Function at 0x401c16
Capabilities:
Copy file
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c4
push ebx
push esi
push edi
xor ebx, ebx
push 0x3f
lea eax, [esp + 0x35]
push ebx
push eax
mov byte [esp + 0x3c], bl
call fcn.00403240
add esp, 0xc
push 0x103
lea eax, [esp + 0xbd]
push ebx
push eax
mov dword [esp + 0x1c], 1
mov byte [esp + 0xc4], bl
call fcn.00403240
add esp, 0xc
push 0x40
lea eax, [esp + 0x78]
push ebx
push eax
mov dword [esp + 0x7c], ebx
call fcn.00403240
mov esi, dword [ebp + 0x10]
mov dword [esp + 0x28], ebx
xor eax, eax
lea edi, [esp + 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
push str._nodel
stosd dword es:[edi], eax
call fcn.00401b10
mov dword [esp + 0x18], eax
mov dword [esp], str._ghost
call fcn.00401b10
mov dword [esp + 0x1c], eax
mov dword [esp], str._stop
call fcn.00401b10
mov dword [esp + 0x30], eax
mov dword [esp], 0x4042e0
call fcn.00401b10
test eax, eax
pop ecx
je 0x401cf4
push str._unattid
lea eax, [esp + 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x40
pop ecx
sub ecx, eax
push ecx
lea eax, [esp + eax + 0x34]
push eax
mov ebx, esi
call fcn.00401b6d
pop ecx
pop ecx
xor ebx, ebx
push 0x4042f8
mov dword [esp + 0x10], ebx
call fcn.00401b10
test eax, eax
pop ecx
je 0x401d59
push 6
push str.SET_RESCUEAPP_MAJOR_d_n
call fcn.00402dae
push 3
push str.SET_RESCUEAPP_MINOR_d_n
call fcn.00402dae
mov edi, 0x178
push edi
push str.SET_RESCUEAPP_BUILD_d_n
call fcn.00402dae
mov esi, 0x50a
push esi
push str.SET_RESCUEAPP_REVISION_d_n
call fcn.00402dae
push esi
push edi
push 3
push 6
push str.SET_RESCUEAPP_VER_d._d._d._d_n
call fcn.00402dae
add esp, 0x34
xor eax, eax
jmp 0x40208b
mov edi, str._app
push edi
call fcn.00401b10
test eax, eax
pop ecx
je 0x401daf
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x401d87
call fcn.00401705
jmp 0x401d89
xor eax, eax
cmp eax, ebx
je 0x401daf
push 0x405020
call fcn.00402ae8
pop ecx
call fcn.0040174a
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x405020]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str._params
call fcn.00401b10
test eax, eax
pop ecx
je 0x401e60
push 1
push ebx
push str.eula.txt
push 0x2717
call fcn.00401777
push 0x404135
call fcn.0040198e
add esp, 0x14
cmp dword [esp + 0x14], ebx
je 0x401df2
push str._nodel
call fcn.0040198e
pop ecx
cmp dword [esp + 0x18], ebx
je 0x401e14
push str._ghost
call fcn.0040198e
cmp byte [esp + 0x34], bl
pop ecx
je 0x401e14
lea eax, [esp + 0x30]
push eax
call fcn.0040198e
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401777
call fcn.00401a23
call fcn.00401abc
push 1
mov edi, str.script
push edi
push 0x2712
push 0x2713
call fcn.00401777
push 1
push edi
push 0x2714
push 0x2715
call fcn.00401777
add esp, 0x30
jmp 0x401d52
push edi
call fcn.00401b10
test eax, eax
pop ecx
jne 0x401d52
mov edi, str.script
lea eax, [esp + 0x1c0]
push eax
lea ebx, [esp + 0x2cc]
lea esi, [esp + 0x10]
call fcn.004015b8
xor ebx, ebx
cmp eax, ebx
pop ecx
je 0x401ead
push dword [eax*4 + 0x40502c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401683
pop ecx
pop ecx
jmp 0x40202a
push 0xa
push 0x7d00
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
mov dword [0x405384], eax
je 0x401ecb
call fcn.00401705
jmp 0x401ecd
xor eax, eax
cmp eax, ebx
jne 0x401ed8
push str.Failed_to_locate_application_resource.
jmp 0x401e9a
push 0x405020
call fcn.00402ae8
test eax, eax
pop ecx
jne 0x401ef9
cmp dword [esp + 0xc], 1
jle 0x40202a
push str.Failed_to_decompress_application_files.
jmp 0x401e9a
push ebx
push str.LMI_Rescue_srv.exe
push dword [0x405020]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x401f16
push str.Failed_to_copy_service_binary.
jmp 0x401e9a
call fcn.0040174a
xor esi, esi
inc esi
push esi
push ebx
push str.eula.txt
push 0x2717
call fcn.00401777
push 0x404135
call fcn.0040198e
add esp, 0x14
cmp dword [esp + 0x14], ebx
je 0x401f4d
push str._nodel
call fcn.0040198e
pop ecx
cmp dword [esp + 0x18], ebx
je 0x401f6f
push str._ghost
call fcn.0040198e
cmp byte [esp + 0x34], bl
pop ecx
je 0x401f6f
lea eax, [esp + 0x30]
push eax
call fcn.0040198e
pop ecx
push ebx
push ebx
push str.params.txt
push 0x2710
call fcn.00401777
call fcn.00401a23
call fcn.00401abc
push esi
push edi
push 0x2712
push 0x2713
call fcn.00401777
push esi
push edi
push 0x2714
push 0x2715
call fcn.00401777
add esp, 0x30
cmp dword [esp + 0x2c], ebx
jne 0x40201e
push dword [0x405020]
lea eax, [esp + 0x1c4]
push eax
lea eax, [esp + 0xc0]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0x1c8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0xd8]
push eax
push ebx
mov dword [esp + 0x98], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40201e
cmp dword [esp + 0xc], esi
jle 0x40202a
push str.Failed_to_start_client_application.
jmp 0x401e9a
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ebx
call fcn.0040174a
cmp dword [esp + 0x20], ebx
je 0x402043
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x1c], ebx
je 0x402057
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0xc], 2
jl 0x401e74
push 0x104
lea eax, [esp + 0xbc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x402087
lea edi, [esp + 0xb8]
call fcn.004011ce
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10