Function at 0x416f10
Capabilities:
Accept command line arguments
Check os version
Create process on windows
Resolve function by parsing pe exports
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa34
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xa30], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [0x43a138], eax
lea eax, [esp + 0x194]
push edi
push eax
mov dword [esp + 0xac], 0
mov dword [esp + 0x19c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x416f61
xor al, al
jmp 0x416f6c
cmp dword [esp + 0x1a8], 2
sete al
mov byte [0x43a021], al
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
lea ecx, [esp + 0x18c]
call fcn.00403190
lea ecx, [esp + 0x64]
call fcn.00403190
lea ecx, [esp + 0xec]
call fcn.00403190
lea ecx, [esp + 0xd4]
call fcn.00403190
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xb0]
call fcn.00403210
lea eax, [esp + 0x64]
push eax
lea edx, [esp + 0x190]
lea ecx, [esp + 0xb0]
call fcn.00402f20
push dword [esp + 0xac]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0xf8]
call fcn.00403190
lea edx, [esp + 0xf8]
call fcn.00405030
lea eax, [esp + 0x14]
push eax
call fcn.00403910
push eax
lea ecx, [esp + 0x68]
call fcn.00403860
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00403910
push eax
lea ecx, [esp + 0x68]
call fcn.004037d0
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0xac]
xor bh, bh
mov byte [esp + 0x13], bh
push 0x430fc0
call fcn.00403210
mov esi, eax
lea ecx, [esp + 0x64]
push 2
lea eax, [esp + 0x18]
push eax
call fcn.004035d0
mov edx, dword [esi]
mov ecx, dword [eax]
call fcn.00403be0
push dword [esp + 0x14]
test eax, eax
sete bl
call fcn.00403e80
add esp, 4
push dword [esp + 0xac]
call fcn.00403e80
add esp, 4
test bl, bl
je 0x4170f8
push 2
lea eax, [esp + 0x18]
mov bh, 1
push eax
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1b], bh
call fcn.00403460
push eax
lea ecx, [esp + 0x68]
call fcn.00403370
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00403910
push eax
lea ecx, [esp + 0x68]
call fcn.00403860
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea eax, [esp + 0x14]
push eax
call fcn.00403910
push eax
lea ecx, [esp + 0x68]
call fcn.004037d0
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0xe0]
call fcn.004040d0
lea eax, [esp + 0xe0]
push eax
push ecx
mov ecx, dword [esp + 0x100]
call fcn.00416630
test al, al
jne 0x417135
test bh, bh
jne 0x41712b
mov edx, str.Cant_load_config_info
call fcn.00414940
mov edi, 1
jmp 0x417f05
push 0x430ff8
lea ecx, [esp + 0xb0]
call fcn.00403210
lea ecx, [esp + 0x90]
call fcn.00403190
push 0x430b1c
lea ecx, [esp + 0x84]
mov byte [esp + 0x80], 1
mov byte [esp + 0x28], 0
mov edi, 0xb
mov byte [esp + 0x90], 0
call fcn.00403210
lea ecx, [esp + 0xb8]
call fcn.00403190
push str.SW_HIDE
lea ecx, [esp + 0x18]
call fcn.00403210
push 0
push eax
lea ecx, [esp + 0x6c]
call fcn.00403740
push dword [esp + 0x14]
cmp eax, 0xffffffff
setne bl
call fcn.00403e80
add esp, 4
test bl, bl
je 0x4171c3
xor bl, bl
xor edi, edi
mov byte [esp + 0x7c], bl
jmp 0x4171c7
mov bl, byte [esp + 0x7c]
cmp dword [esp + 0xe4], 0
mov esi, 1
je 0x4176dd
lea edx, [esp + 0x44]
mov dword [esp + 0x48], 0
lea ecx, [esp + 0xe0]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 4
mov dword [esp + 0x44], vtable.CObjectVector_struct_CTextConfigPair_.0
call fcn.00404390
test al, al
jne 0x41722b
test bh, bh
jne 0x417224
mov edx, str.Config_failed
call fcn.00414940
mov edi, esi
jmp 0x417595
push str.Title
lea ecx, [esp + 0x3c]
call fcn.00403210
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x30]
call fcn.00404780
push dword [esp + 0x38]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x38]
push str.BeginPrompt
call fcn.00403210
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x74]
call fcn.00404780
push dword [esp + 0x38]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x9c]
push str.Encrypt
call fcn.00403210
lea eax, [esp + 0x9c]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x3c]
call fcn.00404780
push dword [esp + 0x9c]
call fcn.00403e80
mov ecx, dword [esp + 0x3c]
add esp, 4
mov edx, 0x431060
call fcn.00403be0
mov ecx, dword [esp + 0x24]
test eax, eax
movzx ecx, cl
cmove ecx, esi
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x58]
push str.ReturnCode
call fcn.00403210
lea eax, [esp + 0x58]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0xa0]
call fcn.00404780
push dword [esp + 0x58]
call fcn.00403e80
mov ecx, dword [esp + 0xa0]
add esp, 4
mov edx, 0x431060
call fcn.00403be0
mov ecx, dword [esp + 0x8c]
test eax, eax
movzx ecx, cl
cmove ecx, esi
mov dword [esp + 0x8c], ecx
lea ecx, [esp + 0x58]
push str.Services
call fcn.00403210
lea eax, [esp + 0x58]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x18]
call fcn.00404780
push eax
lea ecx, [esp + 0x84]
call fcn.00403370
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
push dword [esp + 0x58]
call fcn.00403e80
add esp, 4
call fcn.00416a10
test edi, edi
je 0x4174a5
push str.SW_App
lea ecx, [esp + 0x5c]
call fcn.00403210
lea eax, [esp + 0x58]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x18]
call fcn.00404780
push dword [esp + 0x58]
call fcn.00403e80
mov esi, dword [esp + 0x18]
add esp, 4
mov edx, str.HIDE
mov ecx, esi
call fcn.00403be0
neg eax
mov edx, str.MAXIMIZE
mov ecx, esi
sbb eax, eax
and edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.MINIMIZE
mov eax, 1
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.RESTORE
mov eax, 2
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOW
mov eax, 3
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWDEFAULT
mov eax, 4
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWMAXIMIZED
mov eax, 5
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWMINIMIZED
mov eax, 6
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWMINNOACTIVE
mov eax, 7
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWNA
mov eax, 8
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov edx, str.SHOWNOACTIVATE
mov eax, 9
mov ecx, esi
cmove edi, eax
call fcn.00403be0
test eax, eax
mov eax, 0xa
push esi
cmove edi, eax
call fcn.00403e80
add esp, 4
push str.Progress
lea ecx, [esp + 0x18]
call fcn.00403210
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x5c]
call fcn.00404780
push dword [esp + 0x14]
call fcn.00403e80
mov ecx, dword [esp + 0x5c]
add esp, 4
mov edx, 0x4311a8
call fcn.00403be0
neg eax
lea ecx, [esp + 0x14]
push str.Directory
sbb al, al
and al, bl
mov byte [esp + 0x80], al
call fcn.00403210
lea edx, [esp + 0x14]
lea ecx, [esp + 0x44]
call fcn.00404730
push dword [esp + 0x14]
mov esi, eax
call fcn.00403e80
add esp, 4
test esi, esi
js 0x417530
mov ecx, dword [esp + 0x50]
mov eax, dword [ecx + esi*4]
lea ecx, [esp + 0xac]
add eax, 0xc
push eax
call fcn.00403370
cmp dword [esp + 0x74], 0
mov esi, dword [esp + 0x2c]
je 0x4175b4
test bh, bh
jne 0x4175b4
push 0x24
push esi
push dword [esp + 0x78]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x4175b4
mov eax, dword [esp + 0x58]
xor edi, edi
push eax
call fcn.00403e80
mov eax, dword [esp + 0xa0]
add esp, 4
push eax
call fcn.00403e80
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
call fcn.00403e80
mov eax, dword [esp + 0x74]
add esp, 4
push eax
call fcn.00403e80
add esp, 4
push esi
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], vtable.CObjectVector_struct_CTextConfigPair_.0
call fcn.00403c90
lea ecx, [esp + 0x44]
call fcn.00403c50
jmp 0x417ec9
push str.RunProgram
lea ecx, [esp + 0x18]
call fcn.00403210
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x30]
call fcn.00404780
push eax
lea ecx, [esp + 0x94]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x14]
push str.ExecuteFile
call fcn.00403210
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x30]
call fcn.00404780
push eax
lea ecx, [esp + 0xf0]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x14]
push str.ExecuteParameters
call fcn.00403210
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x48]
lea ecx, [esp + 0x30]
call fcn.00404780
push eax
lea ecx, [esp + 0xd8]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
push dword [esp + 0x14]
call fcn.00403e80
mov eax, dword [esp + 0x5c]
add esp, 4
push eax
call fcn.00403e80
mov eax, dword [esp + 0xa0]
add esp, 4
push eax
call fcn.00403e80
mov eax, dword [esp + 0x3c]
add esp, 4
push eax
call fcn.00403e80
mov eax, dword [esp + 0x74]
add esp, 4
push eax
call fcn.00403e80
add esp, 4
push esi
call fcn.00403e80
add esp, 4
mov dword [esp + 0x44], vtable.CObjectVector_struct_CTextConfigPair_.0
lea ecx, [esp + 0x44]
call fcn.00403c90
lea ecx, [esp + 0x44]
call fcn.00403c50
mov esi, dword [esp + 0x84]
test esi, esi
je 0x417701
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
mov cl, 1
call fcn.00416ca0
lea ecx, [esp + 0xc8]
mov byte [esp + 0xc4], 0
call fcn.004040d0
push ecx
lea ecx, [esp + 0xc8]
call fcn.004060f0
test al, al
jne 0x41775b
test bh, bh
jne 0x417734
mov edx, str.Can_not_create_temp_folder_archive
call fcn.00414940
test esi, esi
je 0x417751
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
mov edi, 1
jmp 0x417ea4
cmp byte [esp + 0x24], 0
je 0x4177c3
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x2c]
call fcn.00405290
push eax
lea ecx, [esp + 0xbc]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
mov esi, dword [esp + 0xbc]
add esp, 4
push esi
call fcn.0041b562
add esp, 4
inc eax
push eax
lea eax, [esp + 0x234]
push esi
push eax
call fcn.0041bc09
add esp, 0xc
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_EncryptFileA]
mov esi, dword [esp + 0x84]
push 0x1c
call fcn.00403e50
mov ebx, eax
mov dword [esp + 0x28], eax
add esp, 4
test ebx, ebx
je 0x41780f
mov dword [ebx + 4], 0
mov dword [ebx], vtable.CCodecs.0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 4
mov dword [ebx + 8], vtable.CObjectVector_struct_CArcInfoEx_.0
mov eax, dword [ebx]
push ebx
call dword [eax + 4]
jmp 0x417815
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov ecx, ebx
call fcn.00413630
test eax, eax
je 0x417851
mov edx, str.Can_not_load_codecs
call fcn.00414940
test esi, esi
je 0x417847
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
mov edi, 1
jmp 0x417e9a
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x2c]
call fcn.00405290
push eax
lea ecx, [esp + 0xbc]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
mov byte [esp + 0x23], 0
lea ecx, [esp + 0x70]
call fcn.00403190
lea eax, [esp + 0x70]
mov ecx, ebx
push eax
lea eax, [esp + 0x27]
push eax
push dword [esp + 0x84]
lea eax, [esp + 0xc4]
push eax
lea edx, [esp + 0x108]
call fcn.00415f90
test eax, eax
je 0x41791a
cmp byte [esp + 0x13], 0
jne 0x4178ea
cmp eax, 1
je 0x4178c6
cmp byte [esp + 0x23], 0
je 0x4178ea
mov edx, 8
lea ecx, [esp + 0x2c]
call fcn.00407370
push eax
lea ecx, [esp + 0x74]
call fcn.00403370
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
test esi, esi
je 0x417907
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
push dword [esp + 0x70]
call fcn.00403e80
mov edi, 1
jmp 0x417e97
push dword [esp + 0x70]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x58]
call fcn.004040d0
lea ecx, [esp + 0x58]
call fcn.00405e20
push dword [esp + 0xc8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x417974
test esi, esi
je 0x417bfd
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
mov edi, 1
jmp 0x417e86
cmp dword [esp + 0xf0], 0
je 0x417b84
lea edx, [esp + 0xec]
lea ecx, [esp + 0x38]
call fcn.00404bf0
cmp dword [esp + 0x68], 0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x104], 0x3c
mov dword [esp + 0x108], 0x8140
mov dword [esp + 0x10c], 0
mov dword [esp + 0x110], 0
mov dword [esp + 0x114], eax
je 0x4179e1
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0xd8]
call fcn.00404bb0
lea edx, [esp + 0xd4]
lea ecx, [esp + 0x70]
call fcn.00404bf0
mov eax, dword [esp + 0x70]
xor ecx, ecx
cmp dword [esp + 0x74], ecx
mov dword [esp + 0x11c], ecx
cmove eax, ecx
mov dword [esp + 0x118], eax
test edi, edi
jne 0x417a1c
mov dword [esp + 0x120], ecx
jmp 0x417af5
cmp edi, 1
jne 0x417a31
mov dword [esp + 0x120], 3
jmp 0x417af5
cmp edi, 2
jne 0x417a46
mov dword [esp + 0x120], 6
jmp 0x417af5
cmp edi, 3
jne 0x417a5b
mov dword [esp + 0x120], 9
jmp 0x417af5
cmp edi, 4
jne 0x417a70
mov dword [esp + 0x120], 5
jmp 0x417af5
cmp edi, 5
jne 0x417a82
mov dword [esp + 0x120], 0xa
jmp 0x417af5
cmp edi, 6
jne 0x417a94
mov dword [esp + 0x120], 3
jmp 0x417af5
cmp edi, 7
jne 0x417aa6
mov dword [esp + 0x120], 2
jmp 0x417af5
cmp edi, 8
jne 0x417ab8
mov dword [esp + 0x120], 7
jmp 0x417af5
cmp edi, 9
jne 0x417aca
mov dword [esp + 0x120], 8
jmp 0x417af5
cmp edi, 0xa
jne 0x417adc
mov dword [esp + 0x120], 4
jmp 0x417af5
mov eax, dword [esp + 0x120]
cmp edi, 0xb
mov ecx, 1
cmove eax, ecx
mov dword [esp + 0x120], eax
lea eax, [esp + 0x104]
mov dword [esp + 0x13c], 0
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp dword [esp + 0x124], 0x20
ja 0x417b68
cmp byte [esp + 0x13], 0
jne 0x417b29
mov edx, str.Can_not_open_file
call fcn.00414940
test esi, esi
je 0x417b46
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
push dword [esp + 0x70]
call fcn.00403e80
add esp, 4
push dword [esp + 0x38]
call fcn.00403e80
add esp, 4
mov edi, 1
jmp 0x417e86
push dword [esp + 0x70]
mov edi, dword [esp + 0x140]
call fcn.00403e80
add esp, 4
push dword [esp + 0x38]
jmp 0x417e2d
cmp dword [esp + 0x94], 0
jne 0x417c0b
push str.setup.exe
lea ecx, [esp + 0x94]
call fcn.00405140
lea edx, [esp + 0x90]
lea ecx, [esp + 0x2c]
call fcn.00404bf0
mov ecx, dword [eax]
call fcn.004069e0
push dword [esp + 0x2c]
test al, al
sete bl
call fcn.00403e80
add esp, 4
test bl, bl
je 0x417c07
cmp byte [esp + 0x13], 0
jne 0x417bdc
mov edx, str.Can_not_find_setup.exe
call fcn.00414940
test esi, esi
je 0x417bf9
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
mov ebx, dword [esp + 0x24]
mov edi, 1
jmp 0x417e86
mov ebx, dword [esp + 0x24]
lea eax, [esp + 0xb8]
push eax
lea ecx, [esp + 0x3c]
call fcn.004032c0
lea ecx, [esp + 0x38]
call fcn.00406f30
push str.__T_
lea ecx, [esp + 0x18]
call fcn.00403210
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x98]
call fcn.00414aa0
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
push dword [esp + 0x38]
call fcn.00403e80
add esp, 4
lea ecx, [esp + 0x14]
push 0x4312fc
call fcn.00403210
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x98]
call fcn.00414aa0
push dword [esp + 0x14]
call fcn.00403e80
add esp, 4
cmp dword [esp + 0x68], 0
je 0x417cba
push 0x20
lea ecx, [esp + 0x94]
call fcn.00403420
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x94]
call fcn.00404bb0
xor eax, eax
mov dword [esp + 0x140], 0x44
mov dword [esp + 0x144], 0
mov dword [esp + 0x148], str.winsta0default
mov dword [esp + 0x14c], 0
mov dword [esp + 0x16c], 1
mov word [esp + 0x172], ax
mov dword [esp + 0x174], eax
test edi, edi
je 0x417d74
cmp edi, 1
jne 0x417d10
lea eax, [edi + 2]
jmp 0x417d74
cmp edi, 2
jne 0x417d1a
lea eax, [edi + 4]
jmp 0x417d74
cmp edi, 3
jne 0x417d24
lea eax, [edi + 6]
jmp 0x417d74
cmp edi, 4
jne 0x417d2e
lea eax, [edi + 1]
jmp 0x417d74
cmp edi, 5
jne 0x417d38
lea eax, [edi + 5]
jmp 0x417d74
cmp edi, 6
jne 0x417d42
lea eax, [edi - 3]
jmp 0x417d74
cmp edi, 7
jne 0x417d4c
lea eax, [edi - 5]
jmp 0x417d74
cmp edi, 8
jne 0x417d56
lea eax, [edi - 1]
jmp 0x417d74
cmp edi, 9
jne 0x417d60
lea eax, [edi - 1]
jmp 0x417d74
cmp edi, 0xa
jne 0x417d6a
lea eax, [edi - 6]
jmp 0x417d74
cmp edi, 0xb
jne 0x417d7c
mov eax, 1
mov word [esp + 0x170], ax
lea eax, [esp + 0x90]
push eax
lea edx, [esp + 0xb0]
lea ecx, [esp + 0x30]
call fcn.00406460
mov edx, eax
lea ecx, [esp + 0x9c]
call fcn.00404bf0
push dword [esp + 0x2c]
call fcn.00403e80
add esp, 4
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x144]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0xbc]
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x417e18
cmp byte [esp + 0x13], al
jne 0x417de5
call fcn.00414990
test esi, esi
je 0x417e02
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
push dword [esp + 0x9c]
call fcn.00403e80
add esp, 4
mov edi, 1
jmp 0x417e86
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x44]
push dword [esp + 0x9c]
call fcn.00403e80
add esp, 4
test edi, edi
je 0x417e62
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [esp + 0x8c], 0
je 0x417e5b
lea eax, [esp + 0xa8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x417e7f
sub esp, 0xc
lea eax, [esp + 0x8c]
mov ecx, esp
push eax
call fcn.004032c0
xor cl, cl
call fcn.00416ca0
mov edi, dword [esp + 0xa8]
mov esi, dword [esp + 0x58]
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push esi
call fcn.00403e80
add esp, 4
test ebx, ebx
je 0x417ea4
mov eax, dword [ebx]
push ebx
call dword [eax + 8]
cmp byte [esp + 0xc4], 0
je 0x417eba
lea ecx, [esp + 0xc8]
call fcn.00405a10
push dword [esp + 0xc8]
call fcn.00403e80
add esp, 4
push dword [esp + 0xb8]
call fcn.00403e80
add esp, 4
push dword [esp + 0x80]
call fcn.00403e80
add esp, 4
push dword [esp + 0x90]
call fcn.00403e80
add esp, 4
push dword [esp + 0xac]
call fcn.00403e80
add esp, 4
push dword [esp + 0xe0]
call fcn.00403e80
add esp, 4
push dword [esp + 0xf8]
call fcn.00403e80
add esp, 4
push dword [esp + 0xd4]
call fcn.00403e80
add esp, 4
push dword [esp + 0xec]
call fcn.00403e80
add esp, 4
push dword [esp + 0x64]
call fcn.00403e80
add esp, 4
push dword [esp + 0x18c]
call fcn.00403e80
mov ecx, dword [esp + 0xa40]
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00418a92
mov esp, ebp
pop ebp
ret 0x10