Function at 0x436d60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [0x44ec90]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x23c], 0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x240]
call fcn.00402790
push str.Helper_started__Command_Line:
lea ecx, [ebp - 0x244]
call fcn.00402790
push 0
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x244]
push edx
push 1
call fcn.00437f60
add esp, 0x10
lea ecx, [ebp - 0x244]
call fcn.00407b20
lea ecx, [ebp - 0x240]
call fcn.00407b20
cmp dword [ebp + 0x10], 0
jne 0x436ddc
mov eax, 4
jmp 0x4373c9
lea ecx, [ebp - 0x1c]
call fcn.004386c0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x248]
call fcn.00402790
lea ecx, [ebp - 0x248]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.004024a0
lea ecx, [ebp - 0x248]
call fcn.00407b20
lea ecx, [ebp - 0x1c]
call fcn.00402690
test eax, eax
je 0x436e7e
push 0x4427b8
lea ecx, [ebp - 0x250]
call fcn.00402790
push 0x4427d0
lea ecx, [ebp - 0x254]
call fcn.00402790
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x254]
push eax
call fcn.004319d0
add esp, 8
mov dword [ebp - 0x24c], eax
lea ecx, [ebp - 0x254]
call fcn.00407b20
lea ecx, [ebp - 0x250]
call fcn.00407b20
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x24c]
jmp 0x4373c9
lea ecx, [ebp - 0x1c]
call fcn.004025e0
test eax, eax
jne 0x436e96
call fcn.00432140
movzx ecx, al
test ecx, ecx
je 0x436ed8
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x25c]
call fcn.00402790
lea eax, [ebp - 0x25c]
push eax
call fcn.004366f0
add esp, 4
mov dword [ebp - 0x258], eax
lea ecx, [ebp - 0x25c]
call fcn.00407b20
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x258]
jmp 0x4373c9
lea ecx, [ebp - 0x1c]
call fcn.004024f0
test eax, eax
je 0x436f09
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00431ba0
add esp, 4
mov dword [ebp - 0x260], eax
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x260]
jmp 0x4373c9
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004347c0
add esp, 8
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 4], 0
je 0x436f4b
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x264], ecx
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x264]
jmp 0x4373c9
mov dword [ebp - 0x23c], 0
lea ecx, [ebp - 0x238]
call fcn.00437730
lea ecx, [ebp - 0x1c]
call fcn.004026c0
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x20]
call fcn.00401850
lea edx, [ebp - 0x20]
push edx
call fcn.0042b7d0
add esp, 4
test eax, eax
jne 0x436fe1
push 0x4427d8
lea ecx, [ebp - 0x268]
call fcn.00402790
push 0
lea eax, [ebp - 0x268]
push eax
push 1
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x268]
call fcn.00407b20
mov dword [ebp - 0x26c], 6
lea ecx, [ebp - 0x20]
call fcn.00407b20
lea ecx, [ebp - 0x238]
call fcn.00437650
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x26c]
jmp 0x4373c9
lea ecx, [ebp - 0x1c]
call fcn.00402660
test eax, eax
jne 0x437016
lea ecx, [ebp - 0x1c]
call fcn.004024c0
neg eax
sbb eax, eax
and eax, 0xfffeb3f8
add eax, 0x15f90
push eax
lea ecx, [ebp - 0x20]
push ecx
call fcn.0042eeb0
add esp, 8
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x437108
push 0x442838
lea ecx, [ebp - 0x270]
call fcn.00402790
push 0x452ca8
lea edx, [ebp - 0x270]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.0042e750
add esp, 0xc
lea ecx, [ebp - 0x270]
call fcn.00407b20
push 0x442898
lea ecx, [ebp - 0x274]
call fcn.00402790
push 0
lea ecx, [ebp - 0x274]
push ecx
push 1
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x274]
call fcn.00407b20
cmp dword [ebp - 0xc], 0
je 0x4370b1
mov byte [ebp - 0x275], 0
lea edx, [ebp - 0x275]
push edx
push 0
push 0x442834
push str.Reported
lea ecx, [ebp - 0x238]
call fcn.00437ae0
jmp 0x4370d6
mov byte [ebp - 0x276], 0
lea eax, [ebp - 0x276]
push eax
push 0
push 0x442904
push 0x442908
lea ecx, [ebp - 0x238]
call fcn.00437ae0
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x27c], ecx
lea ecx, [ebp - 0x20]
call fcn.00407b20
lea ecx, [ebp - 0x238]
call fcn.00437650
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x27c]
jmp 0x4373c9
lea ecx, [ebp - 0x1c]
call fcn.00402480
push eax
lea ecx, [ebp - 0x14]
call fcn.00402770
lea ecx, [ebp - 0x1c]
call fcn.00402520
test eax, eax
je 0x437131
lea edx, [ebp - 0x14]
push edx
call fcn.004357f0
add esp, 4
cmp dword [ebp - 0xc], 0
je 0x4371c8
push str.Finished_ARM_self_update_for_RUM
lea ecx, [ebp - 0x280]
call fcn.00402790
push 0
lea eax, [ebp - 0x280]
push eax
push 1
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x280]
call fcn.00407b20
mov byte [ebp - 0x281], 0
lea ecx, [ebp - 0x281]
push ecx
push 0
push 0x442984
push 0x442988
lea ecx, [ebp - 0x238]
call fcn.00437ae0
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x288], edx
lea ecx, [ebp - 0x14]
call fcn.00407b20
lea ecx, [ebp - 0x20]
call fcn.00407b20
lea ecx, [ebp - 0x238]
call fcn.00437650
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x288]
jmp 0x4373c9
lea ecx, [ebp - 8]
call fcn.00401850
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00438cc0
push 0x452ce0
lea ecx, [ebp - 8]
push ecx
call fcn.00403160
add esp, 8
movzx edx, al
test edx, edx
jne 0x43720c
push 0x44299c
lea eax, [ebp - 0x14]
push eax
call fcn.00403180
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x437276
push 0x4429c4
lea ecx, [ebp - 0x290]
call fcn.00402790
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.004319d0
add esp, 8
mov dword [ebp - 0x28c], eax
lea ecx, [ebp - 0x290]
call fcn.00407b20
lea ecx, [ebp - 8]
call fcn.00407b20
lea ecx, [ebp - 0x14]
call fcn.00407b20
lea ecx, [ebp - 0x20]
call fcn.00407b20
lea ecx, [ebp - 0x238]
call fcn.00437650
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x28c]
jmp 0x4373c9
push 5
push 0
lea ecx, [ebp - 0x14]
call fcn.004031c0
push eax
lea ecx, [ebp - 0x20]
call fcn.004031c0
push eax
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.004023e0
add esp, 4
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0x21
jl 0x4372f3
push str.Re_launch_succeeded
lea ecx, [ebp - 0x294]
call fcn.00402790
push 0
lea edx, [ebp - 0x294]
push edx
push 2
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x294]
call fcn.00407b20
mov dword [ebp - 0x23c], 0
jmp 0x43735e
push str.Re_launch_failed
lea ecx, [ebp - 0x298]
call fcn.00402790
push 0
lea eax, [ebp - 0x298]
push eax
push 1
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x298]
call fcn.00407b20
push str.IDS_ERROR_CATCHALL_MANUAL_DESCRIPTION
lea ecx, [ebp - 0x29c]
call fcn.00402790
push 0x452ca8
lea ecx, [ebp - 0x29c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0042e750
add esp, 0xc
lea ecx, [ebp - 0x29c]
call fcn.00407b20
mov dword [ebp - 0x23c], 2
push 0x442a84
lea ecx, [ebp - 0x2a0]
call fcn.00402790
push 0
lea eax, [ebp - 0x2a0]
push eax
push 1
call fcn.00438620
add esp, 0xc
lea ecx, [ebp - 0x2a0]
call fcn.00407b20
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0x2a4], ecx
lea ecx, [ebp - 8]
call fcn.00407b20
lea ecx, [ebp - 0x14]
call fcn.00407b20
lea ecx, [ebp - 0x20]
call fcn.00407b20
lea ecx, [ebp - 0x238]
call fcn.00437650
lea ecx, [ebp - 0x1c]
call fcn.004386a0
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.00414838
mov esp, ebp
pop ebp
ret 0x10