Function at 0x40aa13
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x443e53
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9a4
mov dword [ebp - 0x994], ecx
mov ecx, dword [ebp - 0x994]
call fcn.0040b900
and eax, 0xff
test eax, eax
je 0x40aa58
push str.__ChangeWinFirewallException
call fcn.004288c1
add esp, 4
call fcn.004210d1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x32
jbe 0x40ad29
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x20]
call fcn.004044a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x96c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004044a0
mov byte [ebp - 4], 1
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040af16
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040bd90
cmp dword [ebp - 0x10], 0x50
jae 0x40abc1
mov edx, dword [ebp + 8]
and edx, 0xff
push edx
push str.ChangeWinFirewallException_is_XP_compatible__set_to__d_____
call fcn.004288c1
add esp, 8
lea eax, [ebp - 0x20]
push eax
push str.::Enabled:Instant_Support_Desk_Service
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x97c]
push edx
call fcn.0040cb10
add esp, 0xc
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x99c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x99c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040cb90
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x97c]
call fcn.004044d0
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x40ab45
lea ecx, [ebp - 0x40]
call fcn.00404530
mov dword [ebp - 0x9a0], eax
jmp 0x40ab4f
mov dword [ebp - 0x9a0], 0
push 1
mov ecx, dword [ebp - 0x9a0]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404530
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040ad39
mov edx, dword [ebp + 8]
and edx, 0xff
test edx, edx
je 0x40ab89
lea ecx, [ebp - 0x40]
call fcn.00404530
mov dword [ebp - 0x9a4], eax
jmp 0x40ab93
mov dword [ebp - 0x9a4], 0
push 0
mov eax, dword [ebp - 0x9a4]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404530
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040ad39
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004044d0
jmp 0x40acf7
mov ecx, dword [ebp + 8]
and ecx, 0xff
push ecx
push str.ChangeWinFirewallException_is_Vista_compatible__set_to__d_____
call fcn.004288c1
add esp, 8
push 0x104
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40acf7
lea eax, [ebp - 0x990]
push eax
push str._netsh.exe
lea ecx, [ebp - 0x98c]
call fcn.00408de0
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp - 0x9ac], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x9ac]
push edx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x164]
push ecx
call fcn.0040cc10
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x98c]
call fcn.004044d0
lea edx, [ebp - 0x20]
push edx
push str.Instant_Support_Desk_Service
lea eax, [ebp - 0x154]
push eax
call fcn.0040cc10
add esp, 0xc
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x40ac80
mov dword [ebp - 0x9b0], str.advfirewall_firewall_add_rule_name__s__program__s__dirin_actionallow
jmp 0x40ac8a
mov dword [ebp - 0x9b0], str.advfirewall_firewall_delete_rule_name__s__program__s_
lea ecx, [ebp - 0x30]
call fcn.00404530
push eax
lea ecx, [ebp - 0x154]
call fcn.00404530
push eax
mov edx, dword [ebp - 0x9b0]
push edx
lea eax, [ebp - 0x964]
push eax
call fcn.0042a288
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x964]
push ecx
lea ecx, [ebp - 0x164]
call fcn.00404530
push eax
push 0x458eb8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x154]
call fcn.004044d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x164]
call fcn.004044d0
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x40ad0e
mov eax, dword [ebp - 0x994]
mov byte [eax + 5], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004044d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004044d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8