Function at 0x404661
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ec
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1e8], eax
push ebx
push esi
push edi
push 6
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.004057fe
test eax, eax
jns 0x4046c4
push 0x10
push esi
push str.Initialization_failed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x404921
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x18], 2
mov edi, eax
je 0x4046e6
cmp dword [esp + 0x18], 3
jne 0x40470e
push 0x41bee8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40470e
cmp dword [esp + 0x18], 3
jne 0x404702
mov esi, dword [edi + 8]
mov ecx, esi
call fcn.004045b0
jmp 0x404921
call fcn.00402025
push eax
lea ecx, [esp + 0x28]
call fcn.00401e3b
call fcn.0040156b
test al, al
mov edx, str.46C3BCD6_F992_4D94_9C03_4960FF5F5A81
mov ecx, str.7DABE060_FEE3_405e_9CE3_99578A7F88A1
cmove ecx, edx
push ecx
lea ecx, [esp + 0x24]
call fcn.00401ccb
push str.InstallLocation
lea ecx, [esp + 0x14]
call fcn.00401ccb
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
call fcn.004016fa
pop ecx
mov ecx, dword [esp + 0x10]
mov bl, al
add ecx, 0xfffffff0
call fcn.004023f1
test bl, bl
je 0x40480a
cmp dword [esp + 0x18], 2
jne 0x404797
push 0x41bfb0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404797
push esi
call fcn.00404109
pop ecx
jmp 0x404904
push esi
lea ecx, [esp + 0x34]
call fcn.00403de5
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004049f2
cmp eax, 2
je 0x4048fb
push esi
call fcn.00404109
pop ecx
test al, al
je 0x4048fb
push str.Installation_succeeded.
lea ecx, [esp + 0x14]
call fcn.00401ccb
push esi
lea eax, [esp + 0x14]
push eax
push 0x6e
pop edx
lea ecx, [esp + 0x1c]
call fcn.00401284
pop ecx
xor edx, edx
mov ecx, eax
call fcn.00401300
pop ecx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x10]
jmp 0x4048f3
push 1
call fcn.00404109
pop ecx
push 1
lea ecx, [esp + 0x34]
call fcn.00403de5
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004049f2
cmp eax, 6
jne 0x4048fb
push str.OutlookFreeware_Utility_Manager_is_not_installed_on_this_machine__it_is_required_to_install_and_run_this_utility._n_nYou_will_be_redirected_to_OutlookFreeware_Utility_Manager_download_page_now.
lea ecx, [esp + 0x14]
call fcn.00401ccb
push 0x65
lea eax, [esp + 0x14]
push eax
push 0x6a
pop edx
lea ecx, [esp + 0x24]
call fcn.00401284
pop ecx
xor edx, edx
mov ecx, eax
call fcn.00401300
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004023f1
push 0x41bb38
lea ecx, [esp + 0x14]
call fcn.00401ccb
push str._runtime.aspx_srcss
lea eax, [esp + 0x14]
push eax
push 0x74
pop edx
lea ecx, [esp + 0x30]
call fcn.00401284
pop ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00404994
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.00401979
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004023f1
push 1
push esi
push esi
push dword [esp + 0x20]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.004023f1
lea ecx, [esp + 0x30]
call fcn.00404025
call fcn.0040576c
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.004023f1
mov ecx, dword [esp + 0x1f4]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00407aee
mov esp, ebp
pop ebp
ret 0x10