Function at 0x40416e
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push esi
push edi
push 6
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.0040539c
test eax, eax
jns 0x4041d1
push 0x10
push esi
push str.Initialization_failed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x40442e
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x18], 2
mov edi, eax
je 0x4041f3
cmp dword [esp + 0x18], 3
jne 0x40421b
push 0x41be48
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40421b
cmp dword [esp + 0x18], 3
jne 0x40420f
mov esi, dword [edi + 8]
mov ecx, esi
call fcn.004040bd
jmp 0x40442e
call fcn.00402039
push eax
lea ecx, [esp + 0x28]
call fcn.00401e4f
call fcn.00401581
test al, al
mov edx, str.46C3BCD6_F992_4D94_9C03_4960FF5F5A81
mov ecx, str.7DABE060_FEE3_405e_9CE3_99578A7F88A1
cmove ecx, edx
push ecx
lea ecx, [esp + 0x24]
call fcn.00401cdf
push str.InstallLocation
lea ecx, [esp + 0x14]
call fcn.00401cdf
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
call fcn.00401710
pop ecx
mov ecx, dword [esp + 0x10]
mov bl, al
add ecx, 0xfffffff0
call fcn.00402405
test bl, bl
je 0x404317
cmp dword [esp + 0x18], 2
jne 0x4042a4
push 0x41bf10
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4042a4
push esi
call fcn.00403c16
pop ecx
jmp 0x404411
push esi
lea ecx, [esp + 0x34]
call fcn.0040391d
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004044ff
cmp eax, 2
je 0x404408
push esi
call fcn.00403c16
pop ecx
test al, al
je 0x404408
push str.Installation_succeeded.
lea ecx, [esp + 0x14]
call fcn.00401cdf
push esi
lea eax, [esp + 0x14]
push eax
push 0x6e
pop edx
lea ecx, [esp + 0x1c]
call fcn.00401292
pop ecx
xor edx, edx
mov ecx, eax
call fcn.0040130e
pop ecx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x10]
jmp 0x404400
push 1
call fcn.00403c16
pop ecx
push 1
lea ecx, [esp + 0x34]
call fcn.0040391d
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004044ff
cmp eax, 6
jne 0x404408
push str.OutlookFreeware.com_Runtime_is_not_installed_on_this_machine__it_is_required_to_install_and_run_this_utility._n_nYou_will_be_redirected_to_OutlookFreeware.com_Runtime_download_page_now.
lea ecx, [esp + 0x14]
call fcn.00401cdf
push 0x65
lea eax, [esp + 0x14]
push eax
push 0x6a
pop edx
lea ecx, [esp + 0x24]
call fcn.00401292
pop ecx
xor edx, edx
mov ecx, eax
call fcn.0040130e
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402405
push 0x41bb54
lea ecx, [esp + 0x14]
call fcn.00401cdf
push str._runtime.aspx_srcss
lea eax, [esp + 0x14]
push eax
push 0x74
pop edx
lea ecx, [esp + 0x30]
call fcn.00401292
pop ecx
push eax
lea ecx, [esp + 0x24]
call fcn.004044a1
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.0040198f
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402405
push 1
push esi
push esi
push dword [esp + 0x20]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402405
lea ecx, [esp + 0x30]
call fcn.00403b4d
call fcn.0040530a
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00402405
mov ecx, dword [esp + 0x13c]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040768c
mov esp, ebp
pop ebp
ret 0x10