1010
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push eax
push ecx
push 0
call fcn.00433140
add esp, 0x10
cmp dword [ebp - 0x14], 8
jb 0x40280b
push dword [ebp - 0x28]
call fcn.0043986c
add esp, 4
xor al, al
jmp 0x4029cc
push str.__respawn
lea ecx, [ebp - 0x58]
call fcn.004034b0
mov esi, eax
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.004034b0
push esi
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.00404cf0
add esp, 4
cmp dword [ebp - 0x14], 8
jb 0x402854
push dword [ebp - 0x28]
call fcn.0043986c
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 5
cmp dword [ebp - 0x44], 8
jb 0x40287d
push dword [ebp - 0x58]
call fcn.0043986c
add esp, 4
xor eax, eax
mov dword [ebp - 0x44], 7
cmp dword [ebp - 0x5c], 8
push 1
mov word [ebp - 0x58], ax
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push edi
push eax
push str.cleanup.exe
push str.runas
push 0
mov dword [ebp - 0x48], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja case.default.0x4028c2
movzx eax, byte [eax + 0x402a20]
jmp dword [eax*4 + 0x4029e8]
push str.ERROR:_The_operating_is_out_of_memory_or_resources.__Terminating_install.
jmp 0x40293d
push edi
push str.ERROR:_Cleanup.exe_not_found_in__s.__Terminating_install.
push edi
call fcn.00438440
add esp, 0xc
jmp 0x402946
push edi
push str.ERROR:_The_path__s_is_not_found.__Terminating_install.
push edi
call fcn.00438440
add esp, 0xc
jmp 0x402946
push str.ERROR:_The_.exe_file_is_invalid_or_error_in_.exe_image.__Terminating_install.
jmp 0x40293d
push str.ERROR:_Operating_system_denied_access_to_Cleanup.exe.__Terminating_install.
jmp 0x40293d
push str.ERROR:_The_file_name_association_is_incomplete_or_invalid.__Terminating_install.
jmp 0x40293d
push str.ERROR:_The_DDE_transaction_could_not_be_completed_because_other_DDE_transactions_were_being_processed.__Terminating_install.
jmp 0x40293d
push str.ERROR:_The_DDE_transaction_failed.__Terminating_install.
jmp 0x40293d
push str.ERROR:_The_DDE_transaction_could_not_be_completed_because_the_request_timed_out.__Terminating_install.
jmp 0x40293d
push str.ERROR:_The_specified_DLL_was_not_found.__Terminating_install.
jmp 0x40293d
push str.ERROR:_There_is_no_application_associated_with_the_given_file_name_extension._This_error_will_also_be_returned_if_you_attempt_to_print_a_file_that_is_not_printable.__Terminating_install.
jmp 0x40293d
push str.ERROR:_There_was_not_enough_memory_to_complete_the_operation.__Terminating_install.
jmp 0x40293d
push str.ERROR:_A_sharing_violation_occurred.__Terminating_install.
jmp 0x40293d
push str.ERROR:_Unable_to_re_spawn_Cleanup.exe_as_admin_user.__Terminating_install.
push edi
call fcn.00438440
add esp, 8
mov ecx, edi
call fcn.00437480
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
lea eax, [edi + 0x250]
mov byte [ebp - 4], 6
push eax
call fcn.00433640
lea ecx, [ebp - 0x40]
movzx eax, ax
push ecx
push eax
push 0x6a
call fcn.00434e90
add esp, 0x10
test al, al
je 0x4029a9
cmp dword [ebp - 0x2c], 8
lea eax, [edi + 0xc78]
push 0x1010
lea ecx, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x40]
push eax
push ecx
push 0
call fcn.00433140
add esp, 0x10
lea ecx, [ebp - 0x40]
call fcn.004035c0
cmp dword [ebp - 0x5c], 8
jb 0x40280b
push dword [ebp - 0x70]
call fcn.0043986c
add esp, 4
xor al, al
jmp 0x4029cc
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438f17
mov esp, ebp
pop ebp
ret