Function at 0x40eae6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x438963
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4444c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xfc], ecx
push 0
push 0x26
lea eax, [ebp - 0x80]
push eax
call fcn.0041aee6
add esp, 0xc
and dword [ebp - 4], 0
push 0x43bb20
lea ecx, [ebp - 0x48]
call fcn.00408e1f
mov byte [ebp - 4], 1
push 0x43b782
lea ecx, [ebp - 0xb8]
call fcn.00408211
mov byte [ebp - 4], 2
push 0x43bb20
lea ecx, [ebp - 0x2c]
call fcn.00408e1f
mov byte [ebp - 4], 3
push 0x43bb1c
lea ecx, [ebp - 0x64]
call fcn.00408e1f
mov byte [ebp - 4], 4
push 0x43bb1c
lea ecx, [ebp - 0x9c]
call fcn.00408e1f
mov byte [ebp - 4], 5
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00408632
pop ecx
pop ecx
mov dword [ebp - 0x100], 0x43bb18
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x100]
mov al, byte [eax]
mov byte [ebp - 0x105], al
inc dword [ebp - 0x100]
cmp byte [ebp - 0x105], 0
jne 0x40ebaf
mov eax, dword [ebp - 0x100]
sub eax, dword [ebp - 0x104]
mov dword [ebp - 0x10c], eax
push dword [ebp - 0x10c]
push 0x43bb18
push 2
push 1
lea ecx, [ebp - 0xb8]
call fcn.00416775
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00408591
pop ecx
pop ecx
push dword [0x43b6a8]
push 0
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x48]
call fcn.00407683
mov dword [ebp - 0x110], 0x43ba2c
mov eax, dword [ebp - 0x110]
add eax, 2
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x110]
mov ax, word [eax]
mov word [ebp - 0x116], ax
add dword [ebp - 0x110], 2
cmp word [ebp - 0x116], 0
jne 0x40ec37
mov eax, dword [ebp - 0x110]
sub eax, dword [ebp - 0x114]
sar eax, 1
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x11c]
push 0x43ba2c
lea ecx, [ebp - 0x48]
call fcn.004073b3
mov dword [ebp - 0x120], str.SUPUninstall.exe
mov eax, dword [ebp - 0x120]
add eax, 2
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x120]
mov ax, word [eax]
mov word [ebp - 0x126], ax
add dword [ebp - 0x120], 2
cmp word [ebp - 0x126], 0
jne 0x40ec98
mov eax, dword [ebp - 0x120]
sub eax, dword [ebp - 0x124]
sar eax, 1
mov dword [ebp - 0x12c], eax
push dword [ebp - 0x12c]
push str.SUPUninstall.exe
lea ecx, [ebp - 0x48]
call fcn.004073b3
mov dword [ebp - 0x130], 0x43bb20
mov eax, dword [ebp - 0x130]
add eax, 2
mov dword [ebp - 0x134], eax
mov eax, dword [ebp - 0x130]
mov ax, word [eax]
mov word [ebp - 0x136], ax
add dword [ebp - 0x130], 2
cmp word [ebp - 0x136], 0
jne 0x40ecf9
mov eax, dword [ebp - 0x130]
sub eax, dword [ebp - 0x134]
sar eax, 1
mov dword [ebp - 0x13c], eax
push dword [ebp - 0x13c]
push 0x43bb20
lea ecx, [ebp - 0x48]
call fcn.004073b3
cmp dword [ebp - 0x34], 8
jb 0x40ed52
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x140], eax
jmp 0x40ed5b
lea eax, [ebp - 0x48]
mov dword [ebp - 0x140], eax
push 0
push 0
push 0
push dword [ebp - 0x140]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
and dword [ebp - 0xbc], 0
mov byte [ebp - 4], 6
push 0
push 1
lea ecx, [ebp - 0x9c]
call fcn.004050af
mov byte [ebp - 4], 4
mov byte [ebp - 4], 7
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004050af
mov byte [ebp - 4], 3
mov byte [ebp - 4], 8
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004050af
mov byte [ebp - 4], 2
mov byte [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0xb8]
call fcn.00402ad2
mov byte [ebp - 4], 1
mov byte [ebp - 4], 0xa
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004050af
mov byte [ebp - 4], 0
mov dword [ebp - 4], 0xb
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.004050af
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c438
leave
ret