Function at 0x401c1f
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
xor esi, esi
lea eax, [ebp - 0x26b]
inc esi
push ebx
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov byte [ebp - 0x26c], bl
call fcn.00402880
push 0x40
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0x64], ebx
call fcn.00402880
mov dword [ebp - 0x20], ebx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push str._nodel
push dword [ebp + 0x10]
stosd dword es:[edi], eax
call fcn.00401bc8
push 0x40b440
push dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
call fcn.00401bc8
add esp, 0x28
test eax, eax
je 0x401cce
push 5
push str.SET_RESCUEAPP_MAJOR_d_n
call fcn.00402b16
push ebx
push str.SET_RESCUEAPP_MINOR_d_n
call fcn.00402b16
mov esi, 0x10d
push esi
push str.SET_RESCUEAPP_BUILD_d_n
call fcn.00402b16
push esi
push ebx
push 5
push str.SET_RESCUEAPP_VER_d._d._d_n
call fcn.00402b16
add esp, 0x28
xor eax, eax
jmp 0x401f17
push str._params
push dword [ebp + 0x10]
call fcn.00401bc8
test eax, eax
pop ecx
pop ecx
mov esi, str.params.txt
je 0x401d3b
push ebx
push esi
push 0x2710
call fcn.004018f6
add esp, 0xc
cmp dword [ebp - 8], ebx
je 0x401d07
push str.__nodel
push esi
call fcn.00401ab8
pop ecx
pop ecx
call fcn.00401b0f
call fcn.00401b8d
mov edi, str.script
push edi
push 0x2712
push 0x2713
call fcn.004018f6
push edi
push 0x2714
push 0x2715
call fcn.004018f6
add esp, 0x18
jmp 0x401cc7
mov edi, str.script
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x370]
push eax
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
call fcn.00401750
add esp, 0xc
test eax, eax
jne 0x401d8b
cmp dword [ebp - 4], ebx
je 0x401ebf
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x370]
push eax
push ebx
mov dword [ebp - 4], ebx
call fcn.00401750
add esp, 0xc
test eax, eax
je 0x401ebf
mov ax, 0x7d00
mov dword [ebp + 0x10], 1
call fcn.00401872
test eax, eax
jne 0x401db7
push str.Failed_to_locate_application_resource.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004014a3
pop ecx
pop ecx
jmp 0x401ebf
push section..data
push dword [0x40efac]
push dword [0x40efa8]
call fcn.00401525
add esp, 0xc
test eax, eax
jne 0x401de4
cmp dword [ebp - 4], ebx
jne 0x401ebf
push str.Failed_to_decompress_application_files.
jmp 0x401da4
call fcn.004018c9
push ebx
push esi
push 0x2710
call fcn.004018f6
add esp, 0xc
cmp dword [ebp - 8], ebx
je 0x401e0a
push str.__nodel
push esi
call fcn.00401ab8
pop ecx
pop ecx
call fcn.00401b0f
call fcn.00401b8d
push edi
push 0x2712
push 0x2713
call fcn.004018f6
push edi
push 0x2714
push 0x2715
call fcn.004018f6
push dword [section..data]
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x26c]
push str.__s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x28
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x168]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x26c]
push eax
push ebx
mov dword [ebp - 0x64], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x401e92
cmp dword [ebp - 4], ebx
jne 0x401ebf
push str.Failed_to_start_client_application.
jmp 0x401da4
push 0xffffffffffffffff
push dword [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401ebc
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov dword [ebp + 0x10], eax
mov dword [ebp - 4], ebx
call fcn.004018c9
cmp dword [ebp - 0x1c], ebx
je 0x401ed5
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x20], ebx
je 0x401ee6
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 0x10], ebx
je 0x401f07
lea eax, [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x168]
push eax
push ebx
call fcn.00401444
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x401f14
mov dword [ebp - 4], ebx
jmp 0x401d40
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10