Function at 0x401766
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46c390]
sub esp, 0x160
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x4017a7
mov eax, dword [0x46c390]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0043b3ee
pop ecx
push eax
call fcn.00401728
pop ecx
pop ecx
jmp 0x401a4a
call fcn.004014e8
test eax, eax
je 0x401a4a
xor eax, eax
push ebx
inc eax
xor ebx, ebx
cmp dword [0x46c38c], eax
push edi
mov dword [ebp - 4], eax
jl 0x401891
mov edi, 0x454b50
mov esi, dword [ebp - 4]
mov eax, dword [0x46c390]
push str._path
shl esi, 2
push dword [esi + eax]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401836
mov eax, dword [0x46c390]
push edi
push dword [esi + eax]
call fcn.0043b40f
push edi
push ebx
call fcn.0043b40f
mov ecx, dword [0x46d5b8]
add esp, 0x10
mov dword [ebp - 8], eax
add ecx, 0x8a44
mov dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x401813
mov ecx, dword [0x46d5b8]
mov edx, dword [ebp - 8]
add ecx, 0x91dd
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x40182c
mov eax, dword [0x46c390]
push str._silent
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401854
mov byte [0x46d5b5], 1
mov eax, dword [0x46c390]
push str._resume
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401879
mov byte [0x46d5b5], 1
mov byte [0x46d5b6], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x46c38c]
jle 0x4017cf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x103
lea eax, [ebp - 0x15f]
push ebx
push eax
mov byte [ebp - 0x160], bl
call fcn.004451c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x160]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x160]
push str.resume.exe
push eax
call fcn.00401000
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4019e5
lea eax, [ebp - 0x160]
push 0x454b70
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x40190b
push ebx
push ebx
push dword [0x46d5b8]
push 0x15
call fcn.0040441c
add esp, 0x10
lea eax, [ebp - 0x160]
push 0x454b7c
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401936
push ebx
push ebx
push dword [0x46d5b8]
push 0x16
call fcn.0040441c
add esp, 0x10
lea eax, [ebp - 0x160]
push 0x454b88
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401961
push ebx
push ebx
push dword [0x46d5b8]
push 0x17
call fcn.0040441c
add esp, 0x10
lea eax, [ebp - 0x160]
push 0x454b94
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x40198c
push ebx
push ebx
push dword [0x46d5b8]
push 0x18
call fcn.0040441c
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop esi
push esi
mov edi, eax
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.004451c0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push str.install.exe__resume
push ebx
mov dword [ebp - 0x5c], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401a38
mov eax, dword [0x46c390]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x401a02
push dword [ebp + 8]
call fcn.0040116c
jmp 0x401a37
mov eax, dword [0x46c390]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x401a2f
mov eax, dword [0x46c390]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0043b3ee
pop ecx
push eax
call fcn.00401728
pop ecx
jmp 0x401a37
push dword [ebp + 8]
call fcn.004012f7
pop ecx
push ebx
push ebx
xor edi, edi
call fcn.0041b97c
pop ecx
pop ecx
call fcn.00401547
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10