Function at 0x40142d
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x63171a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x129c
call fcn.005bc5e0
push ebx
push esi
push edi
push 0x800
lea eax, [esp + 0xaac]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40148f
xor al, al
mov ecx, dword [esp + 0x12ac]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x78]
call fcn.004030bf
mov esi, eax
mov dword [esp + 0x12b4], ebx
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x20]
call fcn.004030bf
mov edi, eax
mov byte [esp + 0x12b4], 1
push 0x67877c
call fcn.005b5201
pop ecx
push eax
mov eax, esi
call fcn.00402101
push eax
push ebx
lea eax, [esp + 0x60]
push eax
mov ecx, edi
call fcn.00401fff
mov byte [esp + 0x12b4], 3
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x24]
call fcn.0040337f
mov byte [esp + 0x12b4], 4
push ebx
push esi
lea ecx, [esp + 0x7c]
call fcn.0040337f
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x40151d
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.00420a30
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00514030
test al, al
jne 0x401550
or dword [esp + 0x12b4], 0xffffffff
push ebx
push esi
lea ecx, [esp + 0x60]
call fcn.0040337f
jmp 0x401478
call fcn.0040105e
test eax, eax
je 0x401538
push 2
mov esi, 0x68326c
push esi
call fcn.005b52a4
pop ecx
pop ecx
test eax, eax
je 0x401573
push esi
call fcn.005b52bc
pop ecx
mov esi, 0x104
push esi
lea eax, [esp + 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x298]
test eax, eax
je 0x401601
lea eax, [esp + 0x90]
test eax, eax
je 0x401601
lea edi, [esp + 0x298]
call fcn.00421220
cmp eax, ebx
jne 0x4015d1
xor eax, eax
movzx ecx, word [esp + eax + 0x298]
mov word [esp + eax + 0x90], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x4015fd
cmp esi, ebx
jne 0x4015b0
jmp 0x4015f3
add eax, 2
lea edx, [esp + 0x90]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x4015fd
cmp esi, ebx
jne 0x4015dd
xor eax, eax
mov word [esp + 0x296], ax
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x4a0]
lea edx, [esp + 0x90]
call fcn.00420c10
mov eax, esi
push eax
push 0x68326c
push 0x683278
lea eax, [esp + 0x6b4]
push 0x200
push eax
call fcn.004211b0
lea eax, [esp + 0x6bc]
add esp, 0x14
push eax
call fcn.005e3b50
pop ecx
lea esi, [esp + 0x38]
call fcn.00422430
mov byte [esp + 0x12b4], 5
mov eax, esi
push eax
lea ecx, [edi + 0xa4]
mov edx, edi
call fcn.00401cb0
test al, al
jne 0x4016ff
push 0x683284
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 6
call fcn.004227f0
push eax
lea ecx, [esp + 0x10]
call fcn.004030fb
mov byte [esp + 0x12b4], 7
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0053ad70
add esp, 0x18
mov byte [esp + 0x12b4], 6
lea ecx, [esp + 0xc]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0x10]
call fcn.00401017
call fcn.00402fb5
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00422440
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
jmp 0x401542
lea esi, [esp + 0x38]
call fcn.004224c0
lea eax, [edi + 0xf8]
cmp dword [eax + 0x18], 8
jb 0x401719
mov eax, dword [eax + 4]
jmp 0x40171c
add eax, 4
push eax
push ecx
call fcn.00402e56
pop ecx
push eax
lea ecx, [esp + 0x40]
call fcn.0040510a
test al, al
jne 0x4017a1
push 0x683284
lea ecx, [esp + 0x10]
call fcn.004030fb
mov byte [esp + 0x12b4], 8
lea esi, [esp + 0x38]
call fcn.004227f0
push eax
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 9
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0053ad70
add esp, 0x18
mov byte [esp + 0x12b4], 8
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
jmp 0x4016d3
call fcn.00402e56
mov ecx, eax
call fcn.004053dd
mov dword [esp + 0x10], 1
call fcn.00422b80
test eax, eax
jne 0x401943
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push eax
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00421690
mov byte [esp + 0x12b4], 0xa
call fcn.00422dd0
test eax, eax
jne 0x40189f
push str.TORRENT_PATCH
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x10]
call fcn.004030fb
mov byte [esp + 0x12b4], 0xb
push str.NOT_SUPPORT_UAC
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 0xc
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0053ad70
add esp, 0x18
mov byte [esp + 0x12b4], 0xb
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 0xa
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00402fb5
mov byte [esp + 0x12b4], 5
lea esi, [esp + 0x1c]
call fcn.00421640
jmp 0x4016dd
cmp dword [esp + 0x24], ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [eax + ecx*2]
jle 0x4018b8
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
jmp 0x4018ba
xor ecx, ecx
push 1
push ebx
push eax
push ecx
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x401889
push str.TORRENT_PATCH
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x10]
call fcn.004030fb
mov byte [esp + 0x12b4], 0xd
push str.LAUNCH_ERROR_WITH_ADMIN_PRIVILEGES
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 0xe
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0053ad70
add esp, 0x18
mov byte [esp + 0x12b4], 0xd
jmp 0x40186a
push 0x18
call fcn.005b4e59
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0xf
cmp eax, ebx
je 0x401964
mov ecx, eax
call fcn.00402661
jmp 0x401966
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0053d490
pop ecx
push 0x18
call fcn.005b4e59
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0x10
cmp eax, ebx
je 0x401996
mov ecx, eax
call fcn.004024bb
jmp 0x401998
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0053d490
pop ecx
lea esi, [esp + 0x38]
call fcn.004224c0
mov eax, esi
push eax
push str.LauncherSkin
call fcn.00402e56
mov esi, eax
call fcn.00405362
push eax
call fcn.0040d278
pop ecx
pop ecx
test eax, eax
jne 0x401a7b
push 0x683284
lea ecx, [esp + 0x10]
call fcn.004030fb
mov byte [esp + 0x12b4], 0x11
lea esi, [esp + 0x38]
call fcn.004227f0
push eax
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 0x12
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0053ad70
add esp, 0x18
mov byte [esp + 0x12b4], 0x11
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00402fb5
mov byte [esp + 0x17], bl
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00422440
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x60]
call fcn.0040337f
mov al, byte [esp + 0x17]
jmp 0x40147a
push 0x1a8
call fcn.005b4e59
pop ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0x12b4], 0x13
cmp eax, ebx
je 0x401ad5
push str.TORRENT_PATCH
push ecx
call fcn.00402e56
pop ecx
mov esi, eax
call fcn.00405362
push eax
lea ecx, [esp + 0x14]
call fcn.004030fb
mov byte [esp + 0x12b4], 0x14
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.0041ccf6
mov esi, eax
jmp 0x401ad7
xor esi, esi
mov dword [esp + 0x12b4], 5
test byte [esp + 0x18], 1
je 0x401af7
and dword [esp + 0x18], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.00401017
mov ecx, esi
call fcn.0041d211
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x98]
mov dword [edi + 0x44], esi
mov byte [esp + 0x17], 1
jmp 0x401a4c