Function at 0x418f30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7ec
mov eax, dword [0x4a06b4]
xor eax, esp
mov dword [esp + 0x7e8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [esp + 0x4c]
call fcn.00403250
cmp dword [esp + 0x58], 0
je 0x419046
mov eax, dword [0x4a3590]
cmp eax, 0xffffffff
jne 0x418f78
call fcn.0040a750
mov dword [0x4a3590], eax
test eax, eax
jne 0x418f83
push 0x804
jmp 0x418f8d
cmp eax, 0x38
jne 0x418fa4
push 0x409
cmp byte [0x4a358c], 0
jne 0x418f9e
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
jmp 0x418fa4
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x6a
lea esi, [esp + 0x34]
call fcn.00410f30
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x418fc0
mov ebx, dword [eax]
jmp 0x418fc2
mov ebx, eax
push 0x80
lea esi, [esp + 0x18]
call fcn.00410f30
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x418fda
mov eax, dword [eax]
push 0x30
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x28], edi
jb 0x418ff9
mov eax, dword [esp + 0x14]
push eax
call fcn.0041cbd1
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp dword [esp + 0x44], edi
jb 0x419023
mov edx, dword [esp + 0x30]
push edx
call fcn.0041cbd1
add esp, 4
cmp dword [esp + 0x60], 0
je 0x41960f
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41960f
mov ecx, dword [esp + 0x64]
push ecx
call eax
jmp 0x41960f
push str.__EDataStoreSetup__
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4190c0
push str.__EDataStoreSetup__
push 1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFC35EB43_F4A0_43B4_BEB1_66A470045416_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x419213
call fcn.0040a6c0
push 0x6a
lea esi, [esp + 0x34]
call fcn.00410f30
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41914b
mov ebx, dword [eax]
jmp 0x41914d
call fcn.0040a6c0
push 0x6a
lea esi, [esp + 0x34]
call fcn.00410f30
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4190e1
mov ebx, dword [eax]
jmp 0x4190e3
mov ebx, eax
push 0x69
lea esi, [esp + 0x18]
call fcn.00410f30
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4190f8
mov eax, dword [eax]
push 0x30
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x28], edi
jb 0x419117
mov edx, dword [esp + 0x14]
push edx
call fcn.0041cbd1
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
cmp dword [esp + 0x44], edi
jb 0x419141
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041cbd1
add esp, 4
mov edx, dword [esp + 0x10]
push edx
jmp 0x419609
mov ebx, eax
push 0x6b
lea esi, [esp + 0x18]
call fcn.00410f30
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419162
mov eax, dword [eax]
push 0x24
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete bl
cmp dword [esp + 0x28], edi
jb 0x419187
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0041cbd1
add esp, 4
xor esi, esi
xor edx, edx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], dx
cmp dword [esp + 0x44], edi
jb 0x4191af
mov eax, dword [esp + 0x30]
push eax
call fcn.0041cbd1
add esp, 4
test bl, bl
je 0x4191f5
lea ecx, [esp + 0xc]
push ecx
lea esi, [esp + 0x50]
call fcn.004013d0
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], edi
jae 0x4191cd
mov eax, esi
push 5
push 0x4927a0
push 0x4927a0
push eax
push 0x4927a0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x4c]
call fcn.00403300
jmp 0x4195e9
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x419208
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x10]
cmp eax, esi
jmp 0x419606
push edi
call fcn.004346ae
add esp, 4
lea ecx, [esp + 0x68]
call fcn.004325e0
mov ebx, vtable.DuiLib::CNotifyPump.0
push 0x53
lea ecx, [esp + 0x80]
mov dword [esp + 0x7c], ebx
call fcn.0043327e
lea ecx, [esp + 0x94]
mov dword [esp + 0x68], vtable.DuiLib::WindowImplBase.0
mov dword [esp + 0x78], vtable.DuiLib::WindowImplBase.1.0
mov dword [esp + 0x88], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + 0x8c], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x90], vtable.DuiLib::WindowImplBase.4.0
call fcn.004357fd
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + 0x6c], vtable.CPageDialog1.0
mov dword [esp + 0x7c], vtable.CPageDialog1.1.0
mov dword [esp + 0x8c], 0x4934dc
mov dword [esp + 0x90], 0x4934e4
mov dword [esp + 0x94], 0x4934ec
call fcn.00410f30
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4192c4
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push pe_nt_image_headers32
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x8c]
call fcn.00432bfd
cmp dword [esp + 0x44], edi
jb 0x419306
mov edx, dword [esp + 0x30]
push edx
call fcn.0041cbd1
add esp, 4
lea ecx, [esp + 0x68]
call fcn.00432747
lea ecx, [esp + 0x68]
call fcn.0043266e
cmp byte [0x4a5544], 0
jne 0x419330
lea eax, [esp + 0x68]
push eax
call fcn.0041a720
jmp 0x4195e9
lea ecx, [esp + 0x2e0]
call fcn.004325e0
push 0x53
lea ecx, [esp + 0x2f8]
mov dword [esp + 0x2f4], ebx
call fcn.0043327e
mov ebx, vtable.DuiLib::WindowImplBase.4.0
lea ecx, [esp + 0x30c]
mov dword [esp + method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [esp + method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [esp + fcn.004341e4], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x308], ebx
call fcn.004357fd
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + method.CPageDialog1.virtual_0], 0x4934f4
mov dword [esp + method.DuiLib::WindowImplBase.1.virtual_0], 0x493584
mov dword [esp + 0x304], 0x49358c
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], 0x493594
mov dword [esp + method.DuiLib::CTxtWinHost.virtual_88], 0x49359c
call fcn.00410f30
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4193e1
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push pe_nt_image_headers32
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x304]
call fcn.00432bfd
cmp dword [esp + 0x44], edi
jb 0x419423
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041cbd1
add esp, 4
lea ecx, [esp + 0x2e0]
call fcn.00432747
lea ecx, [esp + 0x2e0]
call fcn.0043266e
cmp byte [0x4a5544], 0
jne 0x419460
lea edx, [esp + 0x2e0]
push edx
call fcn.0041a720
lea eax, [esp + 0x68]
push eax
call fcn.0041a720
jmp 0x4195e9
lea ecx, [esp + 0x558]
push ecx
call fcn.00418390
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + 0x55c], 0x4935a4
mov dword [esp + 0x56c], 0x493634
mov dword [esp + 0x57c], 0x49363c
mov dword [esp + 0x580], 0x493644
mov dword [esp + 0x584], 0x49364c
mov dword [esp + 0x7e4], 0
call fcn.00410f30
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x4194c4
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push pe_nt_image_headers32
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x57c]
call fcn.00432bfd
cmp dword [esp + 0x44], edi
jb 0x419506
mov edx, dword [esp + 0x30]
push edx
call fcn.0041cbd1
add esp, 4
lea ecx, [esp + 0x558]
call fcn.00432747
lea ecx, [esp + 0x558]
call fcn.0043266e
cmp byte [0x4a5544], 0
jne 0x419550
lea eax, [esp + 0x558]
push eax
call fcn.00419630
lea ecx, [esp + 0x2e0]
push ecx
call fcn.0041a720
lea edx, [esp + 0x68]
push edx
call fcn.0041a720
jmp 0x4195e9
call fcn.00418cb0
lea eax, [esp + 0x558]
push eax
call fcn.00419630
mov esi, vtable.DuiLib::WindowImplBase.0
mov edi, vtable.DuiLib::WindowImplBase.1.0
lea ecx, [esp + 0x30c]
mov dword [esp + 0x2e0], esi
mov dword [esp + 0x2f0], edi
mov dword [esp + fcn.004341e4], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x308], ebx
call fcn.00435ee3
lea ecx, [esp + 0x2f4]
call fcn.004338ba
lea ecx, [esp + 0x94]
mov dword [esp + 0x68], esi
mov dword [esp + 0x78], edi
mov dword [esp + 0x88], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + 0x8c], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x90], ebx
call fcn.00435ee3
lea ecx, [esp + 0x7c]
call fcn.004338ba
mov eax, dword [esp + 0xc]
test eax, eax
je 0x419600
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41960f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x7f4]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041c4a1
mov esp, ebp
pop ebp
ret 0x10