Function at 0x4014c4
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x56d02f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x129c
call fcn.0050b430
push ebx
push esi
push edi
push 0x800
lea eax, [esp + 0xaac]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x401526
xor al, al
mov ecx, dword [esp + 0x12ac]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x78]
call fcn.004027e7
mov esi, eax
mov dword [esp + 0x12b4], ebx
lea eax, [esp + 0xaa8]
push eax
lea ecx, [esp + 0x20]
call fcn.004027e7
mov edi, eax
mov byte [esp + 0x12b4], 1
push 0x5b0bcc
call fcn.00504d8b
pop ecx
push eax
mov eax, esi
call fcn.00402190
push eax
push ebx
lea eax, [esp + 0x60]
push eax
mov ecx, edi
call fcn.0040208e
mov byte [esp + 0x12b4], 3
push ebx
push 1
lea ecx, [esp + 0x24]
call fcn.00403580
mov byte [esp + 0x12b4], 4
push ebx
push 1
lea ecx, [esp + 0x7c]
call fcn.00403580
cmp dword [esp + 0x70], 8
mov eax, dword [esp + 0x5c]
jae 0x4015b3
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call fcn.0041e8c0
mov edi, dword [esp + 0xc]
mov ecx, edi
call fcn.00463ea0
test al, al
jne 0x4015e7
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x60]
call fcn.00403580
jmp 0x40150f
push 2
mov esi, str.temp
push esi
call fcn.00504e2e
pop ecx
pop ecx
test eax, eax
je 0x401601
push esi
call fcn.00504e46
pop ecx
mov esi, 0x104
push esi
lea eax, [esp + 0x29c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x298]
test eax, eax
je 0x40168f
lea eax, [esp + 0x90]
test eax, eax
je 0x40168f
lea edi, [esp + 0x298]
call fcn.0041f0b0
cmp eax, ebx
jne 0x40165f
xor eax, eax
movzx ecx, word [esp + eax + 0x298]
mov word [esp + eax + 0x90], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x40168b
cmp esi, ebx
jne 0x40163e
jmp 0x401681
add eax, 2
lea edx, [esp + 0x90]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
dec esi
movzx ecx, cx
inc eax
inc eax
cmp cx, bx
je 0x40168b
cmp esi, ebx
jne 0x40166b
xor eax, eax
mov word [esp + 0x296], ax
mov edi, dword [esp + 0xc]
lea esi, [esp + 0x4a0]
lea edx, [esp + 0x90]
call fcn.0041eaa0
mov eax, esi
push eax
push str.temp
push 0x5bb550
lea eax, [esp + 0x6b4]
push 0x200
push eax
call fcn.0041f040
lea eax, [esp + 0x6bc]
add esp, 0x14
push eax
call fcn.00532cc0
pop ecx
lea esi, [esp + 0x38]
call fcn.004202c0
mov byte [esp + 0x12b4], 5
mov eax, esi
push eax
lea ecx, [edi + 0xa4]
mov edx, edi
call fcn.00401d40
test al, al
jne 0x401782
push str.YmirPatcher
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 6
call fcn.00420660
push eax
lea ecx, [esp + 0x10]
call fcn.00403311
mov byte [esp + 0x12b4], 7
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [esp + 0x12b4], 6
lea ecx, [esp + 0xc]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0x10]
call fcn.00401017
call fcn.004026dd
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.004202d0
jmp 0x4015ce
lea esi, [esp + 0x38]
call fcn.00420330
lea eax, [edi + 0xf8]
cmp dword [eax + 0x18], 8
jb 0x40179c
mov eax, dword [eax + 4]
jmp 0x40179f
add eax, 4
push eax
push ecx
call fcn.004032e1
pop ecx
push eax
lea ecx, [esp + 0x40]
call fcn.004055d2
test al, al
jne 0x401824
push str.YmirPatcher
lea ecx, [esp + 0x10]
call fcn.00403311
mov byte [esp + 0x12b4], 8
lea esi, [esp + 0x38]
call fcn.00420660
push eax
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 9
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [esp + 0x12b4], 8
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
jmp 0x401761
call fcn.0040105e
test eax, eax
je 0x40176b
call fcn.004032e1
mov ecx, eax
call fcn.004058a5
mov dword [esp + 0x10], 1
call fcn.004209e0
test eax, eax
jne 0x4019d3
mov eax, dword [edi + 0x2c]
mov ecx, dword [edi + 0x28]
push eax
push ecx
lea esi, [esp + 0x24]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.0041f520
mov byte [esp + 0x12b4], 0xa
call fcn.00420c30
test eax, eax
jne 0x40192f
push str.TORRENT_PATCH
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [esp + 0x10]
call fcn.00403311
mov byte [esp + 0x12b4], 0xb
push str.NOT_SUPPORT_UAC
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 0xc
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [esp + 0x12b4], 0xb
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 0xa
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.004026dd
mov byte [esp + 0x12b4], 5
lea esi, [esp + 0x1c]
call fcn.0041f4d0
jmp 0x40176b
cmp dword [esp + 0x24], ebx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
lea eax, [eax + ecx*2]
jle 0x401948
mov ecx, dword [esp + 0x28]
mov ecx, dword [ecx]
jmp 0x40194a
xor ecx, ecx
push 1
push ebx
push eax
push ecx
push str.runas
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x401919
push str.TORRENT_PATCH
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [esp + 0x10]
call fcn.00403311
mov byte [esp + 0x12b4], 0xd
push str.LAUNCH_ERROR_WITH_ADMIN_PRIVILEGES
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 0xe
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x204
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [esp + 0x12b4], 0xd
jmp 0x4018fa
push 0x18
call fcn.005047e7
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0xf
cmp eax, ebx
je 0x4019f4
mov ecx, eax
call fcn.0040267c
jmp 0x4019f6
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0048d240
pop ecx
push 0x18
call fcn.005047e7
pop ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x12b4], 0x10
cmp eax, ebx
je 0x401a26
mov ecx, eax
call fcn.004024d6
jmp 0x401a28
xor eax, eax
mov byte [esp + 0x12b4], 5
push eax
call fcn.0048d240
pop ecx
lea esi, [esp + 0x38]
call fcn.00420330
mov eax, esi
push eax
push str.LauncherSkin
call fcn.004032e1
mov esi, eax
call fcn.0040582a
push eax
call fcn.0040d5f2
pop ecx
pop ecx
test eax, eax
jne 0x401b0b
push str.YmirPatcher
lea ecx, [esp + 0x10]
call fcn.00403311
mov byte [esp + 0x12b4], 0x11
lea esi, [esp + 0x38]
call fcn.00420660
push eax
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 0x12
push 0xffffffffffffffff
push 0xffffffffffffffff
push ebx
push 0x804
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00489b40
add esp, 0x18
mov byte [esp + 0x12b4], 0x11
lea ecx, [esp + 0x10]
call fcn.00401017
mov byte [esp + 0x12b4], 5
lea ecx, [esp + 0xc]
call fcn.00401017
call fcn.004026dd
mov byte [esp + 0x17], bl
mov byte [esp + 0x12b4], 4
lea eax, [esp + 0x38]
push eax
call fcn.004202d0
or dword [esp + 0x12b4], 0xffffffff
push ebx
push 1
lea ecx, [esp + 0x60]
call fcn.00403580
mov al, byte [esp + 0x17]
jmp 0x401511
push 0x1a8
call fcn.005047e7
pop ecx
mov dword [esp + 0xc], eax
mov byte [esp + 0x12b4], 0x13
cmp eax, ebx
je 0x401b65
push str.TORRENT_PATCH
push ecx
call fcn.004032e1
pop ecx
mov esi, eax
call fcn.0040582a
push eax
lea ecx, [esp + 0x14]
call fcn.00403311
mov byte [esp + 0x12b4], 0x14
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
mov dword [esp + 0x20], 1
call fcn.00418c4c
mov esi, eax
jmp 0x401b67
xor esi, esi
mov dword [esp + 0x12b4], 5
test byte [esp + 0x18], 1
je 0x401b87
and dword [esp + 0x18], 0xfffffffe
lea ecx, [esp + 0x10]
call fcn.00401017
mov ecx, esi
call fcn.0041917b
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x98]
mov dword [edi + 0x44], esi
mov byte [esp + 0x17], 1
jmp 0x401adc