Function at 0x40614e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xba4]
sub esp, 0xc24
mov eax, dword [0x41b034]
xor eax, ebp
mov dword [ebp + 0xba0], eax
mov eax, dword [ebp + 0xbac]
push ebx
push esi
push edi
push 0x7ff
mov dword [ebp - 0x68], eax
lea eax, [ebp + 0x3a1]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x78], esi
mov byte [ebp + 0x3a0], 0
call fcn.00406970
lea eax, [esi + 0x3a]
push eax
mov dword [ebp - 0x80], eax
mov ebx, 0x800
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.004073f2
push 0x418858
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
add esp, 0x24
mov esi, 0x41ddbc
push str.browser
mov eax, esi
call fcn.00402a00
mov edi, eax
push 0x4181f0
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x7c], eax
push 0x4181ec
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x70], eax
push 0x4181e8
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x74], eax
push 0x4181e4
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x64], eax
push str.confno
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x6c], eax
push str.confid
mov eax, esi
call fcn.00402a00
push edi
push dword [ebp - 0x7c]
lea edi, [ebp + 0x3a0]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x64]
push dword [ebp - 0x6c]
push eax
call fcn.00403172
push str.rtoken
mov eax, esi
call fcn.00402a00
mov edi, eax
push str.uname
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x6c], eax
push 0x418210
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x64], eax
push str.token
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x74], eax
push str.stype
mov eax, esi
call fcn.00402a00
mov dword [ebp - 0x70], eax
push 0x4181fc
mov eax, esi
call fcn.00402a00
push edi
push dword [ebp - 0x6c]
lea edi, [ebp + 0x3a0]
push dword [ebp - 0x64]
push dword [ebp - 0x74]
push dword [ebp - 0x70]
push eax
call fcn.004032fa
push str.___action
mov eax, edi
push ebx
push eax
call fcn.00406c0d
add esp, 0xc
push str.action
mov eax, esi
call fcn.00402a00
mov esi, eax
test esi, esi
je 0x406311
mov edi, str.start
push edi
push esi
call fcn.0040498b
pop ecx
pop ecx
test al, al
je 0x4062ef
push edi
jmp 0x406316
mov edi, str.join
push edi
push esi
call fcn.0040498b
pop ecx
test al, al
pop ecx
lea eax, [ebp + 0x3a0]
je 0x40630a
push edi
jmp 0x40631c
push str.launch
jmp 0x40631c
push str.launch
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
mov esi, dword [ebp - 0x78]
add esp, 0xc
cmp byte [esi + 0x38], 0
je 0x406344
push str.___install_vs2008true
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
add esp, 0xc
cmp byte [esi + 0x39], 0
je 0x40635f
push str.___copy_winhttptrue
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
add esp, 0xc
xor edi, edi
cmp dword [ebp - 0x68], edi
je 0x406398
push dword [ebp - 0x68]
call fcn.00407660
pop ecx
test eax, eax
jbe 0x406398
push 0x418090
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
push dword [ebp - 0x68]
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.00406c0d
add esp, 0x18
push 0x3ff
lea eax, [ebp - 0x5f]
push edi
push eax
mov byte [ebp - 0x60], 0
call fcn.00406970
push dword [ebp - 0x80]
mov esi, 0x400
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.004073f2
push str.Installer.exe
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.00406c0d
add esp, 0x24
push 1
push 0x417cc6
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x60]
push eax
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp + 0xba0]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00406486
add ebp, 0xba4
leave
ret 4