Function at 0x40395b
Capabilities:
Create process on windows
Create process suspended
Set current directory

Disassembly:
push 0x184
mov eax, 0x4556c9
call fcn.00436bf5
mov esi, edx
mov dword [ebp - 0x74], esi
mov edi, ecx
mov dword [ebp - 0x8c], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x78]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
je 0x403b81
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], ebx
push eax
push 4
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 2
push eax
push 0x12
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x78]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
mov esi, dword [ebp - 0x74]
je 0x403b81
cmp dword [ebp - 0x7c], 2
je 0x403b81
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x4039f2
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x403a2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [edi + 8], ebx
je 0x403a18
push str.SetCurrentDirectory_failed_
push 0x45
mov ecx, edi
call fcn.00402891
movzx eax, si
or eax, 0x80070000
test esi, esi
cmovle eax, esi
jmp 0x403ba9
cmp dword [edi + 8], ebx
je 0x403a3d
push str.Creating_process...
push 0x49
mov ecx, edi
call fcn.00402891
push esi
lea ecx, [ebp - 0x58]
call fcn.00409368
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [esp], str.NVIDIA_Web_Helper.exe_
call fcn.00407d34
push eax
lea ecx, [ebp - 0x40]
call fcn.004059b2
push dword [ebp - 0x84]
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040a1fc
push eax
lea ecx, [ebp - 0x28]
call fcn.004059b2
lea ecx, [ebp - 0x40]
call fcn.00407c3e
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00407c3e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0xe0]
push 0x44
pop edi
push edi
push ebx
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
call fcn.00438580
mov dword [ebp - 0xe0], edi
xor eax, eax
lea edi, [ebp - 0x9c]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0xe0]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ecx
push ecx
lea ecx, [ebp - 0x190]
mov esi, eax
call fcn.004064eb
push esi
mov edx, str.CreateProcess_failed_with
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x180]
call fcn.004091d3
mov ecx, eax
call fcn.00406a9f
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x190]
call fcn.00406442
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x403b34
mov eax, dword [eax]
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + 8], ebx
je 0x403b47
push eax
push 0x45
call fcn.00402891
lea ecx, [ebp - 0x70]
call fcn.00407dc4
lea ecx, [ebp - 0x190]
call fcn.0040390f
movzx ebx, si
or ebx, 0x80070000
test esi, esi
cmovle ebx, esi
jmp 0x403b75
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x9c]
mov dword [eax], ecx
lea ecx, [ebp - 0x28]
call fcn.00407c3e
mov eax, ebx
jmp 0x403ba9
cmp dword [edi + 8], ebx
je 0x403b94
push str.Current_process_is_elevated__trying_to_create_unelevated
push 0x49
mov ecx, edi
call fcn.00402891
mov eax, dword [ebp - 0x80]
mov edx, esi
push eax
push dword [ebp - 0x84]
mov ecx, edi
call fcn.00402cbe
pop ecx
pop ecx
call fcn.00436b9f
ret