Function at 0x402420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4213ab
mov eax, dword fs:[0]
push eax
mov eax, 0x1124
call fcn.00421140
mov eax, dword [0x42f00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1054], edi
push 0x30c
lea eax, [ebp - 0x31c]
push eax
push 0x64
call fcn.00406b80
call fcn.00401b30
mov esi, dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x402491
lea ecx, [ebp - 0x31c]
call fcn.004030d0
mov ecx, eax
call fcn.00403a10
test eax, eax
je 0x4024f9
cmp dword [0x42f954], 6
jb 0x4024f9
call esi
test eax, eax
jne 0x4024f9
call fcn.00403910
test eax, eax
je 0x4024f9
cmp dword [edi + 0xe0], 0
je 0x4024ce
push str.Require_admin_privilege_for_deleting_AppInfo_in_Control_Panel_n
call fcn.00405090
add esp, 4
or ecx, 0xffffffff
call fcn.00404d60
xor eax, eax
jmp 0x402912
push 0x41
push 0x427b58
mov ecx, 0x15
call fcn.00403390
push eax
mov ecx, edi
call fcn.004063d0
cmp eax, 1
jne 0x4024f9
mov ecx, dword [edi + 0x54]
call fcn.00401130
jmp 0x402912
push dword [edi + 0xe0]
push ecx
mov ecx, 0xd
call fcn.00403390
mov ecx, dword [edi + 0x54]
mov edx, eax
call fcn.004011b0
add esp, 8
cmp eax, 1
je 0x4024c7
cmp eax, 2
jne 0x4025ab
cmp dword [edi + 0xe0], 0
je 0x40254a
push str.Cant_terminate_ipmsg_n
call fcn.00404fa0
add esp, 4
or ecx, 0xffffffff
call fcn.00404d60
xor eax, eax
jmp 0x402912
cmp dword [0x42f954], 6
jb 0x40258b
call esi
test eax, eax
jne 0x40258b
call fcn.00403910
test eax, eax
je 0x40258b
mov ecx, 0xf
push 0x41
push 0x427b58
call fcn.00403390
push eax
mov ecx, edi
call fcn.004063d0
cmp eax, 1
je 0x4024ec
xor eax, eax
jmp 0x402912
push 0
push str.UnInstall
mov ecx, 0xe
call fcn.00403390
push eax
mov ecx, edi
call fcn.004063d0
xor eax, eax
jmp 0x402912
cmp dword [edi + 0x74], 0
jne 0x4025dc
cmp dword [edi + 0xe0], 0
jne 0x402620
push 0x41
push str.UnInstall
mov ecx, 0x12
call fcn.00403390
push eax
mov ecx, edi
call fcn.004063d0
cmp eax, 1
jne 0x4024c7
cmp dword [edi + 0xe0], 0
jne 0x402620
push 0x480
mov ecx, edi
call fcn.00406380
test eax, eax
je 0x402620
call fcn.004022e0
test eax, eax
jne 0x402620
cmp dword [0x42f954], 6
jb 0x402620
call esi
test eax, eax
jne 0x402620
call fcn.00403910
test eax, eax
je 0x402620
mov ecx, 0x10
jmp 0x402567
call fcn.004020b0
push 0x30c
lea eax, [ebp - 0x934]
push 0
push eax
call fcn.0040d600
add esp, 0xc
call fcn.00402200
push ecx
push 0x80000001
lea ecx, [ebp - 0x10ec]
call fcn.00407eb0
sub esp, 0xc
mov dword [ebp - 4], 0
call fcn.00407f00
test eax, eax
je 0x4026e8
mov ecx, 0x13
call fcn.00403390
push ecx
mov esi, eax
lea ecx, [ebp - 0x10ec]
push esi
call fcn.00408060
test eax, eax
je 0x4026dc
push ecx
lea eax, [ebp - 0x628]
push eax
push str.LogFile
lea ecx, [ebp - 0x10ec]
call fcn.004082d0
test eax, eax
je 0x4026d1
push ecx
lea edx, [ebp - 0x934]
lea ecx, [ebp - 0x628]
call fcn.00403ed0
add esp, 4
lea ecx, [ebp - 0x934]
call fcn.00402c40
cmp eax, 0xffffffff
je 0x4026ca
test al, 0x10
jne 0x4026d1
mov byte [ebp - 0x934], 0
lea ecx, [ebp - 0x10ec]
call fcn.00408180
push esi
lea ecx, [ebp - 0x10ec]
call fcn.00408550
mov eax, dword [str.IPMsg.exe]
xor esi, esi
test eax, eax
je 0x402722
push ecx
push eax
lea edx, [ebp - 0x31c]
lea ecx, [ebp - 0x628]
call fcn.004045d0
add esp, 8
lea ecx, [ebp - 0x628]
call fcn.00402ab0
lea esi, [esi + 1]
mov eax, dword [esi*4 + 0x428280]
test eax, eax
jne 0x4026f3
lea ecx, [ebp - 0x31c]
call fcn.00401f40
neg eax
sbb eax, eax
lea ecx, [eax + 0xc]
call fcn.00403690
cmp dword [edi + 0xe0], 0
jne 0x402751
push 0
push 0x427fc8
push eax
mov ecx, edi
call fcn.00406c90
push ecx
lea edx, [ebp - 0x1050]
lea ecx, [ebp - 0x31c]
call fcn.00403ed0
add esp, 4
lea ecx, [ebp - 0x1050]
call fcn.00402d20
lea ecx, [ebp - 0x31c]
call fcn.00401f40
test eax, eax
je 0x4028a1
push ecx
push 0x104
lea edx, [ebp - 0xb3c]
lea ecx, [ebp - 0x31c]
call fcn.00402ea0
add esp, 4
lea edx, [ebp - 0xb3c]
lea ecx, [ebp - 0xd44]
push str.uninst.bat
call fcn.00404630
lea eax, [ebp - 0xd44]
push 0x427fe8
push eax
call fcn.00413355
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4028d7
mov edi, 0xa
jmp 0x4027e0
push 0x427fec
push esi
call fcn.00401740
lea eax, [ebp - 0xb3c]
push eax
push str.rd__s__q___s__n
push esi
call fcn.00401740
add esp, 0x14
sub edi, 1
jne 0x4027e0
push esi
call fcn.00412120
push 0x40
lea eax, [ebp - 0x112c]
mov dword [ebp - 0x1130], 0x44
push edi
push eax
call fcn.0040d600
xor eax, eax
mov dword [ebp - 0x1064], eax
mov dword [ebp - 0x1060], eax
mov dword [ebp - 0x105c], eax
mov dword [ebp - 0x1058], eax
lea eax, [ebp - 0xd44]
push eax
lea eax, [ebp - 0x524]
push str.cmd.exe__c___s_
push eax
call fcn.00401080
add esp, 0x1c
lea eax, [ebp - 0x1064]
push eax
lea eax, [ebp - 0x1130]
push eax
push edi
push edi
push 0x8000000
push edi
push edi
push edi
lea eax, [ebp - 0x524]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, dword [ebp - 0x1054]
test eax, eax
je 0x4028d7
push dword [ebp - 0x1060]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1064]
call esi
jmp 0x4028d7
cmp dword [edi + 0xe0], 0
je 0x4028c5
lea ecx, [ebp - 0x31c]
call fcn.004030d0
push eax
push str._s_cant_remove_n
call fcn.004051b0
add esp, 8
jmp 0x4028d7
sub esp, 0xc
lea eax, [ebp - 0x31c]
push eax
call fcn.00402c80
add esp, 0x10
cmp byte [ebp - 0x934], 0
je 0x4028fb
cmp dword [edi + 0xe0], 0
jne 0x4028fb
sub esp, 0xc
lea eax, [ebp - 0x934]
push eax
call fcn.00402c80
add esp, 0x10
xor ecx, ecx
call fcn.00404d60
lea ecx, [ebp - 0x10ec]
call fcn.00407ee0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040bac1
mov esp, ebp
pop ebp
ret