Function at 0x401a70
Capabilities:
Access peb ldr_data
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x412af8
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x28
push edi
push eax
mov edi, 1
call fcn.00401e70
add esp, 4
test al, al
jne 0x401ab1
xor eax, eax
pop edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
mov eax, dword [0x4174c8]
push esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov dword [esp + 0x40], eax
push str.install.exe__c_USB___d_
lea ecx, [esp + 0x30]
mov byte [esp + 0x3c], 0xb
call fcn.0040d0f7
mov ecx, dword [esp + 0x44]
push ecx
lea ecx, [esp + 0x30]
call fcn.0040d133
push 0x4174a4
lea ecx, [esp + 0x30]
call fcn.0040d0f7
push str.install.exe__c_USB___d_
lea ecx, [esp + 0x2c]
call fcn.0040d0f7
mov esi, dword [esp + 0x48]
lea ecx, [esp + 0x28]
push esi
call fcn.0040d133
push 0x4174a4
lea ecx, [esp + 0x2c]
call fcn.0040d0f7
push str.install.exe__c_System___d_
lea ecx, [esp + 0x28]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x28]
call fcn.0040d133
push str._Class_Registry_Bus
lea ecx, [esp + 0x28]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x28]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x24]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x24]
call fcn.0040d133
push str.__COM1_
lea ecx, [esp + 0x24]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x24]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x20]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x20]
call fcn.0040d133
push str.__COM2_
lea ecx, [esp + 0x20]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x20]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x1c]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x1c]
call fcn.0040d133
push str.__COM3_
lea ecx, [esp + 0x1c]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x1c]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x18]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x18]
call fcn.0040d133
push str.__COM1_
lea ecx, [esp + 0x18]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x18]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x14]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x14]
call fcn.0040d133
push str.__COM5_
lea ecx, [esp + 0x14]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x14]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x10]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x10]
call fcn.0040d133
push str.__COM6_
lea ecx, [esp + 0x10]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x10]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0xc]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0xc]
call fcn.0040d133
push str.__COM7_
lea ecx, [esp + 0xc]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0xc]
call fcn.0040d0f7
push str.install.exe__c_Ports___d_
lea ecx, [esp + 0x44]
call fcn.0040d0f7
push esi
lea ecx, [esp + 0x44]
call fcn.0040d133
push str.__COM8_
lea ecx, [esp + 0x44]
call fcn.0040d0f7
push 0x4174a4
lea ecx, [esp + 0x44]
call fcn.0040d0f7
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push 0
push edx
call esi
test eax, eax
je 0x401db1
mov eax, dword [esp + 0x28]
push 0
push eax
call esi
test eax, eax
je 0x401db1
mov ecx, dword [esp + 0x24]
push 0
push ecx
call esi
test eax, eax
je 0x401db1
mov edx, dword [esp + 0x20]
push 0
push edx
call esi
test eax, eax
je 0x401db1
mov eax, dword [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x401db1
mov ecx, dword [esp + 0x18]
push 0
push ecx
call esi
test eax, eax
je 0x401db1
mov edx, dword [esp + 0x14]
push 0
push edx
call esi
test eax, eax
je 0x401db1
mov eax, dword [esp + 0x10]
push 0
push eax
call esi
test eax, eax
je 0x401db1
mov ecx, dword [esp + 0xc]
push 0
push ecx
call esi
test eax, eax
je 0x401db1
mov edx, dword [esp + 8]
push 0
push edx
call esi
test eax, eax
je 0x401db1
mov eax, dword [esp + 0x40]
push 0
push eax
call esi
test eax, eax
jne 0x401db3
xor edi, edi
lea ecx, [esp + 0x40]
mov byte [esp + 0x38], 0xa
call fcn.0040cf3a
lea ecx, [esp + 8]
mov byte [esp + 0x38], 9
call fcn.0040cf3a
lea ecx, [esp + 0xc]
mov byte [esp + 0x38], 8
call fcn.0040cf3a
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 7
call fcn.0040cf3a
lea ecx, [esp + 0x14]
mov byte [esp + 0x38], 6
call fcn.0040cf3a
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 5
call fcn.0040cf3a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x38], 4
call fcn.0040cf3a
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 3
call fcn.0040cf3a
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 2
call fcn.0040cf3a
lea ecx, [esp + 0x28]
mov byte [esp + 0x38], 1
call fcn.0040cf3a
lea ecx, [esp + 0x2c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0040cf3a
mov ecx, dword [esp + 0x30]
mov eax, edi
pop esi
pop edi
mov dword fs:[0], ecx
add esp, 0x34
ret