Function at 0x403910
Capabilities:
Create process on windows
Delete file
Enumerate processes
Hide graphical window
Print debug messages
Terminate process
Terminate process by name

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
push str.Begin_Install
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1388
call ebx
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esp + 0x14], 0
push 0
push 0
push 0
push str.C:Program_Files_rw_b102_10001359.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x10], 0
push 0x434a18
push 0x434a08
call edi
mov esi, eax
push 0
push esi
call ebp
push 0xc8
call ebx
test esi, esi
je 0x403988
cmp dword [esp + 0x10], 5
jge 0x403996
mov eax, dword [esp + 0x10]
inc eax
cmp eax, 0xa
mov dword [esp + 0x10], eax
jl 0x403963
push 0x434a18
push 0x434a08
call edi
mov esi, eax
test esi, esi
jne 0x4039ce
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 5
mov dword [esp + 0x14], eax
jl 0x403943
push str.RW:
push str.report
call fcn.00401830
add esp, 8
push esi
call fcn.0040d11f
push 0x1f4
call ebx
push 0
push esi
call ebp
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0x4349dc
push str.Button
push 0
push esi
mov dword [esp + 0x24], 0
call edi
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349bc
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349b4
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349a4
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x403b5a
mov eax, dword [esp + 0x14]
cmp eax, 1
jge 0x403bc6
mov ecx, eax
push 0x4349dc
push str.Button
inc ecx
push 0
push esi
mov dword [esp + 0x24], ecx
call edi
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349bc
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349b4
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
call ebx
push 0
push esi
call ebp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4349a4
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x403a9a
push 0
push esi
call ebp
mov dword [esp + 0x14], 0
push 0x434994
push str.Button
push 0
push esi
call edi
push 0
push 0xd
push 0x100
push eax
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x403bae
push 0
push esi
call ebp
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
inc eax
cmp eax, 0x3e8
mov dword [esp + 0x14], eax
jl 0x403b67
push str.C:Program_Files_rwuninst.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x434940
push str.report
call fcn.00401830
add esp, 8
push 0
call fcn.0040d11f
nop