Function at 0x60d30c
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x61f8d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x129c
call fcn.005acc70
push ebx
push esi
push edi
push 0x800
lea eax, [esp + 0xaac]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
jne 0x60d36e
xor al, al
mov ecx, dword [esp + 0x12ac]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x78]
call fcn.004018f5
mov esi, eax
mov dword [esp + 0x12b4], ebx
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x20]
call fcn.004018f5
mov edi, eax
mov byte [esp + 0x12b4], 1
push 0x67b818
call fcn.005a659d
pop ecx
push eax
mov eax, esi
call fcn.00401c08
push eax
push ebx
lea eax, [esp + 0x60]
push eax
mov ecx, edi
call fcn.00401926
mov byte [esp + 0x12b4], 3
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [esp + 0x24]
call fcn.00401c85
mov byte [esp + 0x12b4], 4
push ebx
push esi
lea ecx, [esp + 0x7c]
call fcn.00401c85
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x60d3fc
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
call fcn.00413fc0
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.005038b0
test al, al
jne 0x60d42f
or dword [esp + 0x12b4], 0xffffffff
push ebx
push esi
lea ecx, [esp + 0x60]
call fcn.00401c85
jmp 0x60d357
call fcn.0060c5a6
test eax, eax
je 0x60d417
push 2
mov esi, 0x686360
push esi
call fcn.005a68e4
pop ecx
pop ecx
test eax, eax
je 0x60d452
push esi
call fcn.005a656b
pop ecx
mov esi, 0x104
push esi
lea eax, [esp + 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea eax, [esp + 0x298]
test eax, eax
je 0x60d4e0
lea eax, [esp + 0x90]
test eax, eax
je 0x60d4e0
lea edi, [esp + 0x298]
call fcn.004137d0
cmp eax, ebx
jne 0x60d4b0
xor eax, eax
movzx ecx, word [esp + eax + 0x298]
mov word [esp + eax + 0x90], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x60d4dc
cmp esi, ebx
jne 0x60d48f
jmp 0x60d4d2
add eax, 2
lea edx, [esp + 0x90]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x60d4dc
cmp esi, ebx
jne 0x60d4bc
xor eax, eax
mov word [esp + 0x296], ax
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x4a0]
lea edx, [esp + 0x90]
call fcn.004131c0
mov eax, esi
push eax
push 0x686360
push 0x68636c
lea eax, [esp + 0x6b4]
push 0x200
push eax
call fcn.00413760
lea eax, [esp + 0x6bc]
add esp, 0x14
push eax
call fcn.005d42d0
pop ecx
lea esi, [esp + 0x38]
call fcn.00414eb0
mov byte [esp + 0x12b4], 5
mov eax, esi
push eax
lea ecx, [edi + 0xa4]
mov edx, edi
call fcn.0060ca78
test al, al
jne 0x60d5de
push 0x686378
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 6
call fcn.00415270
push eax
lea ecx, [esp + 0x10]
call fcn.00401327
mov byte [esp + 0x12b4], 7
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [esp + 0x12b4], 6
lea ecx, [esp + 0xc]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0x10]
call fcn.00401017
call fcn.00401732
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00414ec0
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
jmp 0x60d421
lea esi, [esp + 0x38]
call fcn.00414f40
lea eax, [edi + 0x168]
cmp dword [eax + 0x18], 8
jb 0x60d5f8
mov eax, dword [eax + 4]
jmp 0x60d5fb
add eax, 4
push eax
push ecx
call fcn.0040171c
pop ecx
push eax
lea ecx, [esp + 0x40]
call fcn.0060db3d
test al, al
jne 0x60d680
push 0x686378
lea ecx, [esp + 0x10]
call fcn.00401327
mov byte [esp + 0x12b4], 8
lea esi, [esp + 0x38]
call fcn.00415270
push eax
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 9
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [esp + 0x12b4], 8
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
jmp 0x60d5b2
call fcn.0040171c
mov ecx, eax
call fcn.0060da71
mov dword [esp + 0x10], 1
call fcn.00414bc0
test eax, eax
jne 0x60d822
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push eax
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00413c40
mov byte [esp + 0x12b4], 0xa
call fcn.00414e10
test eax, eax
jne 0x60d77e
push str.TORRENT_PATCH
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [esp + 0x10]
call fcn.00401327
mov byte [esp + 0x12b4], 0xb
push str.NOT_SUPPORT_UAC
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 0xc
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [esp + 0x12b4], 0xb
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 0xa
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00401732
mov byte [esp + 0x12b4], 5
lea esi, [esp + 0x1c]
call fcn.00413bf0
jmp 0x60d5bc
cmp dword [esp + 0x24], ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [eax + ecx*2]
jle 0x60d797
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
jmp 0x60d799
xor ecx, ecx
push 1
push ebx
push eax
push ecx
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x60d768
push str.TORRENT_PATCH
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [esp + 0x10]
call fcn.00401327
mov byte [esp + 0x12b4], 0xd
push str.LAUNCH_ERROR_WITH_ADMIN_PRIVILEGES
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 0xe
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [esp + 0x12b4], 0xd
jmp 0x60d749
push 0x18
call fcn.005a6b1c
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0xf
cmp eax, ebx
je 0x60d843
mov ecx, eax
call fcn.00401593
jmp 0x60d845
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.00533260
pop ecx
push 0x18
call fcn.005a6b1c
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0x10
cmp eax, ebx
je 0x60d875
mov ecx, eax
call fcn.004014f3
jmp 0x60d877
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.00533260
pop ecx
lea esi, [esp + 0x38]
call fcn.00414f40
mov eax, esi
push eax
push str.LauncherSkin
call fcn.0040171c
mov esi, eax
call fcn.0060d9f6
push eax
call fcn.006093b1
pop ecx
pop ecx
test eax, eax
jne 0x60d95a
push 0x686378
lea ecx, [esp + 0x10]
call fcn.00401327
mov byte [esp + 0x12b4], 0x11
lea esi, [esp + 0x38]
call fcn.00415270
push eax
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 0x12
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0052fac0
add esp, 0x18
mov byte [esp + 0x12b4], 0x11
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.00401732
mov byte [esp + 0x17], bl
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.00414ec0
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x60]
call fcn.00401c85
mov al, byte [esp + 0x17]
jmp 0x60d359
push 0x1a8
call fcn.005a6b1c
pop ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0x12b4], 0x13
cmp eax, ebx
je 0x60d9b4
push str.TORRENT_PATCH
push ecx
call fcn.0040171c
pop ecx
mov esi, eax
call fcn.0060d9f6
push eax
lea ecx, [esp + 0x14]
call fcn.00401327
mov byte [esp + 0x12b4], 0x14
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.00600f87
mov esi, eax
jmp 0x60d9b6
xor esi, esi
mov dword [esp + 0x12b4], 5
test byte [esp + 0x18], 1
je 0x60d9d6
and dword [esp + 0x18], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.00401017
mov ecx, esi
call fcn.00600ef8
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x98]
mov dword [edi + 0x44], esi
mov byte [esp + 0x17], 1
jmp 0x60d92b