Function at 0x401c9e
Capabilities:
Create process on windows
Create process suspended
Get common file path
Move file

Disassembly:
push ebp
lea ebp, [esp - 0xe9c]
sub esp, 0xf1c
mov eax, dword [0x40f440]
push ebx
push esi
push edi
mov dword [ebp + 0xe98], eax
mov esi, 0x104
push esi
lea eax, [ebp + 0xa88]
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0xa88]
push 0x40c5b4
push eax
call fcn.00405abf
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
jne 0x401cf6
push 0x10
push ebx
push str.Critical_error_1
jmp 0x401ea5
push 2
push ebx
push edi
call fcn.00405a07
push edi
call fcn.004058ae
push ebx
push ebx
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405a07
push dword [ebp - 0x1c]
call fcn.004054cd
push edi
push 1
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push eax
call fcn.004057c5
push edi
call fcn.0040576f
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff6
add esp, 0x34
xor eax, eax
cmp ecx, ebx
jle 0x401fb6
mov edx, dword [ebp - 0x20]
xor edi, edi
add edx, eax
cmp byte [edx + edi], 0x40
jne 0x401e3a
inc edi
cmp edi, 0xa
jl 0x401d47
add eax, 0xa
cmp eax, 0xffffffff
mov dword [ebp - 0x24], eax
je 0x401fb6
lea eax, [ebp + 0xb8c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea eax, [ebp + 0xd94]
push eax
push ebx
mov edi, 0x40c59c
push edi
lea eax, [ebp + 0xb8c]
push eax
call esi
lea eax, [ebp + 0xc90]
push eax
push ebx
push edi
lea eax, [ebp + 0xb8c]
push eax
call esi
lea eax, [ebp + 0xd94]
push eax
lea eax, [ebp + 0x880]
push eax
call fcn.00405570
lea eax, [ebp + 0x880]
push str.__setup
push eax
call fcn.00405580
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
lea edi, [eax + ecx]
mov eax, dword [edi]
push eax
mov dword [ebp - 0x2c], eax
call fcn.004054cd
mov esi, eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
add edi, 4
push eax
push edi
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.00402030
mov eax, dword [esi]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 8]
push 0x10
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov edi, 0x40c590
lea eax, [ebp + 0xc90]
push edi
push eax
mov dword [ebp - 0x80], 0x44
call fcn.00405abf
add esp, 0x2c
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x401e48
push 0x10
push ebx
push str.Critical_error_3
jmp 0x401ea5
inc eax
cmp eax, ecx
jl 0x401d40
jmp 0x401fb6
mov ecx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x28]
push 1
push dword [ebp - 0x24]
add eax, ecx
lea eax, [eax + esi + 0xc]
push eax
call fcn.00405668
push dword [ebp - 0x20]
call fcn.0040576f
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0xc90]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea eax, [ebp + 0xd94]
push edi
push eax
call fcn.00405abf
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
jne 0x401eb4
push 0x10
push ebx
push str.Critical_error_2
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
inc eax
jmp 0x401fb8
mov eax, dword [ebp - 0x1c]
cmp eax, 0x400
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
jbe 0x401edb
push dword [ebp - 0x20]
push 1
push eax
lea eax, [esi + 0xc]
push eax
call fcn.00405668
add esp, 0x10
jmp 0x401f5c
inc eax
push eax
call fcn.004054cd
push dword [ebp - 0x1c]
lea ecx, [esi + 0xc]
push ecx
push eax
mov dword [ebp - 0x24], eax
call fcn.00405190
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov byte [eax + ecx], bl
add esp, 0x10
lea ecx, [ebp - 0x18]
call fcn.00401aba
push dword [ebp - 0x24]
lea ecx, [ebp - 0x18]
call fcn.00401c70
lea ecx, [ebp - 0x18]
call fcn.00401c45
cmp dword [ebp + 0x870], ebx
je 0x401f3c
push dword [ebp - 0x20]
push 1
push dword [ebp + 0x870]
push dword [ebp + 0x86c]
call fcn.00405668
add esp, 0x10
jmp 0x401f54
push 4
push ebx
lea eax, [ebp + 0xd94]
push eax
call edi
push 4
push ebx
lea eax, [ebp + 0xc90]
push eax
call edi
lea ecx, [ebp - 0x18]
call fcn.00401af8
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 1
push dword [ebp - 0x28]
lea eax, [eax + esi + 0xc]
push eax
call fcn.00405668
push dword [ebp - 0x20]
call fcn.0040576f
push esi
call fcn.00405189
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x880]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 4
push ebx
lea eax, [ebp + 0xd94]
push eax
call edi
push 4
push ebx
lea eax, [ebp + 0xc90]
push eax
call edi
xor eax, eax
mov ecx, dword [ebp + 0xe98]
pop edi
pop esi
pop ebx
call fcn.00404bac
add ebp, 0xe9c
leave
ret 0x10