Function at 0x4093f6
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
sub esp, 0x974
lea ebp, [esp - 4]
mov eax, dword [0x46c054]
xor eax, ebp
mov dword [ebp + 0x974], eax
push 0x20
mov eax, 0x4404af
call fcn.00426671
mov eax, ecx
xor ebx, ebx
cmp dword [eax + 0x10], ebx
mov dword [ebp - 0x10], eax
je 0x409431
push str.__ChangeWinFirewallException
call fcn.00414978
pop ecx
call fcn.00412d7e
mov edi, eax
cmp edi, 0x32
jbe 0x409654
push 0xf
pop esi
push ebx
lea ecx, [ebp + 0x1c]
mov dword [ebp + 0x34], esi
call fcn.00404219
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x6c], esi
call fcn.00404219
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
push ebx
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x54]
push eax
mov ecx, esi
call fcn.00408a8c
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp + 0x54]
call fcn.00405cbb
cmp edi, 0x50
movzx eax, byte [ebp + 0x980]
push eax
jae 0x409542
push str.ChangeWinFirewallException_is_XP_compatible__set_to__d_____
call fcn.00414978
push str.::Enabled:Instant_Support_Desk_Service
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp]
push eax
call fcn.00408c0a
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x1c]
push ecx
push eax
lea eax, [ebp + 0x38]
push eax
call fcn.00408a39
add esp, 0x20
mov byte [ebp - 4], 4
push ebx
push 1
lea ecx, [ebp]
call fcn.004049a0
cmp byte [ebp + 0x980], bl
push 0x10
pop edi
je 0x4094f0
cmp dword [ebp + 0x50], edi
jb 0x4094eb
mov ecx, dword [ebp + 0x3c]
jmp 0x4094f2
lea ecx, [ebp + 0x3c]
jmp 0x4094f2
xor ecx, ecx
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x4094fd
lea eax, [ebp + 0x58]
push 1
push ecx
push eax
mov ecx, esi
call fcn.004092d9
cmp byte [ebp + 0x980], bl
je 0x40951f
cmp dword [ebp + 0x50], edi
jb 0x40951a
mov ecx, dword [ebp + 0x3c]
jmp 0x409521
lea ecx, [ebp + 0x3c]
jmp 0x409521
xor ecx, ecx
cmp dword [ebp + 0x6c], edi
mov eax, dword [ebp + 0x58]
jae 0x40952c
lea eax, [ebp + 0x58]
push ebx
push ecx
push eax
mov ecx, esi
call fcn.004092d9
mov byte [ebp - 4], 1
lea ecx, [ebp + 0x38]
jmp 0x409623
push str.ChangeWinFirewallException_is_Vista_compatible__set_to__d_____
call fcn.00414978
pop ecx
pop ecx
push 0x104
lea eax, [ebp + 0x870]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40962b
push str._netsh.exe
lea ecx, [ebp - 0x2c]
call fcn.00405057
mov byte [ebp - 4], 5
push eax
lea eax, [ebp + 0x870]
push eax
lea eax, [ebp]
push eax
call fcn.00408c59
add esp, 0xc
mov byte [ebp - 4], 7
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.004049a0
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push str.Instant_Support_Desk_Service
push eax
call fcn.00408c59
add esp, 0xc
mov byte [ebp - 4], 8
cmp byte [ebp + 0x980], bl
mov edx, str.advfirewall_firewall_add_rule_name__s__program__s__dirin_actionallow
jne 0x4095c7
mov edx, str.advfirewall_firewall_delete_rule_name__s__program__s_
mov ecx, dword [ebp + 0x58]
push 0x10
pop edi
cmp dword [ebp + 0x6c], edi
jae 0x4095d5
lea ecx, [ebp + 0x58]
cmp dword [ebp + 0x50], edi
mov eax, dword [ebp + 0x3c]
jae 0x4095e0
lea eax, [ebp + 0x3c]
push ecx
push eax
push edx
lea eax, [ebp + 0x70]
push eax
call fcn.00428956
mov eax, dword [ebp + 4]
add esp, 0x10
cmp dword [ebp + 0x18], edi
jae 0x4095fa
lea eax, [ebp + 4]
push ebx
push ebx
lea ecx, [ebp + 0x70]
push ecx
push eax
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov byte [ebp - 4], 7
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.004049a0
mov byte [ebp - 4], 1
lea ecx, [ebp]
push ebx
push 1
call fcn.004049a0
cmp byte [ebp + 0x984], bl
je 0x409637
mov byte [esi + 5], 1
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 0x54]
call fcn.004049a0
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea ecx, [ebp + 0x1c]
call fcn.004049a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x974]
xor ecx, ebp
call fcn.00425c6b
add ebp, 0x978
leave
ret 8