Function at 0x402d10
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1604
call fcn.004157b0
mov eax, dword [0x42f114]
xor eax, esp
mov dword [esp + 0x1600], eax
push ebx
push esi
mov esi, ecx
cmp word [esi + 0x28c004], 0
lea ebx, [esi + 0x28c004]
je 0x403318
lea eax, [esi + 0x28c20c]
push eax
call fcn.004024b0
mov dword [esp + 0xc], eax
test eax, eax
je 0x403318
mov ecx, dword [esi + 0x28c828]
push 0
push ebx
call fcn.00411550
test al, al
je 0x403318
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x6d6]
push ecx
mov word [esp + 0x6d8], ax
call fcn.00415440
lea eax, [esi + 0x28c414]
add esp, 0xc
cmp word [eax], 0
lea edx, [esp + 0x6cc]
jne 0x402dab
push edx
mov ecx, esi
call fcn.00402c30
jmp 0x402dbf
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x402db0
lea eax, [esp + 0x6cc]
push eax
push str.wszDirExtract___s__n
call fcn.0040d640
add esp, 8
push 0
lea ecx, [esp + 0x6d0]
push ecx
mov ecx, dword [esi + 0x28c828]
call fcn.00411610
test eax, eax
jne 0x402e02
lea edx, [esp + 0x6cc]
push edx
push str.Failed_to_create___s__n
call fcn.0040d640
add esp, 8
cmp dword [esi + 0x28c000], 0
jne 0x402e18
mov ecx, esi
call fcn.00402680
mov dword [esi + 0x28c000], eax
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [esi + 0x28c20c]
push eax
lea eax, [esp + 0x140c]
push str._sKmSFX.zip
push eax
call edi
lea ecx, [esp + 0x1414]
push 0
push ecx
call fcn.004088f0
lea edx, [esp + 0x80]
push edx
mov ebx, eax
push 0xffffffffffffffff
push ebx
call fcn.00406330
mov eax, dword [esp + 0x8c]
add esp, 0x20
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
jle 0x402fd3
nop
lea eax, [esp + 0x198]
push eax
push ebp
push ebx
call fcn.00406330
push 0x103
lea ecx, [esp + 0x8ed]
push 0
push ecx
mov byte [esp + 0x8f4], 0
call fcn.00415440
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x4ee]
push eax
mov word [esp + 0x4f0], dx
call fcn.00415440
add esp, 0x24
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x19c]
mov byte [esp + eax + 0x8dc], cl
inc eax
test cl, cl
jne 0x402ec0
push 0x104
lea ecx, [esp + 0x4d0]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x8e8]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esp + 0x4cc]
push eax
lea ecx, [esp + 0x6d8]
push ecx
lea edx, [esp + 0xdf8]
push 0x426908
push edx
call edi
lea eax, [esp + 0xe00]
push eax
push ebp
push ebx
call fcn.004089a0
mov edi, eax
push edi
lea ecx, [esp + 0xe10]
push ecx
push str._____s____d__n
call fcn.0040d640
add esp, 0x28
test edi, edi
je 0x402faf
lea edx, [esp + 0x4cc]
push edx
lea eax, [esi + 0x28c20c]
push eax
lea eax, [esp + 0xbf0]
push 0x426908
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esp + 0xbf8]
push ecx
push ebp
push ebx
call fcn.004089a0
mov ecx, dword [esi + 0x28c828]
add esp, 0x1c
push 0
lea edx, [esp + 0xdf4]
push edx
lea eax, [esp + 0xbf0]
push eax
call fcn.00412550
lea ecx, [esp + 0xbe8]
push ecx
mov ecx, dword [esi + 0x28c828]
call fcn.00411a80
lea edx, [esp + 0xdf0]
push edx
jmp 0x402fb7
lea eax, [esp + 0xdf0]
push eax
push 0
push 2
mov ecx, esi
call fcn.004021b0
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
inc ebp
cmp ebp, dword [esp + 0x10]
jl 0x402e70
push ebx
call fcn.004089e0
add esp, 4
xor ecx, ecx
xor eax, eax
mov word [esp + 0x1200], cx
push eax
lea ecx, [esp + 0x2c8]
push ecx
mov ecx, dword [esi + 0x28c824]
push str.LaunchEXE
xor edx, edx
push str.Runtime
mov word [esp + 0x9f0], dx
mov word [esp + 0x1008], ax
call fcn.0040fbf0
test al, al
je 0x4032bb
lea edx, [esp + 0x2c4]
push edx
call fcn.00415788
add esp, 4
test eax, eax
je 0x4032bb
mov ecx, dword [esi + 0x28c824]
push 0
lea eax, [esp + 0x2c8]
push eax
push str.Execute
push str.Runtime
call fcn.0040fbf0
test al, al
je 0x403128
lea eax, [esp + 0x2c4]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403070
sub eax, edx
sar eax, 1
je 0x403128
lea ecx, [esp + 0x2c4]
push ecx
push str.Execute___s__n
call fcn.0040d640
add esp, 8
lea edx, [esp + 0x2c4]
push edx
mov ecx, esi
call fcn.00402830
xor eax, eax
jmp 0x4030b0
movzx ecx, word [esp + eax + 0x2c4]
mov word [esp + eax + 0x9e0], cx
add eax, 2
test cx, cx
jne 0x4030b0
push 0
lea eax, [esp + 0xbec]
push eax
lea ecx, [esp + 0x9e8]
push ecx
mov ecx, dword [esi + 0x28c828]
call fcn.00411d70
cmp word [esp + 0xbe8], 0
je 0x403113
lea edx, [esp + 0x6d4]
push edx
lea eax, [esp + 0xbec]
push eax
lea ecx, [esp + 0x9e8]
push ecx
mov ecx, dword [esi + 0x28c828]
call fcn.00411950
lea edx, [esp + 0x9e0]
push edx
push str._After_replace__s__n
call fcn.0040d640
add esp, 8
mov ecx, dword [esi + 0x28c824]
push 0
lea eax, [esp + 0x2c8]
push eax
push str.CmdLine
push str.Runtime
call fcn.0040fbf0
test al, al
je 0x4031a8
lea eax, [esp + 0x2c4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403155
sub eax, edx
sar eax, 1
je 0x4031a8
lea ecx, [esp + 0x2c4]
push ecx
push str.CmdLine_____s__n
call fcn.0040d640
add esp, 8
lea edx, [esp + 0x2c4]
push edx
mov ecx, esi
call fcn.00402830
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x2c4]
mov word [esp + eax + 0xff8], cx
add eax, 2
test cx, cx
jne 0x403190
lea eax, [esp + 0xff8]
push eax
lea ecx, [esp + 0x9e4]
push ecx
lea edx, [esp + 0x1208]
push 0x4263e4
push edx
call edi
xor eax, eax
push 0x44
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
push eax
call fcn.00415440
lea edx, [esp + 0x9fc]
push edx
mov ecx, 1
push str.tszExecute_____s__n
mov dword [esp + 0x4c], 0x44
mov dword [esp + 0x78], 1
mov dword [esp + 0x54], str.winsta0default
mov word [esp + 0x7c], cx
call fcn.0040d640
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x4fa]
push ecx
mov word [esp + 0x4fc], ax
call fcn.00415440
mov ecx, dword [esi + 0x28c828]
add esp, 0x30
push 0
lea edx, [esp + 0x4d0]
push edx
lea eax, [esp + 0x9e8]
push eax
call fcn.00411d70
lea ecx, [esp + 0x4cc]
push ecx
push str.wszPath_____s__n
call fcn.0040d640
add esp, 8
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4d4]
push ecx
push 0
push 0
push 0
push 0
push 0
lea edx, [esp + 0x1220]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4032b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateProcess_failure____ld_n
call fcn.0040d550
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esi + 0x28c828]
lea eax, [esi + 0x28c004]
push eax
call fcn.00411a80
mov ebp, dword [esp + 0x14]
xor eax, eax
test ebp, ebp
jle 0x403316
jmp 0x4032e0
lea ebx, [eax + 1]
push ebx
lea eax, [esi + 0x28c20c]
push eax
lea eax, [esp + 0x2cc]
push str._sKmSFX.zip
push eax
call edi
add esp, 0x10
lea ecx, [esp + 0x2c4]
push ecx
mov ecx, dword [esi + 0x28c828]
call fcn.00411a80
mov eax, ebx
cmp eax, ebp
jl 0x4032e0
pop edi
pop ebp
mov ecx, dword [esp + 0x1608]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004153dc
add esp, 0x1604
ret