Function at 0x1066cc0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x109ba64
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x15c
push esi
lea eax, [esp + 4]
push 4
push eax
lea ecx, [esp + 0x17c]
mov dword [esp + 0x170], 1
call fcn.01088e1d
mov eax, dword [eax]
push 0x10ac300
push eax
call fcn.0108679c
add esp, 8
lea ecx, [esp + 4]
mov esi, eax
call fcn.0108e72b
test esi, esi
pop esi
je 0x1066fb0
mov ecx, dword [0x10aa77c]
push ebx
mov dword [esp + 8], ecx
mov ecx, dword [esp + 0x174]
mov bl, 2
mov byte [esp + 0x168], bl
mov eax, dword [ecx - 8]
cmp eax, 7
jl 0x1066ec2
add eax, 0xfffffff9
push 3
lea edx, [esp + 8]
push eax
push edx
lea ecx, [esp + 0x180]
call fcn.01088d87
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x16c], 3
call fcn.0108e864
lea ecx, [esp + 4]
mov byte [esp + 0x168], bl
call fcn.0108e72b
mov eax, dword [esp + 0x180]
mov ecx, dword [esp + 8]
push eax
push ecx
call fcn.0108679c
add esp, 8
test eax, eax
je 0x1066ec2
mov edx, dword [esp + 8]
push 0x10ac2fc
push edx
call fcn.0108679c
add esp, 8
test eax, eax
jne 0x1066ec2
push 3
push str.Software_aheadNero___Burning_RomNeverShowMeAgain
push SysReAllocStringLen
push str.EnglishHelpFile
lea ecx, [esp + 0x20]
call fcn.01070670
mov eax, dword [0x10aa77c]
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
push 0x6f07
lea ecx, [esp + 0x10]
mov byte [esp + 0x16c], 6
call fcn.01090127
mov eax, dword [esp + 0xc]
push 0x19
lea ecx, [esp + 8]
push eax
push ecx
call fcn.01089297
mov edx, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
push 0x40
push edx
call fcn.01070800
lea ecx, [esp + 0xc]
mov byte [esp + 0x168], 5
call fcn.0108e72b
lea ecx, [esp + 4]
mov byte [esp + 0x168], 4
call fcn.0108e72b
lea ecx, [esp + 0x124]
mov byte [esp + 0x168], 0xc
call fcn.01091c0b
lea ecx, [esp + 0x11c]
mov byte [esp + 0x168], 0xb
call fcn.0108e72b
lea ecx, [esp + 0x118]
mov byte [esp + 0x168], 0xa
call fcn.0108e72b
lea ecx, [esp + 0x80]
mov byte [esp + 0x168], 9
call fcn.0106e420
lea ecx, [esp + 0x7c]
mov byte [esp + 0x168], 8
call fcn.0108e72b
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x1066eb2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x6c], 0
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], bl
call fcn.0108a601
mov eax, dword [esp + 0x174]
push 5
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edx, eax
cmp edx, 0x20
jge 0x1066f9c
cmp edx, 0x1f
jne 0x1066f29
push 0
lea ecx, [esp + 0x14]
call fcn.0106e1d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], 0xd
call fcn.0108aa02
lea ecx, [esp + 0x6c]
mov byte [esp + 0x168], 0xe
call fcn.010671f0
lea ecx, [esp + 0x10]
mov byte [esp + 0x168], bl
call fcn.0108a601
jmp 0x1066f9c
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
push eax
lea ecx, [esp + 0x18]
push 0xff
push ecx
push 0x400
push edx
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, dword [0x10aa77c]
mov dword [esp + 8], edx
lea eax, [esp + 0x14]
lea ecx, [esp + 8]
push eax
push 0x6f00
push ecx
mov byte [esp + 0x178], 0xf
call fcn.010892aa
mov edx, dword [esp + 0x14]
add esp, 0xc
push 0
push 0
push edx
call fcn.01091740
lea ecx, [esp + 8]
mov byte [esp + 0x16c], bl
call fcn.0108e72b
pop edi
lea ecx, [esp + 8]
mov byte [esp + 0x168], 1
call fcn.0108e72b
pop ebx
jmp 0x1066fcc
mov eax, dword [esp + 0x178]
mov ecx, dword [esp + 0x174]
push eax
push ecx
mov ecx, dword [esp + 0x174]
call fcn.0108f6e0
lea ecx, [esp + 0x170]
mov byte [esp + 0x164], 0
call fcn.0108e72b
lea ecx, [esp + 0x17c]
mov dword [esp + 0x164], 0xffffffff
call fcn.0108e72b
mov ecx, dword [esp + 0x15c]
mov dword fs:[0], ecx
add esp, 0x168
ret