Function at 0x410f70
Capabilities:
Create process on windows
Get common file path
Resolve function by parsing pe exports
Set current directory

Disassembly:
push 0xffffffffffffffff
push 0x42f6c1
mov eax, dword fs:[0]
push eax
sub esp, 0x304
mov eax, dword [0x4490c0]
xor eax, esp
mov dword [esp + 0x300], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4490c0]
xor eax, esp
push eax
lea eax, [esp + 0x318]
mov dword fs:[0], eax
mov eax, dword [esp + 0x338]
mov ebx, dword [esp + 0x344]
mov edi, dword [esp + 0x348]
mov esi, dword [esp + 0x328]
mov dword [esp + 0x60], ecx
push str.Launcher::DoLaunch
lea ecx, [esp + 0x84]
mov dword [esp + 0x24], eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x28], edi
call fcn.00401d59
xor ebp, ebp
push str.Runapp
lea ecx, [esp + 0x68]
mov dword [esp + 0x324], ebp
call fcn.00401d59
push 0x200000
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x15c]
mov byte [esp + 0x32c], 1
call fcn.0040ad10
cmp dword [esp + 0x7c], 0x10
jb 0x411039
mov eax, dword [esp + 0x68]
push eax
call fcn.00413f2a
add esp, 4
mov dword [esp + 0x7c], 0xf
mov dword [esp + 0x78], ebp
mov byte [esp + 0x68], 0
cmp dword [esp + 0x98], 0x10
mov byte [esp + 0x320], 4
jb 0x41106c
mov ecx, dword [esp + 0x84]
push ecx
call fcn.00413f2a
add esp, 4
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x9c], 0xf
mov dword [esp + 0x98], ebp
mov byte [esp + 0x88], 0
call fcn.00401d59
lea edx, [esp + 0x28]
push edx
push 0x200000
lea ecx, [esp + 0x158]
mov byte [esp + 0x328], 5
call fcn.0040b1f0
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x320], 4
jb 0x4110ca
mov eax, dword [esp + 0x2c]
push eax
call fcn.00413f2a
add esp, 4
cmp esi, ebp
mov dword [ebx], ebp
mov dword [edi], ebp
mov byte [esp + 0x17], 0
je 0x4118b2
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4110e0
sub eax, edx
je 0x4118b2
lea ecx, [esp + 0x1d8]
call fcn.00403de0
push 1
push 0x20
push esi
lea ecx, [esp + 0x1c0]
mov byte [esp + 0x32c], 6
call fcn.00406310
mov edi, 0xf
mov dword [esp + 0xf8], edi
mov dword [esp + 0xf4], ebp
mov byte [esp + 0xe4], 0
lea ecx, [esp + 0xe0]
push ecx
lea ecx, [esp + 0x1b8]
mov byte [esp + 0x324], 8
call fcn.00406940
test al, al
je 0x411889
lea edx, [esp + 0xe0]
push edx
lea ecx, [esp + 0x1dc]
call fcn.00405bd0
push 4
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0xe8]
call fcn.00404ad0
push str..BAT
mov ecx, eax
mov byte [esp + 0x324], 9
call fcn.00404f30
test eax, eax
sete bl
cmp dword [esp + 0x40], 0x10
mov byte [esp + 0x320], 8
jb 0x4111b1
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00413f2a
add esp, 4
test bl, bl
je 0x4113d4
mov byte [esp + 0x17], 1
mov dword [esp + 0x14c], edi
mov dword [esp + 0x148], ebp
mov byte [esp + 0x138], 0
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x324], 0xa
call fcn.00413550
add esp, 4
mov ecx, eax
mov byte [esp + 0x320], 0xb
call fcn.00412f60
lea ecx, [esp + 0x28]
mov bl, al
mov byte [esp + 0x320], 0xa
call fcn.00413020
test bl, bl
push 1
lea ecx, [esp + 0x100]
je 0x4112d1
push 0x17
call fcn.00412e00
mov bl, 0xc
push str.Command.com
lea ecx, [esp + 0x2c]
mov byte [esp + 0x324], bl
call fcn.00401d59
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0x324], 0xd
call fcn.004046a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x320], bl
call fcn.004015b8
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x100]
call fcn.00404dc0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x320], 0xe
jb 0x411287
mov eax, dword [eax + 4]
jmp 0x41128a
add eax, 4
push esi
push eax
lea edx, [esp + 0x13c]
push str._s__C__s
push edx
call fcn.00408550
add esp, 0x10
lea ecx, [esp + 0x28]
call fcn.004015b8
mov esi, dword [esp + 0x33c]
cmp si, bp
jne 0x4112b8
xor esi, esi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x320], 0xa
call fcn.00403e00
jmp 0x41137a
push 0x13
call fcn.00412e00
push str.cmd.exe
lea ecx, [esp + 0x2c]
mov byte [esp + 0x324], 0xf
call fcn.00401d59
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x100]
mov byte [esp + 0x324], 0x10
call fcn.004046a0
lea ecx, [esp + 0x28]
mov byte [esp + 0x320], 0xf
call fcn.004015b8
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x100]
call fcn.00404dc0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x320], 0x11
jb 0x41133c
mov eax, dword [eax + 4]
jmp 0x41133f
add eax, 4
push esi
push eax
lea edx, [esp + 0x13c]
push str._s__C___s_
push edx
call fcn.00408550
add esp, 0x10
lea ecx, [esp + 0x28]
call fcn.004015b8
lea ecx, [esp + 0xfc]
mov byte [esp + 0x320], 0xa
call fcn.00403e00
mov esi, dword [esp + 0x33c]
mov eax, dword [esp + 0x148]
add eax, 1
push eax
call fcn.004162bd
mov edx, dword [esp + 0x13c]
add esp, 4
cmp dword [esp + 0x14c], 0x10
mov ebx, eax
mov dword [esp + 0x1c], ebx
jae 0x4113ab
lea edx, [esp + 0x138]
mov ecx, ebx
lea ecx, [ecx]
mov al, byte [edx]
mov byte [ecx], al
add edx, 1
add ecx, 1
test al, al
jne 0x4113b0
lea ecx, [esp + 0x134]
mov byte [esp + 0x320], 8
call fcn.004015b8
jmp 0x411418
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4113e0
sub eax, edx
add eax, 1
push eax
call fcn.004162bd
mov edx, eax
add esp, 4
mov dword [esp + 0x1c], edx
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [eax + edx], cl
add eax, 1
test cl, cl
jne 0x411401
mov esi, dword [esp + 0x33c]
mov ebx, dword [esp + 0x1c]
push 0x103
lea ecx, [esp + 0x215]
push ebp
push ecx
mov byte [esp + 0x21c], 0
call fcn.004157e0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
cmp byte [esp + 0x334], 0
je 0x41153a
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Changing_Current_Directory
call fcn.00401d59
lea edx, [esp + 0x16c]
push 1
push edx
call fcn.0040b0e0
add esp, 0x24
lea eax, [esp + 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xfc]
push ecx
lea ecx, [esp + 0x1dc]
call fcn.004040c0
cmp dword [esp + 0x110], ebp
mov byte [esp + 0x320], 0x12
je 0x411526
cmp dword [esp + 0x114], 0x10
mov eax, dword [esp + 0x100]
jae 0x4114c3
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x411526
call edi
push eax
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x1e0]
call fcn.004040c0
cmp dword [eax + 0x18], 0x10
mov byte [esp + 0x324], 0x13
jb 0x4114f5
mov eax, dword [eax + 4]
jmp 0x4114f8
add eax, 4
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x3c], esp
push str.SetCurrentDirectory__s_:_ErrorCode:_d
call fcn.00401d59
lea eax, [esp + 0x174]
push ebp
push eax
call fcn.0040b0e0
add esp, 0x2c
lea ecx, [esp + 0x28]
call fcn.004015b8
lea ecx, [esp + 0xfc]
mov byte [esp + 0x320], 8
call fcn.004015b8
cmp byte [esp + 0x17], 0
je 0x41158d
push ebx
lea ecx, [esp + 0x2c]
call fcn.00401d59
lea ecx, [esp + 0x28]
push ecx
mov byte [esp + 0x324], 0x14
call fcn.00412eb0
add esp, 4
lea ecx, [esp + 0x28]
mov esi, eax
mov byte [esp + 0x320], 8
call fcn.004015b8
push esi
call fcn.004194e6
mov edx, dword [esp + 0x28]
push esi
mov dword [edx], eax
call fcn.0041622a
add esp, 8
jmp 0x4117e5
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Calling_create_Process
call fcn.00401d59
lea eax, [esp + 0x16c]
push 1
push eax
call fcn.0040b0e0
add esp, 0x24
cmp si, bp
jne 0x4115bc
mov esi, 8
push 0x44
lea ecx, [esp + 0xa0]
push ebp
push ecx
call fcn.004157e0
mov eax, dword [esp + 0x2c]
add esp, 0xc
mov edx, eax
neg edx
sbb edx, edx
mov ecx, 1
push ebx
sub esp, 0x1c
and edx, str.Winsta0Default
cmp eax, ebp
mov dword [esp + 0xcc], ecx
mov dword [esp + 0xd0], ecx
mov dword [esp + 0xbc], 0x44
mov dword [esp + 0xc4], edx
mov word [esp + 0xec], si
mov dword [esp + 0xe8], 5
mov ecx, esp
mov dword [esp + 0x38], esp
jne 0x411668
push str.Just_launch_it_normally___s
call fcn.00401d59
lea eax, [esp + 0x170]
push 1
push eax
call fcn.0040b0e0
mov eax, dword [esp + 0x368]
add esp, 0x28
lea ecx, [esp + 0xfc]
push ecx
lea edx, [esp + 0xa0]
push edx
push ebp
push ebp
push eax
push ebp
push ebp
push ebp
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x4116ae
push str.Launch_it_as_the_given_user__s
call fcn.00401d59
lea ecx, [esp + 0x170]
push 1
push ecx
call fcn.0040b0e0
mov ecx, dword [esp + 0x368]
add esp, 0x28
lea edx, [esp + 0xfc]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xa0]
push eax
push ebp
push ebp
push ecx
push ebp
push ebp
push ebp
push ebx
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, ebp
je 0x4117b8
cmp byte [esp + 0x32c], 0
je 0x4117e5
cmp byte [esp + 0x330], 0
je 0x411771
mov eax, dword [esp + 0xfc]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x3e8
push eax
call edi
cmp eax, 0x102
jne 0x411781
mov bl, byte [esp + 0x34c]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
call esi
test eax, eax
je 0x411748
test bl, bl
je 0x411723
cmp dword [esp + 0x2c], 0xf
jne 0x411735
lea edx, [esp + 0x28]
push edx
call ebp
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push 0
push 0
push 0
lea ecx, [esp + 0x38]
push ecx
call esi
test eax, eax
jne 0x411718
mov ecx, dword [esp + 0x60]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xfc]
push 0x3e8
push ecx
call edi
cmp eax, 0x102
je 0x411705
mov ebx, dword [esp + 0x1c]
xor ebp, ebp
jmp 0x411781
mov edx, dword [esp + 0xfc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xfc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0xfc]
cmp eax, ebp
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4117a8
push eax
call esi
mov eax, dword [esp + 0x100]
cmp eax, ebp
je 0x4117e5
push eax
call esi
jmp 0x4117e5
call edi
mov edx, dword [esp + 0x5c]
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push str.Launch_failed_Win32Err:_d
mov dword [edx], eax
call fcn.00401d59
lea eax, [esp + 0x170]
push ebp
push eax
call fcn.0040b0e0
add esp, 0x28
cmp byte [esp + 0x334], 0
je 0x411822
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push str.Setting_Current_Directory_to_Original
call fcn.00401d59
lea ecx, [esp + 0x16c]
push 1
push ecx
call fcn.0040b0e0
add esp, 0x24
lea edx, [esp + 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push ebx
call fcn.0041622a
add esp, 4
cmp dword [esp + 0xf8], 0x10
jb 0x411845
mov eax, dword [esp + 0xe4]
push eax
call fcn.00413f2a
add esp, 4
mov dword [esp + 0xf8], 0xf
lea ecx, [esp + 0x1b4]
mov dword [esp + 0xf4], ebp
mov byte [esp + 0xe4], 0
mov byte [esp + 0x320], 6
call fcn.00405ed0
lea ecx, [esp + 0x1d8]
mov byte [esp + 0x320], 4
call fcn.00403e00
jmp 0x4118de
cmp dword [esp + 0xf8], 0x10
mov dword [ebx], 2
jb 0x4118a9
mov ecx, dword [esp + 0xe4]
push ecx
call fcn.00413f2a
add esp, 4
mov dword [esp + 0xf8], edi
jmp 0x411850
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
mov dword [ebx], 0x57
push str.returning_ERROR_INVALID_PARAMETER
mov dword [edi], ebp
call fcn.00401d59
lea edx, [esp + 0x16c]
push ebp
push edx
call fcn.0040b0e0
add esp, 0x24
lea ecx, [esp + 0x150]
mov dword [esp + 0x320], 0xffffffff
call fcn.0040af00
mov ecx, dword [esp + 0x318]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x300]
xor ecx, esp
call fcn.004157c8
add esp, 0x310
ret 0x28