Function at 0x402b70
Capabilities:
Create process on windows
Create process suspended
Create thread
Get disk size
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4952ac
mov eax, dword fs:[0]
push eax
sub esp, 0x534
mov eax, dword [0x4bc4a0]
xor eax, esp
mov dword [esp + 0x530], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bc4a0]
xor eax, esp
push eax
lea eax, [esp + 0x548]
mov dword fs:[0], eax
mov edi, dword [esp + 0x558]
call fcn.004011b0
mov esi, str..exe
call fcn.00401ec0
xor ebx, ebx
mov byte [esp + 0x1a], al
cmp al, bl
jne 0x402be3
push ebx
push ebx
push str._force
push str.gpupdate.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push edi
push ebx
push str.StepNum
push str.default
call esi
push edi
push ebx
push str.Size
push str.default
mov dword [esp + 0x2c], eax
call esi
push edi
push 0x40
mov dword [esp + 0x28], eax
lea eax, [esp + 0x10c]
push eax
push 0x49bc04
push str.FileName
push str.default
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, edi
mov dword [esp + 0x100], 0xf
mov dword [esp + 0xfc], ebx
mov byte [esp + 0xec], bl
lea ebp, [eax + 1]
jmp 0x402c50
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402c50
sub eax, ebp
push eax
push edi
lea ecx, [esp + 0xf0]
call fcn.00401c30
push 1
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xf4]
mov dword [esp + 0x55c], ebx
mov byte [esp + 0x20], 0x5c
call fcn.00401440
cmp eax, 0xffffffff
je 0x402d01
inc eax
push eax
push ebx
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0xf4]
call fcn.00401e80
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xf4]
mov byte [esp + 0x55c], 1
call fcn.00401a40
cmp dword [esp + 0x84], 0x10
mov byte [esp + 0x550], bl
jb 0x402cd7
mov eax, dword [esp + 0x70]
push eax
call fcn.0042ec92
add esp, 4
lea eax, [esp + 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402ce1
sub eax, edx
push eax
lea ecx, [esp + 0x108]
push ecx
lea ecx, [esp + 0xf0]
call fcn.00401b20
jmp 0x402d2e
lea eax, [esp + 0x104]
lea edx, [eax + 1]
jmp 0x402d10
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402d10
sub eax, edx
push eax
lea edx, [esp + 0x108]
push edx
lea ecx, [esp + 0xf0]
call fcn.00401c30
cmp dword [esp + 0x100], 0x10
mov eax, dword [esp + 0xec]
jae 0x402d46
lea eax, [esp + 0xec]
push eax
call fcn.004011b0
call fcn.004011b0
lea eax, [esp + 0x108]
push eax
call fcn.004011b0
mov ecx, dword [esp + 0x24]
push ecx
call fcn.004011b0
mov edx, dword [esp + 0x2c]
push edx
call fcn.004011b0
add esp, 0x10
call fcn.004011b0
push edi
push ebx
push str.step
push 0x49bb94
call esi
push edi
push 0x200
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x14c]
push eax
push 0x49bc04
push str.CustomInstallPath
push 0x49bb94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x144]
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402dd2
sub eax, ebp
push eax
lea ecx, [esp + 0x148]
push ecx
lea ecx, [esp + 0xd4]
call fcn.00401c30
push edi
push ebx
push str.IsCustomInstallPath
push 0x49bb94
mov byte [esp + 0x560], 2
call esi
push 1
push ebx
lea edx, [esp + 0x1c]
cmp eax, ebx
push edx
lea ecx, [esp + 0xd8]
setne byte [esp + 0x27]
mov byte [esp + 0x20], 0x5c
call fcn.00401380
inc eax
push eax
push ebx
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0xd8]
call fcn.00401e80
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xd8]
mov byte [esp + 0x55c], 3
call fcn.00401a40
mov esi, 0x10
cmp dword [esp + 0x84], esi
jb 0x402e6d
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0042ec92
add esp, 4
mov eax, dword [esp + 0xd0]
cmp dword [esp + 0xe4], esi
jae 0x402e84
lea eax, [esp + 0xd0]
lea edx, [esp + 0x48]
push edx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x402f3f
mov eax, dword [esp + 0xd0]
cmp dword [esp + 0xe4], esi
jae 0x402eb9
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push eax
call fcn.004011b0
mov eax, dword [esp + 0xdc]
add esp, 0xc
cmp dword [esp + 0xe4], esi
jae 0x402eea
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push eax
call fcn.004011b0
mov eax, dword [esp + 0xdc]
add esp, 0xc
cmp dword [esp + 0xe4], esi
jae 0x402f1b
lea eax, [esp + 0xd0]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x28]
sbb edx, dword [esp + 0x4c]
shrd ecx, edx, 0x14
shr edx, 0x14
push edx
push ecx
push eax
call fcn.004011b0
add esp, 0xc
jmp 0x402f50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x7e
call fcn.004011b0
add esp, 8
call fcn.004011b0
call fcn.004011b0
call fcn.004011b0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
shrd eax, ecx, 0x14
sub eax, dword [esp + 0x20]
shr ecx, 0x14
cmp eax, 0xc8
jae 0x402fce
cmp dword [esp + 0xe4], esi
jb 0x402f92
mov edx, dword [esp + 0xd0]
push edx
call fcn.0042ec92
add esp, 4
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x100], esi
jb 0x402fc4
mov eax, dword [esp + 0xec]
push eax
call fcn.0042ec92
add esp, 4
mov eax, 1
jmp 0x4031db
push ebx
push 0x10000000
push ebx
push ebx
push ebx
push str.PrivateDesktopND
call dword [sym.imp.USER32.dll_CreateDesktopA]
mov ebp, eax
cmp ebp, ebx
jne 0x403042
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [esp + 0xe4], esi
jb 0x403009
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.0042ec92
add esp, 4
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x100], esi
jb 0x40303b
mov edx, dword [esp + 0xec]
push edx
call fcn.0042ec92
add esp, 4
mov eax, edi
jmp 0x4031db
mov ecx, dword [esp + 0x1c]
mov dl, byte [esp + 0x1b]
mov al, byte [esp + 0x1a]
mov dword [esp + 0x5c], ecx
movzx ecx, byte [esp + 0x55c]
push ebx
push ebx
mov byte [esp + 0x68], dl
lea edx, [esp + 0x58]
push edx
neg ecx
push 0x4025e0
sbb ecx, ecx
mov byte [esp + 0x64], al
mov eax, dword [esp + 0x44]
and ecx, ebp
push ebx
push ebx
mov dword [esp + 0x68], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], ecx
call fcn.00466665
push 0x40
mov esi, eax
lea eax, [esp + 0xa8]
push ebx
push eax
call fcn.00466720
xor eax, eax
add esp, 0x24
lea ecx, [esp + 0x88]
push ecx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x8c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp byte [esp + 0x55c], bl
je 0x4030e6
mov dword [esp + 0x90], str.PrivateDesktopND
cmp dword [esp + 0x100], 0x10
mov ecx, dword [esp + 0xec]
jae 0x4030fe
lea ecx, [esp + 0xec]
lea edx, [esp + 0x344]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x403105
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x8c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea ecx, [esp + 0x364]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push esi
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov edx, dword [esp + 0x38]
push 0xffffffffffffffff
push edx
call edi
mov eax, dword [esp + 0x38]
push eax
call esi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push ebx
push ebx
push ebx
push 0x11
call esi
push ebx
push ebx
push ebx
push 0x57
call esi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
push 2
push ebx
push 0x57
call esi
push ebx
push 2
push ebx
push 0x11
call esi
push ebp
call dword [sym.imp.USER32.dll_CloseDesktop]
mov esi, 0x10
cmp dword [esp + 0xe4], esi
jb 0x4031a7
mov ecx, dword [esp + 0xd0]
push ecx
call fcn.0042ec92
add esp, 4
mov dword [esp + 0xe4], 0xf
mov dword [esp + 0xe0], ebx
mov byte [esp + 0xd0], bl
cmp dword [esp + 0x100], esi
jb 0x4031d9
mov edx, dword [esp + 0xec]
push edx
call fcn.0042ec92
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x548]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x530]
xor ecx, esp
call fcn.00466555
add esp, 0x540
ret