Function at 0x4303d0
Capabilities:
Check if file exists
Create process on windows
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d3231
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x64c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x430558
push str.RunAfterDownload
call fcn.0040ff00
push eax
call fcn.00410290
mov eax, dword [edi + 0x18]
add esp, 8
cmp dword [eax - 0xc], 0
je 0x430531
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430531
test al, 0x10
jne 0x430531
mov ecx, dword [edi + 0x18]
mov edx, 0x6381a4
push 0
push 0
push 0xffffffffffffffff
call fcn.0044b760
add esp, 0xc
push eax
push str.Run_installer_bRet:_d
call fcn.0040ff00
push eax
call fcn.00410290
add esp, 0xc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [edi + 0x18]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push str.exe_param
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.0040f190
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
call fcn.0042fd10
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.004324c0
push 5
push 0
push dword [ebp + 8]
push dword [eax]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, dword [ebp - 0x14]
or esi, 0xffffffff
mov edi, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4304de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
cmp edi, 0x20
setg al
push eax
push str.Run_exe_bRet:_d
call fcn.0040ff00
push eax
call fcn.00410290
mov dword [ebp - 4], 0xffffffff
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x4306fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.RunAfterDownload_file_empty
call fcn.0040ff00
push eax
call fcn.00410290
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
test eax, eax
jne 0x4306fa
push str.pre_download
call fcn.0040efd0
test eax, eax
jne 0x4306fa
call fcn.00432920
test eax, eax
jne 0x430599
call fcn.00451de0
call fcn.00451de0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x2c]
call fcn.00416500
mov esi, eax
mov dword [ebp - 4], 1
mov ecx, dword fs:[0x2c]
mov ebx, dword [ecx]
mov ecx, dword [0x65cc38]
cmp ecx, dword [ebx + 4]
jle 0x4305fe
push 0x65cc38
call fcn.00483c2d
add esp, 4
cmp dword [0x65cc38], 0xffffffff
jne 0x4305fe
mov byte [ebp - 4], 2
call fcn.00414990
push 0x5d7c10
call fcn.00484084
add esp, 4
mov byte [ebp - 4], 1
push 0x65cc38
call fcn.00483be3
add esp, 4
push dword [esi + 0xc]
mov ecx, 0x65cc40
push dword [esi + 8]
call fcn.004125b0
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004327d0
push 0
push str.exe_param
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0040f190
mov esi, eax
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 3
push eax
mov ecx, edi
call fcn.004324c0
push 0
mov byte [ebp - 4], 4
mov edx, dword [esi]
mov ecx, dword [eax]
push 1
push 0
call fcn.0044b760
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp + 8], eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x43067c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x43069b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 8], 0
je 0x4306b1
push 0
push 5
call fcn.00451de0
mov ecx, eax
call fcn.004523f0
mov ecx, edi
call fcn.00430ad0
mov eax, dword [0x65ccf8]
cmp eax, dword [ebx + 4]
jle 0x4306f5
push 0x65ccf8
call fcn.00483c2d
add esp, 4
cmp dword [0x65ccf8], 0xffffffff
jne 0x4306f5
push 0x5d7ea0
call fcn.00484084
add esp, 4
push 0x65ccf8
call fcn.00483be3
add esp, 4
call fcn.0044fd90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4