Function at 0x46be41
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4993d4]
sub esp, 0x268
push str._cleanup
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x46be7f
mov eax, dword [0x4993d4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00438256
pop ecx
push eax
call fcn.0046b7e5
pop ecx
pop ecx
jmp 0x46c13b
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call fcn.0046b9af
test eax, eax
je 0x46c13a
xor eax, eax
inc eax
push esi
push edi
mov dword [ebp - 8], eax
cmp dword [0x4993d0], eax
jle 0x46bfb2
mov dword [ebp - 4], 2
mov edi, 0x47765c
mov eax, dword [0x4993d4]
mov esi, dword [ebp - 8]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x4993d4]
je 0x46bf19
push edi
push dword [eax + esi*4]
call fcn.00438943
push edi
push ebx
call fcn.00438943
mov ecx, dword [0x49a8cc]
add esp, 0x10
mov esi, eax
add ecx, 0xa95e
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x46bef2
mov ecx, dword [0x49a8cc]
mov edx, eax
add ecx, 0xb0f7
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x46bf0a
jmp 0x46bf9d
push str._silent
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x46bf34
mov byte [0x49a8ca], 1
jmp 0x46bf9d
mov eax, dword [0x4993d4]
push str._resume
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x46bf7a
mov eax, dword [ebp - 4]
mov byte [0x49a8ca], 1
mov byte [0x49a8cb], 1
cmp eax, dword [0x4993d0]
jge 0x46bf9d
inc dword [ebp - 8]
mov eax, dword [0x4993d4]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + ecx*4]
inc dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x46bf9d
mov eax, dword [0x4993d4]
push str._noui
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x46bf9d
mov eax, dword [0x49a8cc]
mov byte [eax + 0xd7c3], 1
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
inc dword [ebp - 4]
cmp eax, dword [0x4993d0]
jl 0x46beb2
mov esi, 0x103
push esi
lea eax, [ebp - 0x267]
push ebx
push eax
mov byte [ebp - 0x268], bl
call fcn.0043cdc0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x268]
push eax
call fcn.0046b7ca
mov dword [esp], str.resume.exe
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x46c0bf
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0043cdc0
push esi
lea eax, [ebp - 0x163]
push ebx
push eax
mov dword [ebp - 0x60], edi
mov byte [ebp - 0x164], bl
call fcn.0043cdc0
lea edi, [ebp - 0x164]
add esp, 0x18
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x46c04c
mov eax, dword [ebp - 4]
push 5
pop ecx
mov esi, str.install.exe__resume
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x46c064
lea edi, [ebp - 0x164]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x46c074
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46c128
mov eax, dword [0x4993d4]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x46c0e2
push dword [ebp + 8]
call fcn.0046bccc
jmp 0x46c127
mov eax, dword [0x4993d4]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x46c10e
mov eax, dword [0x4993d4]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00438256
pop ecx
push eax
call fcn.0046b7e5
jmp 0x46c126
mov eax, dword [0x49a8cc]
movzx eax, byte [eax + 0xd7c3]
mov ecx, dword [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.0046ba14
pop ecx
pop ecx
push ebx
xor ebx, ebx
xor eax, eax
call fcn.0046f1ee
pop ecx
call fcn.0046b823
pop edi
pop esi
pop ebx
xor eax, eax
leave
ret 0x10