Function at 0x4041b0
Capabilities:
Create process on windows
Get common file path
Resume thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1068
call fcn.004449d0
mov eax, dword [0x4710b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov cl, 0xec
xor ebx, ebx
push 0x104
mov byte [ebp - 0x1b0], cl
lea eax, [ebp - 0x109]
mov cl, 0x78
push ebx
push eax
mov dword [ebp - 0xfbc], edi
mov dword [ebp - 0x1c0], 0x1e00b768
mov dword [ebp - 0x1bc], 0x2e800
mov dword [ebp - 0x1b8], 0xe0ff0000
mov dword [ebp - 0x1b4], 0x83ec8b55
mov dword [ebp - 0x1af], 0x30a1640c
mov dword [ebp - 0x1ab], 0x53000000
mov dword [ebp - 0x1a7], 0xc408b57
mov dword [ebp - 0x1a3], 0x8b14408b
mov dword [ebp - 0x19f], 0x8b008b00
mov dword [ebp - 0x19b], 0x478b1078
mov dword [ebp - 0x197], 0x38448b3c
mov byte [ebp - 0x193], cl
mov dword [ebp - 0x192], 0x488bc703
mov dword [ebp - 0x18e], 0x1c588b24
mov dword [ebp - 0x18a], 0x508bcf03
mov dword [ebp - 0x186], 0x8bdf0320
mov dword [ebp - 0x182], 0xd7031840
mov dword [ebp - 0x17e], 0x33f44d89
mov dword [ebp - 0x17a], 0xf85589c9
mov dword [ebp - 0x176], 0x85fc4589
mov dword [ebp - 0x172], 0x564c74c0
mov dword [ebp - 0x16e], 0x338a148b
mov dword [ebp - 0x16a], 0x8ad703f6
mov dword [ebp - 0x166], 0x74c08402
mov dword [ebp - 0x162], 0x1f6691f
mov dword [ebp - 0x15e], 0xf000001
mov dword [ebp - 0x15a], 0xf003c0b6
mov dword [ebp - 0x156], 0x3310e0c1
mov dword [ebp - 0x152], 0x28a42f0
mov dword [ebp - 0x14e], 0xe975c084
mov dword [ebp - 0x14a], 0xe396fe81
mov dword [ebp - 0x146], 0xb74eec1
mov dword [ebp - 0x142], 0xfc4d3b41
mov dword [ebp - 0x13e], 0x558b1873
mov dword [ebp - 0x13a], 0x8bc9ebf8
mov dword [ebp - 0x136], 0xb70ff445
mov dword [ebp - 0x132], 0x48b4804
mov dword [ebp - 0x12e], 0x74c70383
mov dword [ebp - 0x12a], 0x875ff05
mov dword [ebp - 0x126], 0x645ed0ff
mov dword [ebp - 0x122], 0x30a1
mov dword [ebp - 0x11e], 0x8b5b5f00
mov dword [ebp - 0x11a], 0x418b0848
mov dword [ebp - 0x116], 0x8448b3c
mov dword [ebp - 0x112], 0x8bc10328
mov dword [ebp - 0x10e], 0x4c25de5
mov byte [ebp - 0x10a], bl
call fcn.004426d0
push 0x44
lea ecx, [ebp - 0x1024]
push ebx
push ecx
call fcn.004426d0
mov ecx, dword [edi + 0x508]
mov dword [ebp - 0x1024], 0x44
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
add esp, 0x18
push 0x46872c
call eax
mov ecx, dword [edi + 0x50c]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0x46872c
call eax
xor ecx, ecx
mov word [ebp - 0x3c8], cx
push 0x206
lea edx, [ebp - 0x3c6]
push ebx
push edx
call fcn.004426d0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x6d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x6d4]
push 0x5c
push ecx
call fcn.0043e5b7
xor edx, edx
mov word [eax + 2], dx
lea eax, [ebp - 0x6d4]
push eax
lea ecx, [ebp - 0x3c8]
push 0x104
push ecx
call fcn.0043e272
push str.LinLogin.bin
lea edx, [ebp - 0x3c8]
push 0x104
push edx
call fcn.0043e1fd
push 0x206
lea ecx, [ebp - 0x8da]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x8dc], ax
call fcn.004426d0
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x3c8]
push edx
lea eax, [ebp - 0x8dc]
push 0x468ce8
push eax
call esi
push 0x206
lea edx, [ebp - 0xae2]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0xae4], cx
call fcn.004426d0
add esp, 0x44
lea eax, [ebp - 0x6d4]
push eax
lea ecx, [ebp - 0xae4]
push 0x468ce8
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0xfd0]
push edx
lea eax, [ebp - 0x1024]
push eax
lea ecx, [ebp - 0xae4]
push ecx
push ebx
push 0x404
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x8dc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404941
mov eax, dword [ebp - 0xfc8]
push eax
call fcn.0040b6d0
add esp, 4
mov dword [ebp - 0xfc0], eax
cmp eax, ebx
jne 0x40453f
mov ecx, dword [edi + 4]
push 0x40
push 0x468bd4
push 0x468cf0
push ecx
jmp 0x404968
lea eax, [ebp - 0xcec]
call fcn.004032f0
lea esi, [ebp - 0xcec]
call fcn.004032a0
push str.._awke.dll
lea ecx, [ebp - 0x109]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xfd0]
push 4
push 0x3000
push 0x1bb
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
lea eax, [esi + 0xb7]
mov dword [ebp - 0x1bf], eax
cmp esi, ebx
je 0x4045fb
push 0x2cc
lea ecx, [ebp - 0xfb8]
push ebx
push ecx
call fcn.004426d0
mov eax, dword [ebp - 0xfcc]
add esp, 0xc
lea edx, [ebp - 0xfb8]
push edx
push eax
mov dword [ebp - 0xfb8], 0x10002
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
mov edx, dword [ebp - 0xfcc]
lea ecx, [ebp - 0xfb8]
push ecx
push edx
mov dword [ebp - 0xf08], esi
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
mov ecx, dword [ebp - 0xfd0]
push ebx
push 0x1bb
lea eax, [ebp - 0x1c0]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edx, dword [edi + 0x728]
imul edx, edx, 0xd5
lea esi, [edx + edi + 0x770]
mov edx, dword [ebp - 0xfbc]
mov edi, dword [ebp - 0xfc0]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov eax, dword [edx + 0x728]
imul eax, eax, 0xd5
mov esi, dword [eax + edx + 0x795]
lea ecx, [eax + edx + 0x795]
mov eax, dword [ebp - 0xfc0]
mov dword [eax + 0x26], esi
mov esi, dword [ecx + 4]
mov dword [eax + 0x2a], esi
mov esi, dword [ecx + 8]
mov dword [eax + 0x2e], esi
mov ecx, dword [ecx + 0xc]
mov dword [eax + 0x32], ecx
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
mov ecx, dword [ecx + edx + 0x790]
mov dword [eax + 0x20], ecx
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
movzx ecx, byte [ecx + edx + 0x7a5]
mov byte [eax + 0x24], cl
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
movzx ecx, byte [ecx + edx + 0x7a6]
mov byte [eax + 0x25], cl
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
movzx ecx, byte [ecx + edx + 0x7a7]
mov byte [eax + 0x36], cl
mov byte [eax + 0x37], 1
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
movzx ecx, byte [ecx + edx + 0x7e8]
mov byte [eax + 0x79], cl
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
mov ecx, dword [ecx + edx + 0x7ed]
mov dword [eax + 0x80], ecx
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
mov ecx, dword [ecx + edx + 0x7f1]
mov dword [eax + 0x7c], ecx
mov ecx, dword [edx + 0x728]
imul ecx, ecx, 0xd5
lea esi, [ecx + edx + 0x7a8]
lea edi, [eax + 0x38]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
mov byte [eax + 0x78], bl
movzx ecx, byte [0x475778]
mov byte [eax + 0x84], cl
movzx ecx, byte [0x475779]
mov byte [eax + 0x85], cl
movzx ecx, byte [0x47577a]
mov byte [eax + 0x86], cl
movzx ecx, byte [0x47577b]
mov byte [eax + 0x87], cl
movzx ecx, byte [0x47577c]
mov byte [eax + 0x88], cl
movzx ecx, byte [0x47577d]
mov byte [eax + 0x89], cl
movzx ecx, byte [0x47577e]
mov byte [eax + 0x8a], cl
movzx ecx, byte [0x47577f]
mov byte [eax + 0x8b], cl
movzx ecx, byte [0x475780]
mov byte [eax + 0x8c], cl
mov ecx, dword [0x477048]
mov byte [eax + 0x8d], 1
mov edx, dword [edx + 0x51c]
mov dword [eax + 0x94], edx
mov dword [eax + 0x98], 0x98b5cc8
cmp ecx, ebx
je 0x4047bd
mov dword [eax + 0x90], ecx
lea eax, [ebp - 0x4cc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.LauncherDll.dll
lea ecx, [ebp - 0x4cc]
push 0x104
push ecx
call fcn.0043e2d5
mov eax, dword [ebp - 0xfc8]
lea edx, [ebp - 0x4cc]
push edx
call fcn.004035f0
add esp, 0x10
test eax, eax
jne 0x404832
mov esi, dword [ebp - 0xfbc]
mov eax, dword [esi + 4]
push ebx
push 0x468d34
push 0x468d3c
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 0xfd0]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [esi + 0x4c8]
jmp 0x404974
mov ecx, dword [ebp - 0xfcc]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [ebp - 0xfbc]
mov edx, dword [edi + 4]
push ebx
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 0xfc0]
cmp byte [esi + 0x78], bl
jne 0x404873
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
cmp byte [esi + 0x78], bl
je 0x404861
mov edi, dword [ebp - 0xfbc]
call fcn.0040b780
push 0x44
lea eax, [ebp - 0x1068]
push ebx
push eax
call fcn.004426d0
add esp, 0xc
lea ecx, [ebp - 0xef4]
push ecx
push 0x104
mov dword [ebp - 0x1068], 0x44
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push str.C:WINDOWSsystem32cmd.exe_ipconfig_flushdns
lea edx, [ebp - 0xef4]
push 0x104
push edx
call fcn.0043e1fd
add esp, 0xc
lea eax, [ebp - 0xfe0]
push eax
lea ecx, [ebp - 0x1068]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0xef4]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4048f4
mov eax, dword [ebp - 0xfe0]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x477448], ebx
je 0x404916
mov ecx, dword [ebp - 0xfc8]
mov eax, dword [ebp - 0xfd0]
push ecx
call fcn.0040be90
mov edi, dword [ebp - 0xfbc]
jmp 0x40496e
push ebx
push 0xf020
push 0x112
mov ecx, edi
call fcn.0040d569
push ebx
push 0xf060
push 0x112
mov ecx, edi
call fcn.0040d569
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x468db8
lea edx, [ebp - 0x3c8]
call fcn.004096f0
mov eax, dword [edi + 4]
add esp, 8
push ebx
push ebx
lea edx, [ebp - 0x3c8]
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [edi + 0x4c8]
mov edx, dword [ecx]
mov eax, dword [edx + 0xd8]
push 1
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043db8a
mov esp, ebp
pop ebp
ret