Function at 0x4017fd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x476410]
sub esp, 0x15c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x40183e
mov eax, dword [0x476410]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0044585e
pop ecx
push eax
call fcn.004017bf
pop ecx
pop ecx
jmp 0x401b10
call fcn.0040157f
test eax, eax
je 0x401b10
xor eax, eax
push ebx
inc eax
xor ebx, ebx
cmp dword [0x47640c], eax
push edi
mov dword [ebp - 4], eax
jl 0x40194a
mov edi, 0x45eb50
mov esi, dword [ebp - 4]
mov eax, dword [0x476410]
push str._path
shl esi, 2
push dword [esi + eax]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x476410]
je 0x4018cd
push edi
push dword [esi + eax]
call fcn.0044587f
push edi
push ebx
call fcn.0044587f
mov ecx, dword [0x477638]
add esp, 0x10
mov esi, eax
add ecx, 0x8a44
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x4018a9
mov ecx, dword [0x477638]
mov edx, eax
add ecx, 0x91dd
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x4018c1
jmp 0x401932
push str._silent
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4018e8
mov byte [0x477635], 1
jmp 0x401932
mov eax, dword [0x476410]
push str._resume
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40190f
mov byte [0x477635], 1
mov byte [0x477636], 1
jmp 0x401932
mov eax, dword [0x476410]
push str._noui
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401932
mov eax, dword [0x477638]
mov byte [eax + 0xafaa], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x47640c]
jle 0x401866
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x103
lea eax, [ebp - 0x15b]
push ebx
push eax
mov byte [ebp - 0x15c], bl
call fcn.0044f6b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x15c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push str.resume.exe
push eax
call fcn.00401000
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401a9e
lea eax, [ebp - 0x15c]
push 0x45eb78
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x4019c4
push ebx
push ebx
push dword [0x477638]
push 0x15
call fcn.00404587
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45eb84
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x4019ef
push ebx
push ebx
push dword [0x477638]
push 0x16
call fcn.00404587
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45eb90
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a1a
push ebx
push ebx
push dword [0x477638]
push 0x17
call fcn.00404587
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45eb9c
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a45
push ebx
push ebx
push dword [0x477638]
push 0x18
call fcn.00404587
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop esi
push esi
mov edi, eax
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.0044f6b0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push str.install.exe__resume
push ebx
mov dword [ebp - 0x58], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401afe
mov eax, dword [0x476410]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x401abb
push dword [ebp + 8]
call fcn.0040116c
jmp 0x401afd
mov eax, dword [0x476410]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x401ae7
mov eax, dword [0x476410]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0044585e
pop ecx
push eax
call fcn.004017bf
jmp 0x401afc
mov eax, dword [0x477638]
movzx eax, byte [eax + 0xafaa]
push eax
push dword [ebp + 8]
call fcn.00401340
pop ecx
pop ecx
push ebx
push ebx
xor edi, edi
call fcn.0041c494
pop ecx
pop ecx
call fcn.004015de
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10