Function at 0x401880
Capabilities:
Accept command line arguments
Create process on windows
Delete file
Extract resource via kernel32 functions
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3478
call fcn.00413880
mov eax, dword [0x41c040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
push 0x10
push 1
push edi
mov dword [ebp - 0x3424], esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4018c8
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea ecx, [ebx + 0x28]
neg ebx
lea eax, [ebp - 0x3414]
sbb ebx, ebx
push eax
and ebx, ecx
push esi
mov dword [ebp - 0x3420], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
test esi, esi
jne 0x4018f3
mov dword [ebp - 0x3414], eax
jmp 0x4018f9
mov eax, dword [ebp - 0x3414]
xor ecx, ecx
xor bl, bl
mov dword [ebp - 0x3410], ecx
mov byte [ebp - 0x3418], bl
test eax, eax
jle 0x401a23
push str.help
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x401aa6
push str._help
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x401aa6
push 0x419be4
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x401aa6
push 0x419bec
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x401aa6
push str.extract32
push dword [esi]
call fcn.004054de
mov ecx, dword [ebp - 0x3410]
test eax, eax
mov eax, 0x20
push str.extract64
push dword [esi]
cmove ecx, eax
mov dword [ebp - 0x3410], ecx
call fcn.004054de
test eax, eax
mov ecx, 0x40
mov eax, dword [ebp - 0x3410]
push 0x419c1c
push dword [esi]
cmove eax, ecx
mov dword [ebp - 0x3410], eax
call fcn.004054de
add esp, 0x18
test eax, eax
je 0x4019fd
push 0x419c24
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x4019fd
push str._quiet
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
je 0x4019fd
push str._passive
push dword [esi]
call fcn.004054de
add esp, 8
test eax, eax
jne 0x401a05
mov bl, 1
mov byte [ebp - 0x3418], bl
mov eax, dword [ebp - 0x3414]
add esi, 4
dec eax
mov dword [ebp - 0x3414], eax
test eax, eax
jg 0x401911
mov ecx, dword [ebp - 0x3410]
mov esi, dword [ebp - 0x3420]
test esi, esi
jne 0x401b14
test bl, bl
jne 0x401a8e
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401a57
mov word [ebp - 0x204], ax
push 0x100
lea eax, [ebp - 0x60c]
push eax
push 0xa6
push edi
call esi
test eax, eax
jne 0x401a76
mov word [ebp - 0x60c], ax
push 0x10
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x60c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 0x6a
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401ac8
mov word [ebp - 0x204], ax
push 0x1000
lea eax, [ebp - 0x240c]
push eax
push 0xc8
push edi
call esi
test eax, eax
jne 0x401ae7
mov word [ebp - 0x240c], ax
push 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x240c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10
test ecx, ecx
je 0x401b75
movzx eax, word [esi + 0x16]
push eax
movzx eax, word [esi + 0x10]
push eax
movzx eax, word [esi + 0x12]
push eax
push ecx
push str.OpenShellSetup_d__d__d__d.msi
lea eax, [ebp - 0x614]
push 0x104
push eax
call fcn.004020f0
cmp dword [ebp - 0x3410], 0x40
lea edx, [ebp - 0x614]
push dword [ebp - 0x3418]
sete al
mov ecx, edi
movzx eax, al
push eax
call fcn.00401280
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
movzx eax, ax
movzx ecx, al
shr ax, 8
shl cx, 8
or cx, ax
mov eax, 0x601
cmp cx, ax
jb 0x401bb7
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.IsWow64Process
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x3420], eax
test eax, eax
jne 0x401c2c
test bl, bl
jne 0x401c14
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x60c]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401bdd
mov word [ebp - 0x60c], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xa9
push edi
call esi
test eax, eax
jne 0x401bfc
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 0x65
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10
lea eax, [ebp - 0x341c]
mov dword [ebp - 0x341c], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x3420]
movzx eax, word [esi + 0x16]
mov ecx, 0x40
cmp dword [ebp - 0x341c], 0
push eax
movzx eax, word [esi + 0x10]
push eax
movzx eax, word [esi + 0x12]
push eax
mov eax, 0x20
cmovne eax, ecx
push eax
push str.__ALLUSERSPROFILE__OpenShellSetup_d__d__d__d.msi
lea eax, [ebp - 0x40c]
push 0x104
push eax
call fcn.004020f0
add esp, 0x1c
lea eax, [ebp - 0x40c]
push 0x104
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
cmp dword [ebp - 0x341c], 0
lea edx, [ebp - 0x40c]
push dword [ebp - 0x3418]
setne al
mov ecx, edi
movzx eax, al
push eax
call fcn.00401280
add esp, 8
test eax, eax
jne 0x401e74
mov esi, dword [ebp - 0x3424]
push str._MSI_
push esi
call fcn.0040331f
add esp, 8
test eax, eax
jne 0x401d12
push str._msi_
push esi
call fcn.0040331f
add esp, 8
test eax, eax
jne 0x401d12
push esi
lea eax, [ebp - 0x40c]
push eax
push str.msiexec.exe__i___s___s
lea eax, [ebp - 0x340c]
push 0x800
push eax
call fcn.004020f0
add esp, 0x14
jmp 0x401d50
lea eax, [ebp - 0x40c]
push eax
push 0x419d34
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
push str.msiexec.exe__s
lea eax, [ebp - 0x340c]
push 0x800
push eax
call fcn.004020f0
add esp, 0x10
lea eax, [ebp - 0x340c]
push 0x800
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
push 0x40
lea eax, [ebp - 0x3474]
mov dword [ebp - 0x3478], 0x44
push 0
push eax
call fcn.004039c0
add esp, 0xc
lea eax, [ebp - 0x3434]
xorps xmm0, xmm0
movups xmmword [ebp - 0x3434], xmm0
push eax
lea eax, [ebp - 0x3478]
push eax
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 0x340c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x401e2a
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
jne 0x401e12
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x60c]
push 0x100
push eax
push 0x64
push edi
call esi
test eax, eax
jne 0x401ddb
mov word [ebp - 0x60c], ax
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0xaa
push edi
call esi
test eax, eax
jne 0x401dfa
mov word [ebp - 0x204], ax
push 0x10
lea eax, [ebp - 0x60c]
push eax
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
mov eax, 0x6c
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x3430]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push 0xffffffffffffffff
push dword [ebp - 0x3434]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x3424]
push eax
push dword [ebp - 0x3434]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x3434]
call esi
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x3424]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402264
mov esp, ebp
pop ebp
ret 0x10