Function at 0x4183f0
Capabilities:
Accept command line arguments
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xbb4
mov eax, dword [0x44a1a0]
xor eax, esp
mov dword [esp + 0xbb0], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push 0x2e8
call fcn.0041f629
mov esi, dword fs:[0x2c]
add esp, 4
test eax, eax
jne 0x41844c
mov eax, dword [esi]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x418448
mov ecx, dword [ecx + 0x104]
test ecx, ecx
je 0x418448
mov eax, dword [ecx]
push 0x2e8
call dword [eax + 0x14]
xor eax, eax
jmp 0x418456
sub esp, 0x10
mov ecx, eax
call fcn.00404f60
mov ecx, dword [esi]
mov dword [ecx + 4], eax
call fcn.00405c10
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, eax
mov dword [esp + 0x10], vtable.ErrorClass.0
lea eax, [esp + 0x964]
mov dword [0x4d23f4], edi
mov dword [esp + 0x960], eax
xor eax, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], vtable.TextErrorClass.0
mov dword [esp + 0x18], 0x43c8e0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x3c], 0x43c8e0
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x43c8e0
mov dword [esp + 0x48], 0
mov dword [esp + 0x34], 0x43c8e0
mov dword [esp + 0x38], 0
mov dword [esp + 0x950], 0
mov dword [esp + 0x954], 0
mov dword [esp + 0x958], 2
mov dword [esp + 0x95c], 0x108
mov word [esp + 0x964], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
movdqu xmm0, xmmword [str.enstart]
push 0x30
mov dword [esp + 0x34], eax
mov edi, 1
lea eax, [esp + 0xb8c]
mov dword [esp + 0x24], edi
push 0
push eax
mov byte [esp + 0x1a], 1
mov byte [esp + 0x30], 0
mov byte [esp + 0x1b], 0
movdqu xmmword [esp + 0xb84], xmm0
call fcn.00422270
lea eax, [esp + 0x520]
mov dword [esp + 0x50c], 0
mov dword [esp + 0x51c], eax
add esp, 0xc
xor eax, eax
mov dword [esp + 0x504], 0
mov word [esp + 0x514], ax
mov dword [esp + 0x2d8], eax
mov dword [esp + 0x2dc], eax
lea eax, [esp + 0x2ec]
mov dword [esp + 0x2e8], eax
xor eax, eax
cmp dword [0x44f848], 2
mov dword [esp + 0x508], 2
mov dword [esp + 0x50c], 0x108
mov dword [esp + 0x2e0], 2
mov dword [esp + 0x2e4], pe_nt_image_headers32
mov word [esp + 0x2ec], ax
jl 0x418e2c
test byte [0x44f74c], 1
je 0x41862c
mov edi, 0x20
mov dword [0x44c81c], 0xcd
lea eax, [esp + 0xb78]
mov ecx, 0x443be2
lea edx, [edi + 0x45]
lea ecx, [ecx]
dec edi
je 0x418624
mov word [eax], dx
add eax, 2
movzx edx, word [ecx]
add ecx, 2
test dx, dx
jne 0x418610
xor ecx, ecx
mov word [eax], cx
lea edi, [ecx + 1]
push str._drop
push ebx
call fcn.0041ea46
add esp, 8
test eax, eax
je 0x418d62
lea eax, [esp + 0x2d8]
push eax
lea edx, [esp + 0xb7c]
lea ecx, [esp + 0x14]
call fcn.00419e20
add esp, 4
test al, al
jne 0x418670
push ecx
lea ecx, [esp + 0x2dc]
call fcn.0040c630
jmp 0x41868c
mov ecx, dword [esp + 0x2e8]
call fcn.0040dfa0
test al, al
jne 0x41868c
lea ecx, [esp + 0x2d8]
call fcn.0040bdb0
lea eax, [esp + 0xc4]
mov dword [esp + 0xb0], 0
push 1
push dword [esp + 0x34]
mov dword [esp + 0xc8], eax
lea ecx, [esp + 0xb8]
xor eax, eax
mov dword [esp + 0xbc], 0
mov ebx, 0x50
mov dword [esp + 0xc0], 2
mov dword [esp + 0xc4], pe_nt_image_headers32
mov word [esp + 0xcc], ax
mov dword [esp + 0x34], 1
call fcn.0040c540
test al, al
je 0x418943
jmp 0x418700
mov edi, dword [esp + 0xc0]
movzx eax, word [edi]
cmp eax, 0x2d
je 0x418714
cmp eax, 0x2f
jne 0x418757
mov edi, dword [esp + 0xc0]
movzx eax, word [edi + 2]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
add edi, 4
movzx ebx, ax
cmp word [edi], 0
jne 0x418757
cmp ebx, 0x52
je 0x418757
cmp ebx, 0x53
je 0x418757
cmp ebx, 0x48
je 0x418757
cmp ebx, 0x43
je 0x418757
lea ecx, [esp + 0xb0]
call fcn.00408240
jmp 0x4188dd
lea eax, [ebx - 0x43]
cmp eax, 0x12
ja case.0x41876a.69
movzx eax, byte [eax + 0x418fa4]
jmp dword [eax*4 + 0x418f74]
push ecx
push 0x20
push 0xa
push ecx
push 4
lea edx, [esp + 0x3c]
mov dword [esp + 0x3c], 0
mov ecx, edi
call fcn.00404270
add esp, 0x14
test al, al
je 0x41886b
mov eax, dword [esp + 0x28]
mov dword [0x44fe9c], eax
jmp 0x41886b
mov byte [esp + 0xe], 0
jmp 0x41886b
cmp dword [0x44b498], 7
jl 0x41886b
mov byte [esp + 0x24], 1
jmp 0x41886b
push dword [esp + 0x2e4]
mov ecx, dword [esp + 0x2ec]
mov edx, edi
call fcn.00403250
add esp, 4
jmp 0x41886b
movzx ecx, word [edi]
lea eax, [esp + 0xb78]
add edi, 2
mov edx, 0x20
test cx, cx
je 0x418814
lea ebx, [ebx]
dec edx
je 0x418814
mov word [eax], cx
add eax, 2
movzx ecx, word [edi]
add edi, 2
test cx, cx
jne 0x418800
xor ecx, ecx
mov word [eax], cx
jmp 0x41886b
mov byte [esp + 0xf], 1
jmp 0x41886b
push edi
lea ecx, [esp + 0x40]
call fcn.004065a0
jmp 0x41886b
push edi
lea ecx, [esp + 0x48]
call fcn.004065a0
jmp 0x41886b
push 0xffffffffffffffff
push edi
lea ecx, [esp + 0x958]
call fcn.0040bc10
jmp 0x41886b
push edi
lea ecx, [esp + 0x38]
call fcn.004065a0
movzx eax, bx
push eax
lea eax, [esp + 0x14]
push str.Invalid_token___c_
push eax
call fcn.00408b70
add esp, 0xc
mov edi, dword [esp + 0xc0]
mov ebx, 0x4e
test edi, edi
je 0x4188dd
mov eax, dword [esp + 0xb0]
shr eax, 5
test al, 1
je 0x4188a9
mov eax, dword [esp + 0xb8]
imul eax, dword [esp + 0xbc]
test eax, eax
je 0x4188a9
lea esp, [esp]
mov byte [edi], 0
lea edi, [edi + 1]
dec eax
jne 0x4188a0
mov al, byte [esp + 0xb0]
test al, 2
je 0x4188ca
push 0x8000
push 0
push dword [esp + 0xc8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x4188dd
test al, 1
je 0x4188dd
push dword [esp + 0xc0]
call fcn.0041f5f1
add esp, 4
lea eax, [esp + 0xc4]
mov dword [esp + 0xb0], 0
mov dword [esp + 0xc0], eax
lea ecx, [esp + 0xb0]
xor eax, eax
mov dword [esp + 0xb4], 0
mov word [esp + 0xc4], ax
mov eax, dword [esp + 0x2c]
inc eax
mov dword [esp + 0xb8], 2
push eax
push dword [esp + 0x34]
mov dword [esp + 0xc4], pe_nt_image_headers32
mov dword [esp + 0x34], eax
call fcn.0040c540
test al, al
jne 0x418700
lea ecx, [esp + 0xb0]
call fcn.00408240
mov eax, dword [0x450620]
mov dword [0x44fe98], 0
test eax, eax
je 0x418969
push 0x44fe98
call eax
mov ecx, dword [0x44f74c]
xor eax, eax
mov edi, dword [esp + 0x50c]
mov edx, 0x100
mov ebx, dword [esp + 0x510]
mov dword [esp + 0x88], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x8c], str.SoftwareMicrosoftWindowsCurrentVersionSetup
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
test cl, 3
je 0x4189c5
test cl, 1
cmovne eax, edx
mov dword [esp + 0x94], eax
push ecx
lea eax, [edi + edi]
push eax
push ebx
push str.SysRegInstallPath
lea ecx, [esp + 0x98]
call fcn.00411380
test al, al
je 0x418a15
test edi, edi
je 0x4189eb
xor eax, eax
mov word [ebx + edi*2 - 2], ax
mov al, 1
jmp 0x418a17
mov byte [0x44f683], 1
call fcn.004181d0
lea ecx, [esp + 0xb0]
mov byte [0x44f683], 0
call fcn.00408240
xor edi, edi
jmp 0x418e65
xor al, al
test al, al
sete al
test al, al
je 0x418a41
push ecx
push 0x443828
lea eax, [esp + 0xb80]
push eax
push dword [esp + 0x2f4]
lea ecx, [esp + 0x510]
call fcn.0040c350
mov ecx, dword [0x44f74c]
xor eax, eax
mov dword [esp + 0x9c], reloc.OLEAUT32.dll_SysReAllocString
mov ebx, 0x100
mov dword [esp + 0xa0], str.SoftwareMicrosoftWindowsCurrentVersionSetup
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
test cl, 3
je 0x418a8f
test cl, 1
cmovne eax, ebx
mov dword [esp + 0xa8], eax
push 0x44cdfc
push str.SysRegInstallPath
lea ecx, [esp + 0xa4]
call fcn.004115f0
xor edx, edx
lea ecx, [esp + 0x10]
call fcn.00419d90
mov ecx, eax
test ecx, ecx
je 0x418d4a
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
test al, al
je 0x418d4a
mov edx, dword [esp + 0x510]
lea ecx, [esp + 0x10]
call fcn.00417c80
cmp byte [esp + 0xe], 0
je 0x418c94
movzx eax, word [0x44c81c]
push 0xa
push eax
push dword [0x4d23f4]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x418c7f
mov edi, dword [esp + 0x2e8]
mov ecx, edi
call fcn.0040dd30
test al, al
jne 0x418b2b
push ecx
mov edx, edi
lea ecx, [esp + 0x14]
call fcn.0040db10
add esp, 4
test al, al
je 0x418c8d
cmp byte [esp + 0xf], 0
je 0x418b37
call fcn.004182c0
push dword [esp + 0x24]
mov edx, dword [esp + 0x2ec]
lea eax, [esp + 0xb7c]
push 1
push eax
lea ecx, [esp + 0x1c]
call fcn.00417fa0
add esp, 0xc
test al, al
je 0x418c8d
push ecx
push 0x443828
lea eax, [esp + 0xb80]
push eax
push dword [esp + 0x2f4]
lea ecx, [esp + 0x510]
call fcn.0040c350
mov ecx, dword [0x44f74c]
xor eax, eax
mov dword [esp + 0x60], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x64], str.SoftwareMicrosoftWindowsCurrentVersionSetup
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
test cl, 3
je 0x418bb8
test cl, 1
cmovne eax, ebx
mov dword [esp + 0x6c], eax
push 1
push ecx
push dword [esp + 0x518]
lea ecx, [esp + 0x6c]
push str.SysRegInstallPath
call fcn.004114e0
lea ecx, [esp + 0x60]
mov bl, al
call fcn.004047b0
test bl, bl
je 0x418c11
push ecx
call fcn.00413a90
test al, al
jne 0x418bfc
push 0x450560
call dword [sym.imp.ole32.dll_CoCreateGuid]
push ecx
call fcn.00413b50
jmp 0x418c01
call fcn.00413c00
xor edx, edx
mov ecx, 1
test al, al
cmovne ecx, edx
mov dword [esp + 0x20], ecx
push ecx
push 0x443828
lea eax, [esp + 0xb80]
push eax
push dword [esp + 0x2f4]
lea ecx, [esp + 0x510]
call fcn.0040c350
mov eax, dword [0x450624]
test eax, eax
je 0x418c43
push dword [0x44fe98]
call eax
mov eax, dword [0x450620]
mov dword [0x44fe98], 0
test eax, eax
je 0x418c5d
push 0x44fe98
call eax
mov edi, dword [esp + 0x20]
mov eax, dword [0x450624]
test eax, eax
je 0x418c72
push dword [0x44fe98]
call eax
test edi, edi
je 0x418e4b
jmp 0x418e3a
push str.No_executable_file_is_in_this_setup
lea ecx, [esp + 0x1c]
call fcn.004065a0
mov edi, 1
jmp 0x418c61
mov ecx, dword [0x44f74c]
xor eax, eax
mov dword [esp + 0x4c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x50], 0x4400f0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
test cl, 3
je 0x418ccb
test cl, 1
cmovne eax, ebx
mov dword [esp + 0x58], eax
push 0x44cdfc
push str.SysSafeInstallPath
lea ecx, [esp + 0x54]
call fcn.004115f0
lea ecx, [esp + 0x4c]
call fcn.004047b0
mov ecx, dword [0x44f74c]
xor eax, eax
mov dword [esp + 0x74], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x78], 0x4400f0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
test cl, 3
je 0x418d27
test cl, 1
cmovne eax, ebx
mov dword [esp + 0x80], eax
push 0x44cdfc
push 0x442b1c
lea ecx, [esp + 0x7c]
call fcn.004115f0
lea ecx, [esp + 0x74]
call fcn.004047b0
xor edi, edi
jmp 0x418c61
push str.Log_on_as_Administrator
lea ecx, [esp + 0x1c]
call fcn.004065a0
mov edi, 1
jmp 0x418c61
push str.Copying_files
push 0x443cbc
call fcn.00420f55
add esp, 4
mov dword [esp + 0x72c], 0
lea eax, [esp + 0x740]
mov dword [esp + 0x730], 0
mov dword [esp + 0x73c], eax
lea ecx, [esp + 0x72c]
xor eax, eax
mov dword [esp + 0x734], 2
mov word [esp + 0x740], ax
lea eax, [esp + 0xb7c]
push 0x443828
push eax
push 0x43c8e0
mov dword [esp + 0x744], 0x108
call fcn.0040c350
push dword [esp + 0x738]
lea edx, [esp + 0x14]
push ecx
call fcn.00417a80
add esp, 8
lea ecx, [esp + 0x728]
mov bl, al
call fcn.00408240
and dword [esp + 0x728], 0xfffffffc
mov dword [esp + 0x72c], 0
mov dword [esp + 0x734], 0
test bl, bl
je 0x418e3a
push str.Success
lea ecx, [esp + 0x1c]
xor edi, edi
call fcn.004065a0
jmp 0x418e4b
push str.Unsupported_platform
lea ecx, [esp + 0x1c]
call fcn.004065a0
push dword [esp + 0x18]
push 0x443cbc
call fcn.00420f55
add esp, 8
mov ecx, dword [0x44fea0]
test ecx, ecx
je 0x418e5b
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [0x44fea0], 0
lea ecx, [esp + 0x2d8]
call fcn.00408240
and dword [esp + 0x2d8], 0xfffffffc
lea ecx, [esp + 0x500]
mov dword [esp + 0x2dc], 0
mov dword [esp + 0x2e4], 0
call fcn.00408240
and dword [esp + 0x500], 0xfffffffc
lea ecx, [esp + 0x950]
mov dword [esp + 0x504], 0
mov dword [esp + 0x50c], 0
call fcn.00408240
and dword [esp + 0x950], 0xfffffffc
cmp dword [esp + 0x38], 0
mov dword [esp + 0x954], 0
mov dword [esp + 0x95c], 0
je 0x418ef6
push dword [esp + 0x34]
call fcn.0041f5f1
add esp, 4
cmp dword [esp + 0x48], 0
je 0x418f09
push dword [esp + 0x44]
call fcn.0041f5f1
add esp, 4
cmp dword [esp + 0x40], 0
je 0x418f1c
push dword [esp + 0x3c]
call fcn.0041f5f1
add esp, 4
cmp dword [esp + 0x1c], 0
mov dword [esp + 0x10], vtable.TextErrorClass.0
je 0x418f47
push dword [esp + 0x18]
call fcn.0041f5f1
add esp, 4
mov dword [esp + 0x18], 0x43c8e0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], vtable.ErrorClass.0
test esi, esi
js 0x418f59
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [esp + 0xbbc]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041e8c8
mov esp, ebp
pop ebp
ret 0x10