Function at 0x418645
Capabilities:
Accept command line arguments
Create process on windows
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push ebx
push esi
push edi
mov esi, ecx
push dword [0x4824f0]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x4829d4
mov ecx, esi
call fcn.0041d46a
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
mov byte [ebp - 0x198], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x198]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x198]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0041eb20
push 1
push ebx
push 0x42fb7c
lea ecx, [ebp - 0x1c]
call fcn.0041f507
cmp eax, 0xffffffff
je 0x4186cb
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
dec ecx
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041f0d5
push 0x44
lea eax, [ebp - 0x94]
pop esi
push esi
push ebx
push eax
call fcn.00427c50
push 0x10
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x94], esi
call fcn.00427c50
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.0041eab0
mov ecx, 0x4829d4
call fcn.0041fa6a
push eax
lea eax, [ebp - 0x10]
push 0x4300d4
push eax
call fcn.0041f193
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0x22
jne 0x418741
lea edi, [esi + 1]
push 0x22
push edi
call fcn.00428000
pop ecx
test eax, eax
pop ecx
je 0x418741
push ebx
push 0x22
push edi
call fcn.00428000
pop ecx
inc eax
pop ecx
jmp 0x41875b
push 0x20
push esi
call fcn.00428000
pop ecx
test eax, eax
pop ecx
je 0x418764
push ebx
inc esi
push 0x20
push esi
call fcn.00428000
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041ed73
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0041fa6a
push eax
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041fa6a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4187b7
cmp byte [0x483654], bl
jne 0x4188bc
push ebx
push str.Failed_to_launch_installer.__CreateProcess_failed_
push ebx
mov ecx, 0x482320
call fcn.0041df67
jmp 0x4188bc
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x4829f8], ebx
jle 0x4187f6
push esi
mov ecx, 0x4829ec
call fcn.00421b62
mov ecx, eax
call fcn.0041fa6a
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc esi
cmp esi, dword [0x4829f8]
jl 0x4187d4
mov edi, 0x4829e0
lea ecx, [ebp - 0x40]
push edi
call fcn.0041eb84
push ebx
push str.installer
lea ecx, [ebp - 0x40]
call fcn.0041ed73
lea ecx, [ebp - 0x40]
call fcn.0041fa6a
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call esi
push edi
lea ecx, [ebp - 0x28]
call fcn.0041eb84
push ebx
push str._slideshow
lea ecx, [ebp - 0x28]
call fcn.0041ed73
lea ecx, [ebp - 0x28]
call fcn.0041fa6a
push eax
call esi
push edi
lea ecx, [ebp - 0x34]
call fcn.0041eb84
push ebx
push str.3rd_party
lea ecx, [ebp - 0x34]
call fcn.0041ed73
lea ecx, [ebp - 0x34]
call fcn.0041fa6a
push eax
call esi
mov ecx, 0x4829e0
call fcn.0041fa6a
push eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
setne al
cmp byte [0x4836ad], bl
je 0x4188a2
cmp al, bl
sete bl
jmp 0x4188a4
mov bl, al
lea ecx, [ebp - 0x34]
call fcn.0041ebe6
lea ecx, [ebp - 0x28]
call fcn.0041ebe6
lea ecx, [ebp - 0x40]
call fcn.0041ebe6
lea ecx, [ebp - 0x10]
call fcn.0041ebe6
lea ecx, [ebp - 0x1c]
call fcn.0041ebe6
pop edi
mov al, bl
pop esi
pop ebx
leave
ret