Function at 0x40aa33
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x440ca3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x9a4
mov dword [ebp - 0x994], ecx
mov ecx, dword [ebp - 0x994]
call fcn.0040b8b0
and eax, 0xff
test eax, eax
je 0x40aa78
push str.__ChangeWinFirewallException
call fcn.0042571d
add esp, 4
call fcn.0041e421
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x32
jbe 0x40ad49
lea eax, [ebp - 0x968]
push eax
lea ecx, [ebp - 0x20]
call fcn.004044b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x96c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.004044b0
mov byte [ebp - 4], 1
push 0
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040af36
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x30]
call fcn.0040bbf0
cmp dword [ebp - 0x10], 0x50
jae 0x40abe1
mov edx, dword [ebp + 8]
and edx, 0xff
push edx
push str.ChangeWinFirewallException_is_XP_compatible__set_to__d_____
call fcn.0042571d
add esp, 8
lea eax, [ebp - 0x20]
push eax
push str.::Enabled:Instant_Support_Desk_Service
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x97c]
push edx
call fcn.0040c970
add esp, 0xc
mov dword [ebp - 0x998], eax
mov eax, dword [ebp - 0x998]
mov dword [ebp - 0x99c], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x99c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.0040c9f0
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x97c]
call fcn.004044e0
mov eax, dword [ebp + 8]
and eax, 0xff
test eax, eax
je 0x40ab65
lea ecx, [ebp - 0x40]
call fcn.00404540
mov dword [ebp - 0x9a0], eax
jmp 0x40ab6f
mov dword [ebp - 0x9a0], 0
push 1
mov ecx, dword [ebp - 0x9a0]
push ecx
lea ecx, [ebp - 0x30]
call fcn.00404540
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040ad59
mov edx, dword [ebp + 8]
and edx, 0xff
test edx, edx
je 0x40aba9
lea ecx, [ebp - 0x40]
call fcn.00404540
mov dword [ebp - 0x9a4], eax
jmp 0x40abb3
mov dword [ebp - 0x9a4], 0
push 0
mov eax, dword [ebp - 0x9a4]
push eax
lea ecx, [ebp - 0x30]
call fcn.00404540
push eax
mov ecx, dword [ebp - 0x994]
call fcn.0040ad59
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.004044e0
jmp 0x40ad17
mov ecx, dword [ebp + 8]
and ecx, 0xff
push ecx
push str.ChangeWinFirewallException_is_Vista_compatible__set_to__d_____
call fcn.0042571d
add esp, 8
push 0x104
lea edx, [ebp - 0x144]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40ad17
lea eax, [ebp - 0x990]
push eax
push str._netsh.exe
lea ecx, [ebp - 0x98c]
call fcn.00408e00
mov dword [ebp - 0x9a8], eax
mov ecx, dword [ebp - 0x9a8]
mov dword [ebp - 0x9ac], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x9ac]
push edx
lea eax, [ebp - 0x144]
push eax
lea ecx, [ebp - 0x164]
push ecx
call fcn.0040ca70
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x98c]
call fcn.004044e0
lea edx, [ebp - 0x20]
push edx
push str.Instant_Support_Desk_Service
lea eax, [ebp - 0x154]
push eax
call fcn.0040ca70
add esp, 0xc
mov byte [ebp - 4], 8
mov ecx, dword [ebp + 8]
and ecx, 0xff
test ecx, ecx
je 0x40aca0
mov dword [ebp - 0x9b0], str.advfirewall_firewall_add_rule_name__s__program__s__dirin_actionallow
jmp 0x40acaa
mov dword [ebp - 0x9b0], str.advfirewall_firewall_delete_rule_name__s__program__s_
lea ecx, [ebp - 0x30]
call fcn.00404540
push eax
lea ecx, [ebp - 0x154]
call fcn.00404540
push eax
mov edx, dword [ebp - 0x9b0]
push edx
lea eax, [ebp - 0x964]
push eax
call fcn.004270d8
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x964]
push ecx
lea ecx, [ebp - 0x164]
call fcn.00404540
push eax
push 0x454eb8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x154]
call fcn.004044e0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x164]
call fcn.004044e0
mov edx, dword [ebp + 0xc]
and edx, 0xff
test edx, edx
je 0x40ad2e
mov eax, dword [ebp - 0x994]
mov byte [eax + 5], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.004044e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004044e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8