Function at 0x41ff70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ac660
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4e006c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [ebp + 0x1c], 0
jne 0x420313
mov eax, dword [ebp + 0xc]
cmp eax, 0x110
jne 0x41ffcd
sub esp, 0x10
call fcn.00420920
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x138
jne 0x420017
mov eax, dword [ebp + 0x14]
cmp eax, dword [esi + 0x104]
je 0x41ffe7
cmp eax, dword [esi + 0x108]
jne 0x41fff5
push 0x191514
push dword [ebp + 0x10]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [ebp + 0x18]
mov ecx, dword [esi + 0x1ac]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x2b
jne 0x420072
movzx eax, word [ebp + 0x10]
sub eax, 0x5e0
je 0x420041
sub eax, 1
je 0x420039
sub eax, 5
jne 0x420052
lea ecx, [esi + 0x13c]
jmp 0x420044
lea ecx, [esi + 0x98]
jmp 0x420044
lea ecx, [esi + 0x5c]
push dword [esi + 0x1ac]
push dword [ebp + 0x14]
call fcn.00424a00
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x14
jne 0x42009b
sub esp, 0x10
call fcn.00421170
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x4e
jne 0x42011b
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx + 8]
cmp eax, 0xfffffffe
je 0x4200b0
cmp eax, 0xfffffffc
jne 0x4200fb
mov eax, dword [ecx]
cmp eax, dword [esi + 0x58]
jne 0x4200fb
mov ecx, dword [esi + 0x19c]
sub ecx, 0x10
call fcn.00403d80
push 1
push 0
push 0
lea esi, [eax + 0x10]
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esi, 0xfffffff0
mov dword [ebp - 4], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4200fb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x18
jne 0x4201ae
push 0x10
push str.Install_Progress
mov ecx, 0x4e5a8c
call fcn.004033b0
cmp dword [ebp + 0x10], 0
je 0x420180
mov eax, dword [0x4e5bc4]
test eax, eax
jne 0x420152
push 0x5e0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push eax
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
mov dword [0x4e5bc4], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x113
jne 0x4201dd
sub esp, 8
push dword [ebp + 0x10]
push ecx
call fcn.004213b0
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp eax, 0x111
jne 0x420313
movzx eax, word [ebp + 0x10]
mov ecx, 0x5e0
cmp cx, ax
jne 0x420263
add dword [esi + 0x1c4], 0xffffffff
mov eax, dword [esi + 0x1c4]
jns 0x420214
mov dword [esi + 0x1c4], 2
mov eax, 2
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.004252c0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e1
cmp cx, ax
jne 0x4202d9
inc dword [esi + 0x1c4]
mov eax, dword [esi + 0x1c4]
cmp eax, 2
jle 0x42028a
mov dword [esi + 0x1c4], 0
xor eax, eax
push dword [esi + 0x1ac]
lea ecx, [esi + 0x178]
push eax
call fcn.004252c0
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_KillTimer]
push 0
push 0x1b58
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 0x5e6
cmp cx, ax
jne 0x420309
sub esp, 0x10
mov ecx, esi
call fcn.00421d00
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
mov ecx, 2
cmp cx, ax
je 0x4202e3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18