Function at 0x40d43f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x2a0
mov esi, esp
mov eax, dword [0x52efc0]
lea edi, [esi + 0x90]
xor eax, ebp
mov dword [esi + 0x298], eax
mov eax, 0x4e3743
mov dword [edi], eax
push eax
call fcn.004ceea0
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [edi + 4], eax
lea ebx, [esi + 0x7c]
push edi
push ebx
call fcn.0042cef0
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x40d491
mov eax, dword [esi + 0x80]
xor ebx, ebx
test eax, eax
jne 0x40d6d1
lea ecx, [esi + 0x7c]
push ebx
push 0x4e2bc0
push 0xffffffffffffffff
push ebx
call fcn.0042815a
test eax, eax
jne 0x40d6d1
mov ecx, dword [ebp + 8]
push str.secorepending
call fcn.0042ce80
xor ebx, ebx
test al, al
jne 0x40d6d1
push 0x208
push ebx
push edi
call fcn.004b81d0
add esp, 0xc
push 0x104
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4e2d9c
push edi
call fcn.004b896e
add esp, 8
test eax, eax
je 0x40d5d0
push eax
call fcn.004cf81e
add esp, 4
cmp eax, 0xd
jne 0x40d5d0
xor edi, edi
inc edi
push edi
push 0x4e2db8
push 0x4e2dce
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, edi
jne 0x40d6cf
mov edi, esp
push eax
sub esp, 0xc
mov ebx, esp
lea ecx, [ebx + 4]
push str.installer_setup.exe
call fcn.00402d2c
lea eax, [esi + 0x70]
mov dword [ebx], eax
call fcn.0040d30a
add esp, 0x10
mov esp, edi
xor ebx, ebx
mov edi, esi
lea eax, [esi + 0x70]
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x68], ebx
push eax
push 0x4e2c6c
push edi
call fcn.0040d191
add esp, 0xc
mov ecx, edi
push 0x4e2c66
call fcn.004288d4
mov edx, dword [eax + 8]
lea ecx, [esi + 0x18]
mov dword [ecx + 8], edx
movsd xmm0, qword [eax]
movsd qword [ecx], xmm0
mov dword [eax], ebx
mov dword [eax + 8], ebx
mov dword [eax + 4], ebx
push str.__secore_restore___360se_pid360secore2___silent_install2_1_1
call fcn.004288d4
mov ecx, dword [eax + 4]
mov edx, dword [eax + 7]
mov edi, dword [eax]
mov dword [esi + 0x8b], edx
mov dword [esi + 0x88], ecx
mov dl, byte [eax + 0xb]
mov dword [eax + 4], ebx
mov dword [eax], ebx
mov dword [eax + 8], ebx
cmp byte [esi + 0x6b], 0
js 0x40d5d7
mov word [esi + 0x60], 0
mov byte [esi + 0x6b], 0
jmp 0x40d602
xor ebx, ebx
jmp 0x40d6d1
mov eax, dword [esi + 0x60]
mov word [eax], 0
mov dword [esi + 0x64], 0
cmp byte [esi + 0x6b], 0
jns 0x40d602
push dword [esi + 0x60]
mov ebx, edx
call fcn.004aeac6
mov edx, ebx
add esp, 4
mov dword [esi + 0x68], 0
mov eax, dword [esi + 0x88]
mov dword [esi + 0x60], edi
mov ecx, dword [esi + 0x8b]
mov dword [esi + 0x64], eax
xor eax, eax
cmp byte [esi + 0x23], 0
mov dword [esi + 0x67], ecx
mov byte [esi + 0x6b], dl
mov dword [esi + 0x88], eax
mov dword [esi + 0x8b], eax
jns 0x40d639
push dword [esi + 0x18]
call fcn.004aeac6
add esp, 4
cmp byte [esi + 0xb], 0
jns 0x40d649
push dword [esi]
call fcn.004aeac6
add esp, 4
xor ebx, ebx
xorps xmm0, xmm0
cmp byte [esi + 0x6b], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x18], 0x44
movaps xmmword [esi], xmm0
jns 0x40d692
mov eax, dword [esi + 0x60]
jmp 0x40d695
lea eax, [esi + 0x60]
mov ecx, esi
push ecx
lea ecx, [esi + 0x18]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp byte [esi + 0x6b], bl
jns 0x40d6be
push dword [esi + 0x60]
call fcn.004aeac6
add esp, 4
cmp byte [esi + 0x7b], 0
jns 0x40d6cf
push dword [esi + 0x70]
call fcn.004aeac6
add esp, 4
mov bl, 1
cmp byte [esi + 0x87], 0
jns 0x40d6e5
push dword [esi + 0x7c]
call fcn.004aeac6
add esp, 4
mov ecx, dword [esi + 0x298]
xor ecx, ebp
call fcn.004aeb01
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret