Function at 0x4646f6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x488f94]
sub esp, 0x15c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call ebx
test eax, eax
jne 0x464737
mov eax, dword [0x488f94]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004342f1
pop ecx
push eax
call fcn.004640eb
pop ecx
pop ecx
jmp 0x4649f6
call fcn.00464289
test eax, eax
je 0x4649f6
xor eax, eax
inc eax
push esi
push edi
mov dword [ebp - 4], eax
cmp dword [0x488f90], eax
jl 0x46482d
mov edi, 0x46c5f0
mov eax, dword [0x488f94]
mov esi, dword [ebp - 4]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x488f94]
je 0x4647c2
push edi
push dword [eax + esi*4]
call fcn.00434312
push edi
push 0
call fcn.00434312
mov ecx, dword [0x48ab6c]
add esp, 0x10
mov esi, eax
add ecx, 0x8adc
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x46479e
mov ecx, dword [0x48ab6c]
mov edx, eax
add ecx, 0x9275
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x4647b6
jmp 0x46481b
push str._silent
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x4647d9
mov byte [0x48ab69], 1
jmp 0x46481b
mov eax, dword [0x488f94]
push str._resume
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x4647fc
mov byte [0x48ab69], 1
mov byte [0x48ab6a], 1
jmp 0x46481b
mov eax, dword [0x488f94]
push str._noui
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x46481b
mov eax, dword [0x48ab6c]
mov byte [eax + 0xb842], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x488f90]
jle 0x46475d
push 0x103
xor esi, esi
lea eax, [ebp - 0x15b]
push esi
push eax
mov byte [ebp - 0x15c], 0
call fcn.00438870
add esp, 0xc
push 0x104
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push str.resume.exe
push eax
call fcn.004640d0
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x464984
lea eax, [ebp - 0x15c]
push 0x46c618
push eax
call fcn.004640d0
pop ecx
push eax
call ebx
test eax, eax
jne 0x4648aa
push esi
push esi
push dword [0x48ab6c]
push 0x15
call fcn.004622aa
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c624
push eax
call fcn.004640d0
pop ecx
push eax
call ebx
test eax, eax
jne 0x4648d5
push esi
push esi
push dword [0x48ab6c]
push 0x16
call fcn.004622aa
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c630
push eax
call fcn.004640d0
pop ecx
push eax
call ebx
test eax, eax
jne 0x464900
push esi
push esi
push dword [0x48ab6c]
push 0x17
call fcn.004622aa
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c63c
push eax
call fcn.004640d0
pop ecx
push eax
call ebx
test eax, eax
jne 0x46492b
push esi
push esi
push dword [0x48ab6c]
push 0x18
call fcn.004622aa
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov ebx, eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00438870
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push str.install.exe__resume
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4649e4
mov eax, dword [0x488f94]
push str._uninstall
push dword [eax + 4]
call ebx
test eax, eax
jne 0x4649a1
push dword [ebp + 8]
call fcn.00464560
jmp 0x4649e3
mov eax, dword [0x488f94]
push str._cleanup
push dword [eax + 4]
call ebx
test eax, eax
jne 0x4649cd
mov eax, dword [0x488f94]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.004342f1
pop ecx
push eax
call fcn.004640eb
jmp 0x4649e2
mov eax, dword [0x48ab6c]
movzx eax, byte [eax + 0xb842]
push eax
push dword [ebp + 8]
call fcn.004642e9
pop ecx
pop ecx
push esi
xor ebx, ebx
xor eax, eax
call fcn.0044b56a
pop ecx
call fcn.00464129
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10