Function at 0x411f54
Capabilities:
Check if file exists
Create process on windows
Create process suspended

Disassembly:
push esi
mov esi, ecx
call fcn.00422de9
test eax, eax
je 0x411f79
push 0xbf7
push str.ScreenSaverFrame::DoMayBeShowExitPopup
push str.__s__d___DoMayBeShowExitPopup_return
call fcn.00402cc1
add esp, 0xc
pop esi
ret
mov ecx, esi
call fcn.004114cb
test al, al
je 0x411f77
call fcn.00423dfe
pop esi
test eax, eax
jne 0x424d60
jmp 0x424ba4
push 0xec
mov eax, 0x54d522
call fcn.0051d3dc
lea eax, [ebp - 0xac]
push eax
call fcn.004226b9
xor ebx, ebx
mov dword [ebp - 0xc8], 7
xor eax, eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xcc], ebx
mov word [ebp - 0xdc], ax
lea eax, [ebp - 0xdc]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.00437a74
sub esp, 0xc
lea eax, [ebp - 0xdc]
mov ecx, esp
push eax
mov dword [ecx + 0x10], ebx
mov dword [ecx + 0x14], ebx
call fcn.0040342e
call fcn.00423e91
add esp, 0x18
test al, al
je 0x424d44
push ebx
call fcn.005283c3
push 0x82
mov edi, eax
mov esi, edx
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.00520800
push 0xa
push 0x40
lea eax, [ebp - 0x94]
push eax
push esi
push edi
call fcn.005321b6
add esp, 0x24
test eax, eax
je 0x424c6d
push eax
push 0xd1d
push str.LaunchExitPopup
push str.__s__d___LaunchExitPopup__i64tot_s_error_re___d
call fcn.00402cc1
add esp, 0x10
jmp 0x424d44
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0xf4]
call fcn.00401b4a
push str._hep:
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 2
call fcn.00401b4a
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 3
push eax
call fcn.00524c40
pop ecx
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0xc4]
call fcn.004037f5
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call fcn.0043bf37
pop ecx
test eax, eax
je 0x424d17
cmp dword [ebp - 0xb0], 8
lea ecx, [ebp - 0xc4]
push 1
cmovae ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xac]
cmp dword [ebp - 0x98], 8
push ebx
cmovae eax, dword [ebp - 0xac]
push ecx
push eax
push str.open
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x424d2e
push 0xd26
push str.LaunchExitPopup
push str.__s__d___LaunchExitPopup_Check360Sign_error
call fcn.00402cc1
add esp, 0xc
lea ecx, [ebp - 0xc4]
call fcn.004036e0
lea ecx, [ebp - 0xf4]
call fcn.004036e0
lea ecx, [ebp - 0xdc]
call fcn.004036e0
lea ecx, [ebp - 0xac]
call fcn.004036e0
call fcn.0051d386
ret
push 0x158
mov eax, 0x54d576
call fcn.0051d3dc
lea eax, [ebp - 0xac]
push eax
call fcn.004226b9
pop ecx
xor ebx, ebx
lea eax, [ebp - 0xac]
cmp dword [ebp - 0x98], 8
mov dword [ebp - 4], ebx
cmovae eax, dword [ebp - 0xac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424f77
cmp dword [ebp - 0x98], 8
lea eax, [ebp - 0xac]
cmovae eax, dword [ebp - 0xac]
push eax
call fcn.0043bf37
pop ecx
test eax, eax
je 0x424f77
push 0x44
pop esi
push esi
lea eax, [ebp - 0x164]
push ebx
push eax
call fcn.00520800
xor eax, eax
mov dword [ebp - 0x164], esi
inc eax
mov dword [ebp - 0x15c], str.Default
push ebx
mov dword [ebp - 0x138], eax
mov word [ebp - 0x134], ax
call fcn.005283c3
push 0x82
mov edi, eax
mov esi, edx
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.00520800
push 0xa
push 0x40
lea eax, [ebp - 0x94]
push eax
push esi
push edi
call fcn.005321b6
add esp, 0x30
test eax, eax
je 0x424e4a
push eax
push 0xcfe
push str.LaunchExitPopupEx
push str.__s__d___LaunchExitPopup__i64tot_s_error_re___d
call fcn.00402cc1
add esp, 0x10
jmp 0x424f77
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x10c]
call fcn.00401b4a
push str._hepex:
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 1
call fcn.00401b4a
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 2
push eax
call fcn.00524c40
pop ecx
push eax
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0xdc]
call fcn.004037f5
push 0x562cf4
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.004014b0
add esp, 0xc
cmp dword [ebp - 0xc8], 8
lea ecx, [ebp - 0xdc]
push dword [ebp - 0xcc]
cmovae ecx, dword [ebp - 0xdc]
push ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004037f5
mov byte [ebp - 0x110], bl
lea ecx, [ebp - 0xc4]
push dword [ebp - 0x110]
mov dword [ebp - 0xb4], ebx
push eax
mov dword [ebp - 0xb0], ebx
call fcn.00403238
lea ecx, [ebp - 0xf4]
call fcn.004036e0
xor eax, eax
lea edi, [ebp - 0x120]
cmp dword [ebp - 0xb0], 8
lea ecx, [ebp - 0x120]
push ecx
stosd dword es:[edi], eax
lea ecx, [ebp - 0x164]
push ecx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
push ebx
push ebx
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0xc4]
cmovae eax, dword [ebp - 0xc4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp - 0x11c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x120]
call esi
lea ecx, [ebp - 0xc4]
call fcn.004036e0
lea ecx, [ebp - 0xdc]
call fcn.004036e0
lea ecx, [ebp - 0x10c]
call fcn.004036e0
lea ecx, [ebp - 0xac]
call fcn.004036e0
call fcn.0051d386
ret