Function at 0x40182e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x474c50]
sub esp, 0x15c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x40186f
mov eax, dword [0x474c50]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0044407e
pop ecx
push eax
call fcn.004017f0
pop ecx
pop ecx
jmp 0x401b41
call fcn.004015b0
test eax, eax
je 0x401b41
xor eax, eax
push ebx
inc eax
xor ebx, ebx
cmp dword [0x474c4c], eax
push edi
mov dword [ebp - 4], eax
jl 0x40197b
mov edi, 0x45cb50
mov esi, dword [ebp - 4]
mov eax, dword [0x474c50]
push str._path
shl esi, 2
push dword [esi + eax]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x474c50]
je 0x4018fe
push edi
push dword [esi + eax]
call fcn.0044409f
push edi
push ebx
call fcn.0044409f
mov ecx, dword [0x475e78]
add esp, 0x10
mov esi, eax
add ecx, 0x8a5c
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x4018da
mov ecx, dword [0x475e78]
mov edx, eax
add ecx, 0x91f5
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x4018f2
jmp 0x401963
push str._silent
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401919
mov byte [0x475e75], 1
jmp 0x401963
mov eax, dword [0x474c50]
push str._resume
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401940
mov byte [0x475e75], 1
mov byte [0x475e76], 1
jmp 0x401963
mov eax, dword [0x474c50]
push str._noui
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401963
mov eax, dword [0x475e78]
mov byte [eax + 0xb7c2], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x474c4c]
jle 0x401897
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x103
lea eax, [ebp - 0x15b]
push ebx
push eax
mov byte [ebp - 0x15c], bl
call fcn.0044ded0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x15c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push str.resume.exe
push eax
call fcn.00401000
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401acf
lea eax, [ebp - 0x15c]
push 0x45cb78
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x4019f5
push ebx
push ebx
push dword [0x475e78]
push 0x15
call fcn.004049d1
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45cb84
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a20
push ebx
push ebx
push dword [0x475e78]
push 0x16
call fcn.004049d1
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45cb90
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a4b
push ebx
push ebx
push dword [0x475e78]
push 0x17
call fcn.004049d1
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x45cb9c
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a76
push ebx
push ebx
push dword [0x475e78]
push 0x18
call fcn.004049d1
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop esi
push esi
mov edi, eax
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.0044ded0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push str.install.exe__resume
push ebx
mov dword [ebp - 0x58], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401b2f
mov eax, dword [0x474c50]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x401aec
push dword [ebp + 8]
call fcn.00401160
jmp 0x401b2e
mov eax, dword [0x474c50]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x401b18
mov eax, dword [0x474c50]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0044407e
pop ecx
push eax
call fcn.004017f0
jmp 0x401b2d
mov eax, dword [0x475e78]
movzx eax, byte [eax + 0xb7c2]
push eax
push dword [ebp + 8]
call fcn.00401350
pop ecx
pop ecx
push ebx
push ebx
xor edi, edi
call fcn.0041a616
pop ecx
pop ecx
call fcn.0040160f
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10