Function at 0x402e49
Capabilities:
Create process on windows
Hide graphical window
Resolve path using msvcrt
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [0x4742a0], eax
call fcn.00412aaa
mov dword [0x4742c0], eax
call sub.msvcrt.dll___p__pgmptr
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov ebx, eax
mov dword [esp + 4], 0x5c
mov dword [esp], eax
call sub.msvcrt.dll_strrchr
test eax, eax
je 0x402e97
mov byte [eax], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_SetCurrentDirectoryA
sub esp, 4
mov dword [esp + 4], 0x4602d7
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call fcn.0041512c
mov ebx, eax
cmp dword [eax], 0
je 0x40317d
mov eax, dword [ebx]
mov dword [esp + 4], str.__I_agree_to_the_terms_of_the_licence
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402ee4
mov dword [esp + 4], 1
mov dword [esp], str.LicenceAgreed
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 8], 6
mov dword [esp + 4], str.__dir
mov dword [esp], eax
call sub.msvcrt.dll__strnicmp
test eax, eax
jne 0x402f1c
mov eax, dword [ebx]
add eax, 6
mov dword [esp + 4], eax
mov dword [esp], 0x460313
call fcn.00403954
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 8], 9
mov dword [esp + 4], str.__serial
mov dword [esp], eax
call sub.msvcrt.dll__strnicmp
test eax, eax
jne 0x402f54
mov eax, dword [ebx]
add eax, 9
mov dword [esp + 4], eax
mov dword [esp], 0x460325
call fcn.00403954
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__subinstall
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402f83
mov dword [esp + 4], 1
mov dword [esp], str.SubInstall
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__activate
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402fc6
mov dword [esp + 4], 1
mov dword [esp], 0x460351
call fcn.00403c52
mov dword [esp + 4], 1
mov dword [esp], 0x46035a
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__remove
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x402ff5
mov dword [esp + 4], 1
mov dword [esp], 0x46036a
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__remove_silently
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x403038
mov dword [esp + 4], 1
mov dword [esp], 0x46036a
call fcn.00403c52
mov dword [esp + 4], 1
mov dword [esp], 0x460031
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__expired
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x403067
mov dword [esp + 4], 1
mov dword [esp], 0x46006d
call fcn.00403c52
jmp 0x403171
mov eax, dword [ebx]
mov dword [esp + 4], str.__no_hitide
mov dword [esp], eax
call sub.msvcrt.dll__stricmp
test eax, eax
jne 0x403097
mov dword [esp + 4], 0x460399
mov eax, dword [0x4742c0]
mov dword [esp], eax
call fcn.00412bb1
jmp 0x403171
mov dword [esp + 4], str.__no_
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0040a3d6
test eax, eax
je 0x4030c8
mov eax, dword [ebx]
add eax, 5
mov dword [esp + 4], eax
mov eax, dword [0x4742c0]
mov dword [esp], eax
call fcn.00412bb1
jmp 0x403171
mov dword [esp + 4], str.__setTrue_
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0040a3d6
test eax, eax
je 0x403109
mov edi, dword [ebx]
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0xa
jbe 0x403109
mov dword [esp + 4], 1
mov eax, dword [ebx]
add eax, 0xa
mov dword [esp], eax
call fcn.00403c52
jmp 0x403171
mov dword [esp + 4], str.__setVariable_
mov eax, dword [ebx]
mov dword [esp], eax
call fcn.0040a3d6
test eax, eax
je 0x403171
mov esi, dword [ebx]
lea eax, [esi + 0xf]
mov dword [esp + 4], 0x3d
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x403171
lea eax, [esi + 0xe]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov esi, eax
mov dword [esp + 4], 0x3d
mov dword [esp], eax
call sub.msvcrt.dll_strchr
test esi, esi
je 0x403169
mov byte [eax], 0
inc eax
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00403954
mov dword [esp], esi
call sub.msvcrt.dll_free
add ebx, 4
cmp dword [ebx], 0
jne 0x402eb5
mov dword [esp], 0x460313
call fcn.00403a4f
test eax, eax
je 0x4031e5
mov dword [esp], str.LicenceAgreed
call fcn.00403c85
test al, al
je 0x4031e5
mov dword [esp + 4], 1
mov dword [esp], 0x460031
call fcn.00403c52
mov dword [esp], 0x460351
call fcn.00403c85
test al, al
jne 0x4031e5
mov dword [esp], 0x46036a
call fcn.00403c85
test al, al
jne 0x4031e5
mov dword [esp + 4], 1
mov dword [esp], 0x4603c1
call fcn.00403c52
lea eax, [ebp - 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_time
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call sub.msvcrt.dll_srand
mov dword [esp], str.SubInstall
call fcn.00403c85
test al, al
je 0x403232
mov dword [esp + 4], 0
mov dword [esp], str.HI_TECH_Installer
call sub.USER32.dll_FindWindowA
sub esp, 8
test eax, eax
je 0x403232
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov dword [esp], 0x460031
call fcn.00403c85
test al, al
jne 0x403247
call fcn.00402cc7
call fcn.0040be73
mov dword [ebp - 0x40], 0
mov dword [esp], 0x46006d
call fcn.00403c85
test al, al
je 0x40329d
call fcn.00404032
lea edx, [ebp - 0x40]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0x4603c9
mov dword [esp + 4], eax
mov dword [esp], 4
call fcn.0041393b
test eax, eax
jne 0x40329d
cmp dword [ebp - 0x40], 0
je 0x40329d
mov dword [esp], 0
call fcn.004015a8
call fcn.00403d95
test al, al
jne 0x4032b2
mov dword [esp], str.This_program_requires_Administrator_privileges
call fcn.00401520
cmp dword [0x474360], 0
je 0x4032d3
mov dword [esp + 4], 0
mov eax, dword [0x474360]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp], 0x460031
call fcn.00403c85
test al, al
je 0x4032f1
mov dword [esp], 0
call fcn.00401607
jmp 0x40335f
call fcn.00402438
mov dword [esp], 0
call fcn.00401607
lea esi, [ebp - 0x38]
jmp 0x403335
mov dword [esp + 4], esi
mov eax, dword [0x474310]
mov dword [esp], eax
call sub.USER32.dll_IsDialogMessageA
sub esp, 8
test al, al
jne 0x403335
mov dword [esp], esi
call sub.USER32.dll_TranslateMessage
sub esp, 4
mov dword [esp], esi
call sub.USER32.dll_DispatchMessageA
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test al, al
jne 0x403307
mov dword [esp], 0x460407
call fcn.00403a4f
test eax, eax
je 0x403411
cmp byte [0x4742b0], 0
je 0x403411
mov dword [esp], 0x460407
call fcn.00403a4f
mov dword [esp + 4], eax
mov dword [esp], 0x460416
call fcn.004130c0
mov ebx, eax
mov dword [esp], 0x460313
call fcn.00403a4f
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.004130c0
mov ebx, eax
mov dword [esp], eax
call fcn.00412842
test eax, eax
je 0x4033f9
mov dword [esp + 0x14], 9
mov dword [esp + 0x10], 0x4602d7
mov dword [esp + 0xc], 0x4602d7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4600f8
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x403411
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Could_not_locate_quickstart_guide:_n__s
mov dword [esp], str.Quickstart
call fcn.004013f7
cmp dword [0x470010], 0
je 0x4034d3
mov ebx, dword [0x470010]
je 0x4034d3
cmp dword [ebx + 0xc], 0
je 0x4034c8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xf0
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
cmp eax, 1
jne 0x4034c8
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00412842
test eax, eax
je 0x4034a6
mov dword [esp + 0x14], 9
mov dword [esp + 0x10], 0x4602d7
mov dword [esp + 0xc], 0x4602d7
mov eax, dword [ebx + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4600f8
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
jmp 0x4034c8
mov eax, dword [ebx + 8]
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 4]
mov dword [esp + 8], eax
mov dword [esp + 4], str.Could_not_locate_the___s_:_n__s
mov dword [esp], str.Read_PDF
call fcn.004013f7
mov ebx, dword [ebx + 0x10]
test ebx, ebx
jne 0x40342a
cmp byte [0x474300], 0
je 0x4034fa
mov dword [esp], 0x460474
call fcn.00403a4f
mov dword [esp + 4], 0x4602d7
mov dword [esp], eax
call fcn.00409599
jmp 0x403521
cmp byte [0x474280], 0
je 0x403521
cmp dword [0x4743b0], 0
je 0x403521
mov dword [esp + 4], 0x4602d7
mov eax, dword [0x4743b0]
mov dword [esp], eax
call fcn.00409599
cmp dword [0x474290], 0
je 0x40356a
mov dword [esp], 0x460479
call fcn.00403a4f
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x4602d7
mov eax, dword [0x474290]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4600f8
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
mov eax, dword [ebp - 0x30]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10