Function at 0x4049b8
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x416919
call fcn.0040ef50
sub esp, 0x138
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push str.CMainFrame::UnInstall___n
mov dword [ebp - 0x10], ebx
call fcn.004024eb
pop ecx
mov edi, 0x420bb0
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], ebx
call fcn.00401595
lea eax, [ebp - 0x30]
push ebx
lea ecx, [esi + 0x18]
push eax
mov dword [ebp - 4], ebx
call fcn.00401e04
push eax
call sub.WINSPOOL.DRV_OpenPrinterA
cmp eax, ebx
jne 0x404a27
mov dword [esi + 0x70], 8
mov dword [esi + 0x74], 1
jmp 0x404f1f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x30]
call sub.WINSPOOL.DRV_GetPrinterA
cmp dword [ebp - 0x14], ebx
je 0x404a61
push dword [ebp - 0x14]
call fcn.0040efd0
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x14]
push eax
push 2
push dword [ebp - 0x30]
call sub.WINSPOOL.DRV_GetPrinterA
cmp eax, ebx
jne 0x404a80
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xa8], eax
mov dword [esi + 0x70], 7
mov dword [esi + 0x74], 0xa
jmp 0x404f1f
mov eax, dword [ebp - 0x20]
lea ecx, [esi + 0x84]
push dword [eax + 0x10]
call fcn.00401680
push dword [ebp - 0x20]
call fcn.0040eaf0
pop ecx
lea eax, [esi + 0x84]
push ecx
mov dword [ebp - 0x20], ebx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
mov ecx, esi
call fcn.0040520c
push 0x10
call fcn.0040efd0
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x404b0d
lea eax, [esi + 0x84]
push eax
lea eax, [ebp - 0x2c]
push str.SoftwareEPSONSTM3Driver_
push eax
call fcn.004017d5
add esp, 0xc
mov dword [ebp - 0x10], 1
push 0x20019
push ebx
push ebx
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00401e04
mov ecx, dword [ebp - 0x18]
push eax
push 0x80000002
call fcn.0040dc20
mov dword [ebp - 0x24], eax
jmp 0x404b10
mov dword [ebp - 0x24], ebx
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 1
je 0x404b25
lea ecx, [ebp - 0x2c]
call fcn.00401563
mov eax, dword [ebp - 0x24]
and byte [ebp - 4], 0
cmp dword [eax + 8], ebx
je 0x404c84
push edi
lea ecx, [ebp - 0x10]
call fcn.00401595
mov ecx, dword [ebp - 0x24]
mov ebx, 0x100
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x18]
push str.E_SENV
push eax
mov byte [ebp - 4], 3
call fcn.0040df98
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.00401618
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00401563
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401563
lea ecx, [ebp - 0x28]
call fcn.00401b7a
test eax, eax
jne 0x404c74
lea eax, [ebp - 0x28]
push 0x41c670
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040176a
add esp, 0xc
push edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00401595
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x18]
push ebx
push eax
lea eax, [ebp - 0x2c]
push str.ModelID
push eax
mov byte [ebp - 4], 6
call fcn.0040df98
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.00401563
lea ecx, [ebp - 0x2c]
call fcn.00401b7a
test eax, eax
jne 0x404c36
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push str.__M_
push eax
call fcn.004017d5
add esp, 0xc
push 0x41c3a8
push eax
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 9
push eax
call fcn.0040176a
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa
call fcn.00401a26
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.00401563
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00401563
push 5
lea ecx, [ebp - 0x10]
call fcn.00401e04
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x404c5a
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 6
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 5
call fcn.00401563
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401563
jmp 0x404c92
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 5
jmp 0x404c92
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 4
push ecx
lea eax, [esi + 0x18]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
push ecx
mov ebx, str.softwareEPSONSTM3STMDataEPLTarget
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
mov byte [ebp - 4], 0xb
call fcn.00401595
and byte [ebp - 4], 0
mov edi, 0x80000001
push edi
mov ecx, esi
call fcn.00404f58
test eax, eax
jne 0x404cd9
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 1
push ecx
lea eax, [esi + 0x18]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x18], esp
push str.softwareEPSONSTM3STMDataEPNTarget
call fcn.00401595
and byte [ebp - 4], 0
push edi
mov ecx, esi
call fcn.00404f58
test eax, eax
jne 0x404d1a
mov dword [esi + 0x70], 3
mov dword [esi + 0x74], 2
push ecx
lea eax, [esi + 0x18]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
push ecx
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
call fcn.00401595
and byte [ebp - 4], 0
push 0x80000002
mov ecx, esi
call fcn.00404f58
test eax, eax
jne 0x404d5c
push 1
mov dword [esi + 0x70], 3
pop edi
mov dword [esi + 0x74], edi
jmp 0x404d5f
push 1
pop edi
lea eax, [ebp - 0x38]
xor ebx, ebx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 2
push ebx
push 0x46
mov dword [ebp - 0x14], ebx
call sub.WINSPOOL.DRV_EnumPrintersA
cmp dword [ebp - 0x14], ebx
je 0x404e6a
push dword [ebp - 0x14]
call fcn.0040efd0
mov ebx, eax
pop ecx
lea eax, [ebp - 0x38]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push 0
push 0x46
call sub.WINSPOOL.DRV_EnumPrintersA
test eax, eax
jne 0x404dc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0xa8], eax
mov dword [esi + 0x70], 7
mov dword [esi + 0x74], 0xb
jmp 0x404f1d
xor eax, eax
cmp dword [ebp - 0x38], eax
je 0x404e6a
cmp dword [ebp - 0x38], eax
mov dword [ebp - 0x10], eax
jbe 0x404e18
add ebx, 0x10
lea eax, [esi + 0x18]
push eax
push dword [ebx - 0xc]
call fcn.00401ebd
pop ecx
test al, al
pop ecx
je 0x404e05
lea eax, [esi + 0x84]
push eax
push dword [ebx]
call fcn.00401e51
pop ecx
test al, al
pop ecx
jne 0x404e15
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add ebx, 0x54
cmp eax, dword [ebp - 0x38]
jb 0x404ddf
jmp 0x404e18
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], 0
jne 0x404e6d
mov eax, dword [esi + 0x78]
mov dword [ebp - 0x3c], edi
cmp eax, 2
je 0x404e2e
cmp eax, 3
jne 0x404e35
mov ecx, esi
call fcn.00405230
mov ecx, esi
call fcn.0040565c
mov ecx, esi
call fcn.004067c9
mov ecx, esi
call fcn.0040cb86
mov ecx, esi
call fcn.0040c074
mov ecx, esi
call fcn.00405b2c
cmp dword [esi + 0x78], 3
mov dword [ebp - 0x34], eax
jne 0x404e6d
mov ecx, esi
call fcn.00405df0
jmp 0x404e6d
mov dword [ebp - 0x34], edi
mov ecx, esi
call fcn.00405916
test eax, eax
je 0x404e9a
lea eax, [ebp - 0x144]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x144]
mov ecx, esi
push eax
call fcn.0040b536
mov ecx, esi
call fcn.0040ba5e
cmp dword [ebp - 0x34], 0
je 0x404eb0
mov ecx, esi
call fcn.00405d23
jmp 0x404f0a
lea ecx, [ebp - 0x28]
call fcn.00401b7a
test eax, eax
jne 0x404f0a
lea eax, [ebp - 0x28]
push 0x41c60c
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040176a
add esp, 0xc
push 5
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.00401e04
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
lea ecx, [ebp - 0x1c]
sbb ebx, ebx
and byte [ebp - 4], 0
neg ebx
call fcn.00401563
test bl, bl
je 0x404f0a
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 7
cmp dword [ebp - 0x3c], 0
je 0x404f1d
cmp dword [esi + 0x7c], 0
je 0x404f1d
mov ecx, esi
call fcn.00408616
xor ebx, ebx
cmp dword [ebp - 0x30], ebx
je 0x404f2c
push dword [ebp - 0x30]
call sub.WINSPOOL.DRV_ClosePrinter
cmp dword [ebp - 0x20], ebx
je 0x404f3a
push dword [ebp - 0x20]
call fcn.0040eaf0
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401563
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret