Function at 0x4160a0
Capabilities:
Create process on windows
Create process suspended
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1538
call fcn.0042d250
mov eax, dword [0x438374]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1538], ecx
push 0
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0xf4]
push ecx
call fcn.00415ec0
add esp, 0xc
lea ecx, [ebp - 0xfc]
call fcn.00401920
mov edx, dword [ebp - 0xf4]
and edx, 0xffff
movzx eax, dx
push eax
mov ecx, dword [ebp - 0xf4]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push str._d._d
lea eax, [ebp - 0xfc]
push eax
call fcn.004103c0
add esp, 0x10
mov ecx, dword [0x430f1c]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x430f20]
mov dword [ebp - 0x10], edx
mov eax, dword [0x430f24]
mov dword [ebp - 0xc], eax
mov ecx, dword [0x430f28]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x14]
push edx
push str.70D33259_C73B_439B_B7CF_94E1AA23038C
lea ecx, [ebp - 0x1534]
call fcn.004189a0
mov ecx, eax
call fcn.0040f230
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea ecx, [ebp - 0x1534]
call fcn.004189d0
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_void___thiscall_CLiveUpdate::constructor_void_]
sub esp, 0x10
mov eax, esp
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
mov dword [eax + 0xc], edx
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_void___thiscall_CLiveUpdate::SetProduct_struct__GUID_]
mov eax, dword [ebp - 0x1538]
mov ecx, dword [eax + 4]
push ecx
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_void___thiscall_CLiveUpdate::SetNotifyWindow_struct_HWND____]
lea ecx, [ebp - 0xfc]
call fcn.0040f230
push eax
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_int___thiscall_CLiveUpdate::IsNewVersionAvailable_wchar_t_const__]
test eax, eax
je 0x416371
xor edx, edx
mov word [ebp - 0x1c8], dx
push 0xc6
push 0
lea eax, [ebp - 0x1c6]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x100], 0
lea ecx, [ebp - 0x100]
push ecx
lea edx, [ebp - 0x1c8]
push edx
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_void___thiscall_CLiveUpdate::GetUpdatesInfo_wchar_t___int__]
push str.The_latest_version_of_MyCam_is
lea ecx, [ebp - 0x1cc]
call fcn.00418580
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x1cc]
call fcn.00414db0
push str.__do_you_want_to_update_to_it_now_
lea ecx, [ebp - 0x1cc]
call fcn.00414db0
push 0x24
push str.Live_Update
lea ecx, [ebp - 0x1cc]
call fcn.0040f230
push eax
mov ecx, dword [ebp - 0x1538]
add ecx, 4
call fcn.004180f0
cmp eax, 6
jne 0x416366
push 1
push 0
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_int___thiscall_CLiveUpdate::DownloadUpdates_wchar_t_const___int_]
push 0x44
push 0
lea ecx, [ebp - 0x1420]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x13f4], 0x80
xor edx, edx
mov word [ebp - 0x13d8], dx
push 0xffe
push 0
lea eax, [ebp - 0x13d6]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0x800
lea ecx, [ebp - 0x13d8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x13d8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov word [ebp - 0x3d8], ax
push 0x206
push 0
lea ecx, [ebp - 0x3d6]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
push 0
push 0x25
lea edx, [ebp - 0x3d8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str._rundll32.exe
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea ecx, [ebp - 0x1430]
push ecx
lea edx, [ebp - 0x1420]
push edx
lea eax, [ebp - 0x13d8]
push eax
push 0
push 0x20
push 0
push 0
push 0
push str._LiveUpdate.dll_LUInstallUpdates_70D33259_C73B_439B_B7CF_94E1AA23038C
lea ecx, [ebp - 0x3d8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x1538]
add ecx, 4
call fcn.00404540
lea ecx, [ebp - 0x1cc]
call fcn.00401a20
lea ecx, [ebp - 0xf0]
call dword [sym.imp.LiveUpdate.dll_public:_void___thiscall_CLiveUpdate::destructor_void_]
lea ecx, [ebp - 0xfc]
call fcn.00401a20
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042d238
mov esp, ebp
pop ebp
ret