Function at 0x464a38
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x48cd14]
sub esp, 0x274
push ebx
push esi
push edi
push str._cleanup
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464a7c
mov eax, dword [0x48cd14]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436b21
pop ecx
push eax
call fcn.00464424
pop ecx
pop ecx
jmp 0x464d47
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.004645c2
test eax, eax
je 0x464d47
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
cmp dword [0x48cd10], eax
jle 0x464bb8
mov dword [esp + 0xc], 2
mov edi, 0x46ea78
mov eax, dword [0x48cd14]
mov esi, dword [esp + 0x10]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x48cd14]
je 0x464b17
push edi
push dword [eax + esi*4]
call fcn.00437166
push edi
push ebx
call fcn.00437166
mov ecx, dword [0x48e8ec]
add esp, 0x10
mov esi, eax
add ecx, 0x9d5c
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x464af0
mov ecx, dword [0x48e8ec]
mov edx, eax
add ecx, 0xa4f5
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x464b08
jmp 0x464ba0
push str._silent
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464b32
mov byte [0x48e8e9], 1
jmp 0x464ba0
mov eax, dword [0x48cd14]
push str._resume
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464b7d
mov eax, dword [esp + 0xc]
mov byte [0x48e8e9], 1
mov byte [0x48e8ea], 1
cmp eax, dword [0x48cd10]
jge 0x464ba0
inc dword [esp + 0x10]
mov eax, dword [0x48cd14]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + ecx*4]
inc dword [esp + 0xc]
mov dword [esp + 0x14], eax
jmp 0x464ba0
mov eax, dword [0x48cd14]
push str._noui
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464ba0
mov eax, dword [0x48e8ec]
mov byte [eax + 0xcbc1], 1
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
inc dword [esp + 0xc]
cmp eax, dword [0x48cd10]
jl 0x464aaf
mov esi, 0x103
push esi
lea eax, [esp + 0x17d]
push ebx
push eax
mov byte [esp + 0x184], bl
call fcn.0043b5d0
add esp, 0xc
push 0x104
lea eax, [esp + 0x17c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x178]
push eax
call fcn.00464409
mov dword [esp], str.resume.exe
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x464ccd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.0043b5d0
add esp, 0xc
push esi
lea eax, [esp + 0x75]
push ebx
push eax
mov dword [esp + 0x34], edi
mov byte [esp + 0x7c], bl
call fcn.0043b5d0
lea edi, [esp + 0x7c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x464c57
mov eax, dword [esp + 0xc]
push 5
pop ecx
mov esi, str.install.exe__resume
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x464c70
lea edi, [esp + 0x70]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x464c7e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464d37
mov eax, dword [0x48cd14]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x464cf0
push dword [ebp + 8]
call fcn.004648c3
jmp 0x464d36
mov eax, dword [0x48cd14]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x464d1c
mov eax, dword [0x48cd14]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436b21
pop ecx
push eax
call fcn.00464424
jmp 0x464d35
mov eax, dword [0x48e8ec]
movzx eax, byte [eax + 0xcbc1]
mov ecx, dword [esp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00464620
pop ecx
pop ecx
push ebx
xor ebx, ebx
xor eax, eax
call fcn.0044e371
pop ecx
call fcn.00464462
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10