Function at 0x402e60
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
sub esp, 0x704
push ebx
push esi
mov esi, dword [esp + 0x718]
push edi
push ebp
cmp byte [esi], 0
je 0x4032f5
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x408eb0
call ebx
push 0x408eb0
call fcn.004022d0
add esp, 4
test eax, eax
jne 0x402eb2
push 0x10
push str.EXIT
push str.Not_Found_UNINST.INI
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403375
push 0x408eb0
push 0x408fb8
call ebx
push 0x408fb8
call fcn.00402260
mov edi, dword [esp + 0x71c]
add esp, 4
mov byte [0x408da8], 0
push 0x408eb0
mov dword [0x407148], edi
push 0x104
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x408da8
push 0x40706c
push str.RESOURCE
push str.CONTROL
call ebp
test eax, eax
je 0x402f23
push 0x408da8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x407148], eax
test eax, eax
jne 0x402f23
mov dword [0x407148], edi
mov byte [0x408ca0], 0
push 0x408eb0
push 0x104
push 0x408ca0
push 0x40706c
push str.PLUGINS
push str.CONTROL
call ebp
test eax, eax
je 0x402f5b
push 0x408ca0
call fcn.00401ed0
add esp, 4
push 0x408eb0
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 0
push str.RESTART
push str.CONTROL
call ebp
push 0x408eb0
mov dword [0x40714c], eax
push 0
push str.HIDE
push str.CONTROL
call ebp
push 0x408eb0
mov dword [0x407158], eax
push 0
push str.AllUser
push str.CONTROL
call ebp
mov dword [0x40715c], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
cmp dword [0x40715c], 0
je 0x403014
push 0
call fcn.00402c20
add esp, 4
test eax, eax
jne 0x403014
lea eax, [esp + 0x410]
push 0x104
push eax
mov ecx, dword [0x407148]
push 1
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push ecx
call esi
lea ecx, [esp + 0x10]
push 0x200
push ecx
mov eax, dword [0x407148]
push 2
push eax
call esi
lea ecx, [esp + 0x410]
push 0x10
lea edx, [esp + 0x14]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403375
push 0x104
push 0x407160
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
push 0x407268
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x407370
push 0
call fcn.00402820
add esp, 8
push 0x407478
push 0
call fcn.00402890
add esp, 8
push 0x407580
push 0
call fcn.00402900
add esp, 8
push 0x407688
push 0
call fcn.00402970
add esp, 8
push 0x407790
push 0
call fcn.00402b30
add esp, 8
call fcn.004011c0
test eax, eax
jne 0x4030b3
cmp byte [0x408ca0], 0
je 0x403096
call fcn.00401f20
cmp edi, dword [0x407148]
je 0x403375
mov eax, dword [0x407148]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x403375
call fcn.00401f60
call fcn.00401a00
call fcn.00401fc0
call fcn.00401bd0
cmp byte [0x408ca0], 0
je 0x4030e2
call fcn.00401f20
push 0x408ca0
call fcn.00401fe0
add esp, 4
cmp byte [0x408da8], 0
je 0x40310e
cmp edi, dword [0x407148]
je 0x403101
mov eax, dword [0x407148]
mov ebp, dword [sym.imp.KERNEL32.dll_FreeLibrary]
push eax
call ebp
push 0x408da8
call fcn.00401fe0
add esp, 4
call fcn.00401d10
push 0x408eb0
call fcn.00401fe0
add esp, 4
push 0x408fb8
call fcn.004025f0
add esp, 4
cmp byte [esi], 0
jne 0x4032eb
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0x80000000
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x403208
lea eax, [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push eax
push 0x200
call ebp
lea ecx, [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ecx
call ebp
mov al, byte [esp + eax + 0xf]
cmp al, 0x5c
je 0x40318f
cmp al, 0x2f
je 0x40318f
lea eax, [esp + 0x10]
push 0x40792c
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
jmp 0x403195
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x10]
push str.UNINSTALL.EXE
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x44d
push edi
call fcn.00402760
add esp, 0xc
test eax, eax
jne 0x403247
lea eax, [esp + 0x10]
push 0x407160
push eax
call ebx
lea eax, [esp + 0x10]
push eax
call ebp
mov al, byte [esp + eax + 0xf]
cmp al, 0x5c
je 0x4031e7
cmp al, 0x2f
je 0x4031e7
lea eax, [esp + 0x10]
push 0x40792c
push eax
call esi
lea eax, [esp + 0x10]
push str.UNINSTALL.EXE
push eax
call esi
lea eax, [esp + 0x10]
push eax
push 0x44d
push edi
call fcn.00402760
add esp, 0xc
jmp 0x40323f
lea eax, [esp + 0x10]
push 0x408fb8
push eax
call ebx
lea eax, [esp + 0x10]
push str.UNINST16.EXE
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x44c
push edi
call fcn.00402760
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4032eb
lea eax, [esp + 0x514]
push 0x200
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x210]
push 0x200
lea eax, [esp + 0x518]
push ecx
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
call edi
lea ecx, [esp + 0x210]
push 0x4079e0
push ecx
call esi
lea eax, [esp + 0x514]
push 0x200
push eax
push 0x408fb8
call edi
lea eax, [esp + 0x210]
push 0x408fb8
push eax
call esi
lea eax, [esp + 0x210]
push eax
call ebp
lea eax, [esp + eax + 0x20f]
cmp byte [eax], 0x5c
jne 0x4032c3
mov byte [eax], 0
lea eax, [esp + 0x10]
push 0x4079cc
push eax
call esi
lea eax, [esp + 0x210]
lea ecx, [esp + 0x10]
push eax
push ecx
call esi
lea ecx, [esp + 0x10]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
jmp 0x403377
push 0x104
push 0x408fb8
call fcn.00402290
add esp, 8
push 0x104
push 0x408eb0
call fcn.00402290
add esp, 8
push str.UNINST.INI
push 0x408eb0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x408eb0
call fcn.004022d0
add esp, 4
test eax, eax
jne 0x403350
push 0x10
push str.EXIT
push str.Not_Found_UNINST.INI
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x403375
push 0x104
push 0x407160
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, dword [esp + 0x718]
push 0x408eb0
push edi
call fcn.00402d20
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x704
ret 0x10