Function at 0x406ea0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4cc
mov eax, dword [0x4142c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], 0
mov ax, word [0x410844]
mov word [ebp - 0x218], ax
push 0x208
push 0
lea ecx, [ebp - 0x216]
push ecx
call fcn.00409c60
add esp, 0xc
mov dx, word [0x410848]
mov word [ebp - 0x428], dx
push 0x208
push 0
lea eax, [ebp - 0x426]
push eax
call fcn.00409c60
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x407173
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x44c]
call fcn.00401410
lea ecx, [ebp - 0x448]
call fcn.00407a10
lea ecx, [ebp - 0x49c]
call fcn.00407a10
lea ecx, [ebp - 0x434]
call fcn.00407a10
push 0x5c
lea ecx, [ebp - 0x44c]
call fcn.00407b30
push eax
lea eax, [ebp - 0x4c8]
push eax
lea ecx, [ebp - 0x44c]
call fcn.00407bd0
push eax
lea ecx, [ebp - 0x448]
call fcn.00407a30
lea ecx, [ebp - 0x4c8]
call fcn.00401450
push 0x41084c
lea ecx, [ebp - 0x448]
call fcn.00407a50
push str.club_application
lea ecx, [ebp - 0x448]
call fcn.00407a50
push 0x410850
lea ecx, [ebp - 0x448]
call fcn.00407a50
push str.dotnetfx30SP1setup.exe
lea ecx, [ebp - 0x448]
call fcn.00407a50
push str.__qb
lea ecx, [ebp - 0x448]
call fcn.00407a70
push 0x44
push 0
lea ecx, [ebp - 0x498]
push ecx
call fcn.00409c60
add esp, 0xc
mov dword [ebp - 0x498], 0x44
push 0x10
push 0
lea edx, [ebp - 0x444]
push edx
call fcn.00409c60
add esp, 0xc
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0x498]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x448]
call fcn.00402450
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 0
je 0x407147
mov byte [ebp - 0x4a1], 0
movzx edx, byte [ebp - 0x4a1]
test edx, edx
jne 0x4070f9
push 0x4bf
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x444]
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x4a8], eax
mov ecx, dword [ebp - 0x4a8]
mov dword [ebp - 0x4cc], ecx
cmp dword [ebp - 0x4cc], 0
je 0x4070a1
cmp dword [ebp - 0x4cc], 1
je 0x4070aa
jmp 0x4070f4
mov byte [ebp - 0x4a1], 1
jmp 0x4070f4
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x4c4]
push edx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4070f4
lea eax, [ebp - 0x4c4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x4070f2
lea edx, [ebp - 0x4c4]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4070aa
jmp 0x407054
mov dword [ebp - 0x4a0], 0xffffffff
lea ecx, [ebp - 0x4a0]
push ecx
mov edx, dword [ebp - 0x444]
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0x4a0], 0xbc2
jne 0x40712d
mov dword [ebp - 0x42c], 0xbc2
mov eax, dword [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x440]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x434]
call fcn.00401450
lea ecx, [ebp - 0x49c]
call fcn.00401450
lea ecx, [ebp - 0x448]
call fcn.00401450
lea ecx, [ebp - 0x44c]
call fcn.00401450
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409937
mov esp, ebp
pop ebp
ret