Function at 0x465f7b
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x48f354]
sub esp, 0x268
push str._cleanup
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x465fb9
mov eax, dword [0x48f354]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436201
pop ecx
push eax
call fcn.0046594e
pop ecx
pop ecx
jmp 0x466275
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
call fcn.00465aee
test eax, eax
je 0x466274
xor eax, eax
inc eax
push esi
push edi
mov dword [ebp - 8], eax
cmp dword [0x48f350], eax
jle 0x4660ec
mov dword [ebp - 4], 2
mov edi, 0x46fa78
mov eax, dword [0x48f354]
mov esi, dword [ebp - 8]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x48f354]
je 0x466053
push edi
push dword [eax + esi*4]
call fcn.00436846
push edi
push ebx
call fcn.00436846
mov ecx, dword [0x490f2c]
add esp, 0x10
mov esi, eax
add ecx, 0xa75c
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x46602c
mov ecx, dword [0x490f2c]
mov edx, eax
add ecx, 0xaef5
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x466044
jmp 0x4660d7
push str._silent
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x46606e
mov byte [0x490f29], 1
jmp 0x4660d7
mov eax, dword [0x48f354]
push str._resume
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4660b4
mov eax, dword [ebp - 4]
mov byte [0x490f29], 1
mov byte [0x490f2a], 1
cmp eax, dword [0x48f350]
jge 0x4660d7
inc dword [ebp - 8]
mov eax, dword [0x48f354]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + ecx*4]
inc dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x4660d7
mov eax, dword [0x48f354]
push str._noui
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4660d7
mov eax, dword [0x490f2c]
mov byte [eax + 0xd5c1], 1
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
inc dword [ebp - 4]
cmp eax, dword [0x48f350]
jl 0x465fec
mov esi, 0x103
push esi
lea eax, [ebp - 0x267]
push ebx
push eax
mov byte [ebp - 0x268], bl
call fcn.0043afd0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x268]
push eax
call fcn.00465933
mov dword [esp], str.resume.exe
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x4661f9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call fcn.0043afd0
push esi
lea eax, [ebp - 0x163]
push ebx
push eax
mov dword [ebp - 0x60], edi
mov byte [ebp - 0x164], bl
call fcn.0043afd0
lea edi, [ebp - 0x164]
add esp, 0x18
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x466186
mov eax, dword [ebp - 4]
push 5
pop ecx
mov esi, str.install.exe__resume
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x46619e
lea edi, [ebp - 0x164]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x4661ae
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x164]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x466262
mov eax, dword [0x48f354]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x46621c
push dword [ebp + 8]
call fcn.00465e06
jmp 0x466261
mov eax, dword [0x48f354]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x466248
mov eax, dword [0x48f354]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436201
pop ecx
push eax
call fcn.0046594e
jmp 0x466260
mov eax, dword [0x490f2c]
movzx eax, byte [eax + 0xd5c1]
mov ecx, dword [ebp - 0xc]
push eax
push dword [ebp + 8]
call fcn.00465b4e
pop ecx
pop ecx
push ebx
xor ebx, ebx
xor eax, eax
call fcn.0044dd99
pop ecx
call fcn.0046598c
pop edi
pop esi
pop ebx
xor eax, eax
leave
ret 0x10