Function at 0x4020c7
Capabilities:
Create process on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x195c
call fcn.00413ad0
mov eax, dword [0x41c004]
xor eax, esp
mov dword [esp + 0x1958], eax
push ebx
push esi
push edi
mov ecx, str._nodel
call fcn.0040202a
mov ecx, str._ghost
mov dword [esp + 0x10], eax
call fcn.0040202a
mov ecx, str._stop
mov dword [esp + 0x18], eax
call fcn.0040202a
mov ecx, str._service
mov dword [esp + 0x24], eax
call fcn.0040202a
mov ecx, str._norunonce
mov dword [esp + 0x20], eax
call fcn.0040202a
mov ecx, str._app
mov dword [esp + 0x14], eax
call fcn.0040202a
mov ecx, str._params
mov dword [esp + 0x1c], eax
call fcn.0040202a
mov ebx, 0x80
mov dword [esp + 0xc], eax
push ebx
xor edi, edi
lea eax, [esp + 0x84]
push edi
push eax
call fcn.00404620
add esp, 0xc
lea eax, [esp + 0x1140]
xor esi, esi
inc esi
push 0x820
push edi
push eax
call fcn.00404620
add esp, 0xc
lea eax, [esp + 0x100]
push 0x820
push edi
push eax
call fcn.00404620
add esp, 0xc
lea eax, [esp + 0x920]
push 0x820
push edi
push eax
call fcn.00404620
add esp, 0xc
lea eax, [esp + 0x38]
push 0x44
push edi
push eax
call fcn.00404620
mov dword [esp + 0x34], edi
xor eax, eax
lea edi, [esp + 0x38]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, 0x41a8f4
mov ecx, edi
call fcn.0040202a
test eax, eax
je 0x402211
push str._unattid
lea eax, [esp + 0x84]
push ebx
push eax
call fcn.00404fa7
add esp, 0xc
lea eax, [esp + 0x80]
push 0x40
push eax
call fcn.00405202
sub ebx, eax
lea edx, [esp + 0x88]
push ebx
mov ecx, edi
lea edx, [edx + eax*2]
call fcn.00402063
add esp, 0xc
mov ebx, dword [esp + 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
test ebx, ebx
je 0x402251
push 0xa
push 0x7d00
push 0
call edi
mov dword [0x41d2d0], eax
test eax, eax
je 0x40223a
call fcn.00401ae6
jmp 0x40223c
xor eax, eax
test eax, eax
je 0x402251
push ecx
call fcn.0040364b
pop ecx
call fcn.00401b2a
call fcn.00401acd
mov eax, dword [esp + 0xc]
test eax, eax
je 0x402313
push esi
push 0
mov edx, str.eula.txt
mov ecx, 0x2717
call fcn.00401b57
pop ecx
pop ecx
mov edx, 0x41a6c0
call fcn.00401dfb
cmp dword [esp + 0x10], 0
je 0x40228c
mov edx, str._nodel
call fcn.00401dfb
cmp dword [esp + 0x14], 0
je 0x40229d
mov edx, str._norunonce
call fcn.00401dfb
cmp dword [esp + 0x18], 0
je 0x4022c5
mov edx, str._ghost
call fcn.00401dfb
cmp word [esp + 0x80], 0
je 0x4022c5
lea edx, [esp + 0x80]
call fcn.00401dfb
push 0
push 0
mov edx, str.params.txt
mov ecx, 0x2710
call fcn.00401b57
xor ecx, ecx
call fcn.00401f0e
xor ecx, ecx
call fcn.00401fbf
mov edx, 0x2712
push esi
push str.script
lea ecx, [edx + 1]
call fcn.00401b57
mov edx, 0x2714
push esi
push str.script
lea ecx, [edx + 1]
call fcn.00401b57
mov eax, dword [esp + 0x24]
add esp, 0x18
test ebx, ebx
jne 0x40256d
test eax, eax
jne 0x40256d
mov ebx, 0x41a978
mov ecx, ebx
call fcn.0040202a
lea edx, [esp + 0x100]
test eax, eax
je 0x402371
push 0x410
mov ecx, ebx
call fcn.00402063
pop ecx
lea eax, [esp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0xa
push 0x7d00
xor ebx, ebx
push ebx
call edi
mov dword [0x41d2d0], eax
test eax, eax
je 0x40239f
call fcn.00401ae6
jmp 0x4023a1
push ecx
push ecx
lea ecx, [esp + 0x1148]
call fcn.004018ce
pop ecx
pop ecx
test eax, eax
je 0x402355
push str.Failed_to_create_applet_folder.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401a07
pop ecx
pop ecx
xor ebx, ebx
jmp 0x402518
mov eax, ebx
test eax, eax
jne 0x4023bd
push str.Failed_to_locate_application_resource.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401a07
pop ecx
pop ecx
jmp 0x402518
push ecx
call fcn.0040364b
pop ecx
test eax, eax
jne 0x4023cf
push str.Failed_to_decompress_application_files.
jmp 0x4023aa
call fcn.00401acd
test eax, eax
jne 0x4023df
push str.Failed_to_copy_service_binary.
jmp 0x4023aa
call fcn.00401b2a
push esi
push ebx
mov edx, str.eula.txt
mov ecx, 0x2717
call fcn.00401b57
mov ebx, dword [esp + 0x28]
pop ecx
pop ecx
test ebx, ebx
jne 0x402467
mov edx, 0x41a6c0
call fcn.00401dfb
cmp dword [esp + 0x10], ebx
je 0x402419
mov edx, str._nodel
call fcn.00401dfb
cmp dword [esp + 0x14], 0
je 0x40242a
mov edx, str._norunonce
call fcn.00401dfb
cmp dword [esp + 0x18], 0
je 0x402452
mov edx, str._ghost
call fcn.00401dfb
cmp word [esp + 0x80], 0
je 0x402452
lea edx, [esp + 0x80]
call fcn.00401dfb
push 0
push 0
mov edx, str.params.txt
mov ecx, 0x2710
call fcn.00401b57
pop ecx
pop ecx
mov ecx, ebx
call fcn.00401f0e
mov ecx, ebx
call fcn.00401fbf
test ebx, ebx
jne 0x40249f
mov edx, 0x2712
mov ebx, str.script
push esi
push ebx
lea ecx, [edx + 1]
call fcn.00401b57
mov edx, 0x2714
push esi
push ebx
lea ecx, [edx + 1]
call fcn.00401b57
add esp, 0x10
xor ebx, ebx
mov esi, ebx
cmp dword [esp + 0x24], ebx
jne 0x402518
push str.LMI_Rescue.exe
lea eax, [esp + 0x104]
push eax
push str.__s_s_
lea eax, [esp + 0x92c]
push 0x820
push eax
call fcn.00401998
add esp, 0x14
mov dword [esp + 0x38], 0x44
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x108]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x940]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x402518
push str.Failed_to_start_client_application.
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00401a07
pop ecx
pop ecx
push 2
pop esi
call fcn.00401b2a
cmp dword [esp + 0x2c], 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x402534
push dword [esp + 0x2c]
call edi
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x28], 0
je 0x402545
push dword [esp + 0x28]
call edi
mov dword [esp + 0x28], ebx
push 0x410
lea eax, [esp + 0x924]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x402569
lea ecx, [esp + 0x920]
call fcn.00401265
mov eax, esi
jmp 0x40256f
xor eax, eax
mov ecx, dword [esp + 0x1964]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004037ca
mov esp, ebp
pop ebp
ret