Function at 0x40d6b4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push edi
push 0x40d562
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov eax, dword [0x4aaefc]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call edi
test eax, eax
jne 0x40d705
mov eax, dword [0x4aaefc]
push dword [eax + 8]
call fcn.0043e4c8
mov edx, dword [0x4aaefc]
pop ecx
mov ecx, eax
mov edx, dword [edx + 0xc]
call fcn.0040d52a
jmp 0x40d9b1
and dword [ebp - 4], 0
call fcn.0040d2ba
test eax, eax
je 0x40d9b1
push ebx
push esi
xor esi, esi
inc esi
cmp dword [0x4aaef8], esi
jle 0x40d813
push 2
pop ebx
mov eax, dword [0x4aaefc]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x4aaefc]
je 0x40d797
mov edi, 0x481c4c
push edi
push dword [eax + esi*4]
call fcn.0043ecc8
push edi
push 0
call fcn.0043ecc8
mov ecx, dword [0x4ae264]
add esp, 0x10
add ecx, 0xa95e
mov edx, eax
mov edi, ecx
mov cl, byte [eax]
inc eax
mov byte [edi], cl
inc edi
test cl, cl
jne 0x40d76f
mov ecx, dword [0x4ae264]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
add ecx, 0xb0fb
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x40d78b
jmp 0x40d805
push str._silent
push dword [eax + esi*4]
call edi
test eax, eax
jne 0x40d7ae
mov byte [0x4ae262], 1
jmp 0x40d805
mov eax, dword [0x4aaefc]
push str._resume
push dword [eax + esi*4]
call edi
test eax, eax
jne 0x40d7e6
mov byte [0x4ae262], 1
mov byte [0x4ae261], 1
cmp ebx, dword [0x4aaef8]
jge 0x40d805
mov eax, dword [0x4aaefc]
inc esi
inc ebx
mov eax, dword [eax + esi*4]
mov dword [ebp - 4], eax
jmp 0x40d805
mov eax, dword [0x4aaefc]
push str._noui
push dword [eax + esi*4]
call edi
test eax, eax
jne 0x40d805
mov eax, dword [0x4ae264]
mov byte [eax + 0xd84f], 1
inc esi
inc ebx
cmp esi, dword [0x4aaef8]
jl 0x40d72a
push 0x103
lea eax, [ebp - 0x15f]
mov byte [ebp - 0x160], 0
push 0
push eax
call fcn.00443b90
add esp, 0xc
lea eax, [ebp - 0x160]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x160]
push 0x5c
push eax
call fcn.0043d6b0
pop ecx
pop ecx
lea ebx, [eax + 1]
test eax, eax
jne 0x40d861
lea ebx, [ebp - 0x160]
push str.resume.exe
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x40d932
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop esi
push esi
mov dword [ebp + 8], eax
lea eax, [ebp - 0x5c]
push 0
push eax
call fcn.00443b90
push 0x103
lea eax, [ebp - 0x263]
mov dword [ebp - 0x5c], esi
push 0
push eax
mov byte [ebp - 0x264], 0
call fcn.00443b90
lea edi, [ebp - 0x264]
add esp, 0x18
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d8c2
push 5
pop ecx
mov esi, str.install.exe__resume
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x40d8d7
lea edi, [ebp - 0x264]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40d8e7
mov ecx, ebx
lea eax, [ebp - 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
lea eax, [ebp - 0x5c]
push eax
and ecx, 3
lea eax, [ebp - 0x264]
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
push ecx
push ecx
push ecx
push 1
push ecx
push ecx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d99e
mov eax, dword [0x4aaefc]
push str._uninstall
push dword [eax + 4]
call edi
test eax, eax
jne 0x40d94f
mov ecx, dword [ebp + 8]
call fcn.0040cda9
jmp 0x40d99e
mov eax, dword [0x4aaefc]
push str._cleanup
push dword [eax + 4]
call edi
test eax, eax
jne 0x40d982
mov eax, dword [0x4aaefc]
push dword [eax + 8]
call fcn.0043e4c8
mov edx, dword [0x4aaefc]
pop ecx
mov ecx, eax
mov edx, dword [edx + 0xc]
call fcn.0040d52a
jmp 0x40d99e
mov eax, dword [0x4ae264]
push dword [ebp - 4]
movzx eax, byte [eax + 0xd84f]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.0040cf29
add esp, 0xc
push 0
xor edx, edx
xor ecx, ecx
call fcn.0040694c
pop ecx
call fcn.0040d343
pop esi
pop ebx
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret 0x10