Function at 0x4011f0
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x690
lea eax, [esp + 0x90]
push ebx
push ebp
push esi
push edi
push 0x200
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.filetest
mov esi, dword [esp + 0x6b0]
push esi
call edi
test eax, eax
jne 0x40123e
lea edx, [esp + 0xa0]
push str.c:_temp_test.exe
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.buildtest
push esi
call edi
test eax, eax
push 0x40
jne 0x401388
mov ebp, dword [sym.imp.KERNEL32.dll__lopen]
push str.z:installexebuilderupgradewbsetup.exe
call ebp
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
mov esi, eax
push 2
push 0
push esi
call edi
mov ebx, eax
lea eax, [ebx + 0x400]
push eax
call fcn.004014b7
add esp, 4
mov dword [esp + 0x14], eax
push 0
push 0
push esi
call edi
push ebx
mov ecx, dword [esp + 0x18]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll__lread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push 0x40
push str.c:_tempwork.wbp
call ebp
mov esi, eax
push 2
push 0
push esi
call edi
mov ebp, eax
lea edx, [ebp + 0x400]
push edx
call fcn.004014b7
add esp, 4
mov dword [esp + 0x18], eax
push 0
push 0
push esi
call edi
push ebp
mov eax, dword [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll__lread]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push str.c:_temp_temp.pak
call dword [sym.imp.KERNEL32.dll__lcreat]
mov esi, eax
mov ecx, 0x21
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1c]
push str.________WEBSHOTS_FILE_BEGINS_HERE___________________________
push ecx
call edi
lea edx, [esp + 0x1c]
push str.____
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x60]
push str.wssetup.exe
push eax
mov dword [esp + 0x64], ebx
call edi
mov edi, dword [sym.imp.KERNEL32.dll__lwrite]
lea ecx, [esp + 0x1c]
push 0x84
push ecx
push esi
call edi
push ebx
mov edx, dword [esp + 0x18]
push edx
push esi
call edi
lea eax, [esp + 0x60]
push str.WebshotsAutoCollection.wbp
push eax
mov dword [esp + 0x64], ebp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x1c]
push 0x84
push ecx
push esi
call edi
push ebp
mov edx, dword [esp + 0x1c]
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x690
ret 0x10
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebp, dword [sym.imp.KERNEL32.dll__llseek]
mov edi, eax
push 2
push 0
push edi
call ebp
mov esi, eax
lea ecx, [esi + 0x400]
push ecx
call fcn.004014b7
add esp, 4
mov ebx, eax
push 0
push 0
push edi
call ebp
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll__lread]
push edi
call dword [sym.imp.KERNEL32.dll__lclose]
lea edx, [esp + 0x2a0]
lea eax, [esp + 0x10]
push edx
push esi
push eax
push ebx
mov dword [esp + 0x20], 0
call fcn.00401090
add esp, 0x10
test eax, eax
jne 0x40140e
push str.Unable_to_extract_Installer._Please_try_and_download_the_file_again.
call fcn.004011d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x690
ret 0x10
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x4a0]
sub esi, eax
push ecx
lea edx, [esp + 0x14]
push esi
push edx
push ebx
call fcn.00401090
add esp, 0x10
test eax, eax
jne 0x40144b
push str.Unable_to_extract_Photos._Please_try_and_download_the_file_again.
call fcn.004011d0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x690
ret 0x10
lea eax, [esp + 0x2a0]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push ebx
call fcn.00401480
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x690
ret 0x10