Function at 0x4011e0
Capabilities:
Accept command line arguments
Create process on windows
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x69c
mov eax, dword [0x521174]
xor eax, esp
mov dword [esp + 0x694], eax
push ebx
push ebp
push esi
push edi
call fcn.004010c0
mov esi, eax
mov dword [esp + 0x10], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401206
sub eax, edx
sar eax, 1
mov ecx, 0
je 0x401232
lea esp, [esp]
mov dl, byte [esi + ecx*2]
mov byte [esp + ecx + 0x180], dl
add ecx, 1
sub eax, 1
jne 0x401220
mov byte [esp + ecx + 0x180], 0
push 0xf0c0
mov edi, 0x411470
mov ecx, 0x411460
mov bl, 1
call fcn.00401120
add esp, 4
test al, al
jne 0x401259
xor bl, bl
push 0xcb000
mov edi, 0x420540
mov ecx, 0x420530
call fcn.00401120
add esp, 4
test al, al
jne 0x401276
xor bl, bl
push 0x3345c
mov edi, str._PDF_1.4_r_n1_0_obj___Creator_
mov ecx, str.Windexter.pdf
call fcn.00401120
add esp, 4
cmp al, 1
jne 0x40131c
mov ecx, dword [0x522c84]
movzx eax, word [ecx]
cmp ax, 0x2d
je 0x4012aa
cmp ax, 0x2f
jne 0x40131c
movzx eax, word [ecx + 2]
cmp ax, 0x68
je 0x4012c0
cmp ax, 0x48
je 0x4012c0
cmp ax, 0x3f
jne 0x40131c
push str.Windexter.pdf
lea eax, [esp + 0x184]
push eax
push str._s_s
lea ecx, [esp + 0x84]
push 0x104
push ecx
call fcn.00401e60
add esp, 0x14
lea esi, [esp + 0x78]
lea edx, [esp + 0x288]
call fcn.00401080
call fcn.00401ffa
push 1
push 0
push 0
lea edx, [esp + 0x294]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4017b7
cmp bl, 1
jne 0x4017b7
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x411460
lea eax, [esp + 0x184]
push eax
push str._s_s
lea ecx, [esp + 0x84]
push 0x104
push ecx
call fcn.00401e60
lea eax, [esp + 0x8c]
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401362
sub eax, edx
mov ecx, 0
je 0x401396
jmp 0x401380
movsx dx, byte [esp + ecx + 0x78]
mov word [esp + ecx*2 + 0x288], dx
add ecx, 1
sub eax, 1
jne 0x401380
mov word [esp + ecx*2 + 0x288], 0
call fcn.00401ffa
call fcn.0040203e
push 0
mov dword [eax], 0
push str._version_2.0_
lea eax, [esp + 0x290]
push eax
push 0
call fcn.00402082
add esp, 0x10
mov esi, eax
call fcn.0040203e
cmp dword [eax], 0
jne 0x4017b7
test esi, esi
jne 0x401603
push 0x14
push str.Windexter_.NET_Framework_2.0_Installation_Check
push str.This_application_requires_the_.NET_Framework_2.0__which_is_not_installed._nDo_you_wish_to_install_the_.NET_Framework_2.0_now__n
push esi
call ebx
cmp eax, 6
jne 0x4017b7
push str.PROCESSOR_ARCHITECTURE
push 0x104
lea ecx, [esp + 0x5a0]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00402152
add esp, 0x10
cmp dword [esp + 0x1c], esi
jne 0x4014b3
push 0x40a
mov edi, str._h1_style_text_align:_center___r_n___Windexter_launched_Download_Page__h1__r_n_h2__r_n___To_download_the_.NET_Framework_Version_2.0_Redistributable_Package__click_one_of_r_n___the_following_links:__h2__r_n_h3__r_n____a_href_http:__www.microsoft.com_downloads_thankyou.aspx_familyId0856eacb_4362_4b0d_8edd_aab15c5e04f5displayLangen___r_n______Microsoft_.NET_Framework_Version_2.0_Redistributable_Package__x86___a___h3__r_n_h3__r_n____a_href_http:__www.microsoft.com_downloads_thankyou.aspx_familyIdB44A0000_ACF8_4FA1_AFFB_40E78D788B00displayLangen___r_n______Microsoft_.NET_Framework_Version_2.0_Redistributable_Package__x64___a___h3__r_n_h3__r_n____a_href_http:__www.microsoft.com_downloads_thankyou.aspx_familyId53C2548B_BEC7_4AB4_8CBE_33E07CFC83A7displayLangen___r_n______Microsoft_.NET_Framework_Version_2.0_Redistributable_Package__IA64___a___h3__r_n_h2__r_n___After_selecting_the_proper_link_above__download_the_package__and_install_it.nbsp__r_n___Once_you_are_finished__return_to_the_Windexter_.NET_Installation_Check__and_select_r_n___OK.__h2__r_n
mov ecx, 0x51e9ac
call fcn.00401120
push 0x51e9ac
lea eax, [esp + 0x188]
push eax
push str._s_s
lea ecx, [esp + 0x88]
push 0x104
push ecx
call fcn.00401e60
add esp, 0x18
lea esi, [esp + 0x78]
lea edx, [esp + 0x288]
call fcn.00401080
call fcn.00401ffa
push 1
push 0
push 0
lea edx, [esp + 0x294]
push edx
push str.open
push 0
call ebp
cmp eax, 0x20
jle 0x4017b7
push 0x4031
push str.Windexter_.NET_Framework_2.0_Installation
push str.Launching_a_web_browser_to_connect_to_Microsofts_.NET_Framework_2.0_ndownload_site.__Choose_the_appropriate_download_for_your_processor_nand_operating_system_type._n_nOnce_the_.NET_Framework_has_been_installed__click_OK._n_nClick_Cancel_to_abort_this_application.
push 0
call ebx
cmp eax, 1
je 0x401331
jmp 0x4017b7
lea eax, [esp + 0x598]
push str.IA64
push eax
call fcn.004023b4
add esp, 8
test eax, eax
jne 0x4014ea
push 0x105
mov edi, str._DEFAULT__nBASEURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyId53C2548B_BEC7_4AB4_8CBE_33E07CFC83A7displayLangen_n_InternetShortcut__nURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyId53C2548B_BEC7_4AB4_8CBE_33E07CFC83A7displayLangen_n
mov ecx, str.DotNetDownload_IA64.url
call fcn.00401120
push str.DotNetDownload_IA64.url
jmp 0x40158e
push str.SYSTEMROOT
push 0x104
lea eax, [esp + 0x498]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.00402152
add esp, 0x10
cmp dword [esp + 0x14], 0
jbe 0x401575
push str.SysWow64
lea edx, [esp + 0x494]
push 0x104
push edx
call fcn.00402404
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x4a0]
push ecx
call fcn.00401ae3
add esp, 0x14
test eax, eax
jne 0x401575
push 0x105
mov edi, str._DEFAULT__nBASEURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyIdB44A0000_ACF8_4FA1_AFFB_40E78D788B00displayLangen_n_InternetShortcut__nURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyIdB44A0000_ACF8_4FA1_AFFB_40E78D788B00displayLangen_n
mov ecx, str.DotNetDownload_x64.url
call fcn.00401120
push str.DotNetDownload_x64.url
lea edx, [esp + 0x188]
push edx
push str._s_s
push 0x104
lea eax, [esp + 0x8c]
push eax
jmp 0x4015a8
push 0x105
mov edi, str._DEFAULT__nBASEURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyId0856eacb_4362_4b0d_8edd_aab15c5e04f5displayLangen_n_InternetShortcut__nURLhttp:__www.microsoft.com_downloads_thankyou.aspx_familyId0856eacb_4362_4b0d_8edd_aab15c5e04f5displayLangen_n
mov ecx, str.DotNetDownload_x86.url
call fcn.00401120
push str.DotNetDownload_x86.url
lea ecx, [esp + 0x188]
push ecx
push str._s_s
push 0x104
lea edx, [esp + 0x8c]
push edx
call fcn.00401e60
add esp, 0x18
lea esi, [esp + 0x78]
lea edx, [esp + 0x288]
call fcn.00401080
call fcn.00401ffa
push 1
push 0
push 0
lea eax, [esp + 0x294]
push eax
push str.open
push 0
call ebp
cmp eax, 0x20
jle 0x4017b7
push 0x31
push str.Windexter_.NET_Framework_2.0_Installation
push str.Launching_a_web_browser_to_download_the_proper_.NET_Framework_2.0_npackage_for_your_version_of_Windows.__Download_and_install_the_nfile_through_the_web_browser._n_nOnce_the_.NET_Framework_has_been_installed__click_OK._n_nClick_Cancel_to_abort_this_application.
push 0
call ebx
cmp eax, 1
je 0x401331
jmp 0x4017b7
mov esi, dword [esp + 0x10]
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401610
sub eax, edx
sar eax, 1
mov ecx, 0
je 0x401642
jmp 0x401630
mov dl, byte [esi + ecx*2]
mov byte [esp + ecx + 0x180], dl
add ecx, 1
sub eax, 1
jne 0x401630
push 0x420530
lea eax, [esp + 0x184]
push eax
push str._s_s
mov byte [esp + ecx + 0x18c], 0
lea ecx, [esp + 0x84]
push 0x104
push ecx
call fcn.00401e60
lea eax, [esp + 0x8c]
add esp, 0x14
lea edx, [eax + 1]
jmp 0x401680
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x401680
sub eax, edx
mov ecx, 0
je 0x4016a8
movsx dx, byte [esp + ecx + 0x78]
mov word [esp + ecx*2 + 0x288], dx
add ecx, 1
sub eax, 1
jne 0x401692
lea eax, [esp + 0x10]
push eax
mov word [esp + ecx*2 + 0x28c], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x18], ebp
je 0x4017b7
push 0x8000
call fcn.004024c4
lea ecx, [esp + 0x28c]
push ecx
push str.__s_
mov ebx, eax
push 0x4000
push ebx
call fcn.00402587
mov esi, ebx
add esp, 0x14
lea ecx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x401700
sub esi, ecx
mov edi, 1
sar esi, 1
cmp dword [esp + 0x10], edi
jle 0x401765
jmp 0x401724
mov ebp, dword [esp + 0x18]
mov edx, dword [ebp + edi*4]
mov eax, edx
lea ebp, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401730
push edx
sub eax, ebp
push str.___s_
lea edx, [ebx + esi*2]
sar eax, 1
push 0x4000
push edx
mov ebp, eax
call fcn.00402587
add edi, 1
add esp, 0x10
cmp edi, dword [esp + 0x10]
lea esi, [esi + ebp + 4]
jl 0x401720
push 0x40
lea eax, [esp + 0x38]
push 0
push eax
call fcn.004086e0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x34]
push edx
push eax
push eax
push 0x20
push 1
push eax
push eax
push ebx
push eax
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push ebx
call fcn.004025a3
add esp, 4
mov ecx, dword [esp + 0x6a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401a5c
add esp, 0x69c
ret