Function at 0x4014b0
Capabilities:
Create process on windows
Create process suspended
Get common file path
Set current directory

Disassembly:
sub esp, 0x78
push esi
mov esi, dword [esp + 0x80]
push 1
push 0x104
mov dword [0x40fa98], esi
call fcn.00405b57
push 1
push 0x104
mov dword [0x40fa94], eax
call fcn.00405b57
push 1
push 0x104
mov dword [0x40fa90], eax
call fcn.00405b57
push 1
push 0x2000
mov dword [0x40fa80], eax
call fcn.00405b57
mov ecx, dword [0x40fa94]
add esp, 0x20
test ecx, ecx
mov dword [0x40fa84], eax
je 0x4019e8
mov edx, dword [0x40fa90]
test edx, edx
je 0x4019e8
mov edx, dword [0x40fa80]
test edx, edx
je 0x4019e8
test eax, eax
je 0x4019e8
push ebp
push edi
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call fcn.00401310
mov edi, eax
test edi, edi
jne 0x40191b
push ebx
call fcn.00401a10
test eax, eax
mov dword [esp + 0x10], eax
jne 0x40176c
mov eax, dword [0x40fa90]
mov ecx, dword [0x40fa84]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push 0x40c064
push ecx
call ebx
mov edx, dword [esp + 0xa0]
add esp, 0xc
test edx, edx
je 0x4015d9
cmp byte [edx], 0
je 0x4015d9
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov ax, word [0x40c060]
or ecx, 0xffffffff
mov word [edi - 1], ax
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x40fa84]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x40c058]
dec edi
mov dword [edi], eax
mov cx, word [0x40c05c]
xor eax, eax
mov word [edi + 4], cx
mov dl, byte [0x40c05e]
or ecx, 0xffffffff
mov byte [edi + 6], dl
mov edi, dword [0x40fa94]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, dword [0x40fa84]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x40fa84]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ax, word [0x40c054]
mov word [edi - 1], ax
mov ecx, dword [0x40fa8c]
mov edx, dword [0x40fa84]
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
push 0x40c04c
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ecx, edx
push ecx
call ebx
xor edx, edx
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x50]
mov dword [esp + 0x24], edx
add esp, 0xc
rep stosd dword es:[edi], eax
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x18]
lea ecx, [esp + 0x44]
mov dword [esp + 0x20], edx
push eax
push ecx
push edx
push edx
push 0x20
push 1
push edx
mov dword [esp + 0x40], edx
push edx
mov edx, dword [0x40fa84]
push edx
push 0
mov dword [esp + 0x6c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40176c
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebp, dword [sym.imp.USER32.dll_GetMessageA]
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edi, edi
test edi, edi
jne 0x401724
push edi
push edi
push edi
lea eax, [esp + 0x34]
push edi
push eax
call esi
test eax, eax
je 0x401724
push 0
push 0
lea ecx, [esp + 0x30]
push 0
push ecx
call ebp
test eax, eax
je 0x40170c
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x401711
mov edi, 1
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
call esi
test eax, eax
jne 0x4016e3
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401758
push 0xff
push 0x3e8
push 0
push 0
push 0
call ebx
cmp dword [esp + 0x14], 0x103
je 0x4016d0
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [0x40fa94]
test eax, eax
je 0x4017a9
push 0x5c
push eax
call fcn.00405b30
add esp, 8
test eax, eax
je 0x4017a9
mov esi, dword [0x40fa94]
mov ecx, eax
sub ecx, esi
cmp ecx, 3
jae 0x401799
mov byte [eax + 1], 0
jmp 0x40179c
mov byte [eax], 0
mov edx, dword [0x40fa94]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ebx, dword [0x40fa88]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x401868
cmp byte [ebx], 0
je 0x40185f
xor esi, esi
push ebx
call fcn.00405c08
add esp, 4
test eax, eax
je 0x4017ed
cmp dword [0x40faa4], 2
je 0x4017ed
push 0x3e8
call ebp
inc esi
cmp esi, 0xa
jl 0x4017c8
jmp 0x40183d
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00405b57
mov esi, eax
add esp, 8
test esi, esi
je 0x40183d
mov edx, esi
mov eax, ebx
sub edx, ebx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40180f
push 0x5c
push esi
call fcn.00405b30
add esp, 8
test eax, eax
je 0x401834
push esi
mov byte [eax], 0
call fcn.00405c32
add esp, 4
push esi
call fcn.004059f3
add esp, 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebx + ecx + 1]
lea ebx, [ebx + ecx + 1]
test al, al
jne 0x4017c6
mov ebx, dword [0x40fa88]
push ebx
call fcn.004059f3
add esp, 4
push 1
push 0x104
call fcn.00405b57
mov esi, eax
add esp, 8
test esi, esi
je 0x4018df
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4018d6
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x40fa80]
not ecx
dec ecx
push ecx
push eax
push esi
call fcn.0040a1a0
add esp, 0xc
test eax, eax
jne 0x4018d6
mov edx, dword [0x40fa80]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, esi
mov ebx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ebx, ecx
jbe 0x4018d6
push edx
call fcn.00401370
add esp, 4
push esi
call fcn.004059f3
add esp, 4
xor esi, esi
pop ebx
mov ecx, dword [0x40fa80]
push ecx
call fcn.00401040
mov edx, dword [0x40fa80]
push edx
call fcn.00405c32
add esp, 8
test eax, eax
je 0x401917
cmp dword [0x40faa4], 2
je 0x401917
push 0x3e8
call ebp
inc esi
cmp esi, 0xa
jl 0x4018e2
mov edi, dword [esp + 0xc]
cmp edi, 0x40000000
jl case.default.0x40192e
lea eax, [edi - 0x40000001]
cmp eax, 3
ja case.default.0x40192e
jmp dword [eax*4 + 0x4019f4]
mov dword [esp + 0xc], 2
mov edi, dword [esp + 0xc]
jmp 0x401968
mov dword [esp + 0xc], 6
mov edi, dword [esp + 0xc]
jmp 0x401968
mov dword [esp + 0xc], 7
mov edi, dword [esp + 0xc]
jmp 0x401968
test edi, edi
jle 0x4019ab
cmp edi, 8
jge 0x4019ab
push 1
push 0x104
call fcn.00405b57
mov ecx, dword [esp + 0x90]
add esp, 8
mov esi, eax
movsx eax, byte [edi + 0x40c030]
push 0x104
push esi
push eax
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
push 0
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push esi
call fcn.004059f3
add esp, 4
mov edx, dword [0x40fa84]
push edx
call fcn.004059f3
mov eax, dword [0x40fa80]
push eax
call fcn.004059f3
mov ecx, dword [0x40fa90]
push ecx
call fcn.004059f3
mov edx, dword [0x40fa94]
push edx
call fcn.004059f3
add esp, 0x10
xor eax, eax
pop edi
pop ebp
pop esi
add esp, 0x78
ret 0x10
or eax, 0xffffffff
pop esi
add esp, 0x78
ret 0x10