Function at 0x415ed4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x45562b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
push ebx
push esi
push edi
mov eax, dword [0x46fd08]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 0x474ce8
mov edx, str.InstallScanEvent
mov ecx, edi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebx
call fcn.00402d99
mov edx, str.InstallScanResultUrl
mov ecx, edi
mov esi, eax
call fcn.00402d99
cmp dword [0x474bc0], ebx
mov dword [esp + 0x30], eax
jne 0x4167b8
cmp esi, ebx
je 0x416590
cmp eax, ebx
je 0x416590
mov edx, 0x45d5e4
mov ecx, edi
mov dword [esp + 0x4c], 1
call fcn.00402d99
cmp eax, ebx
je 0x41614e
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0040154d
mov dword [esp + 0xb4], ebx
or dword [esp + 0xb4], 0xffffffff
lea ebx, [esp + 0x14]
call fcn.004157a5
pop ecx
mov dword [esp + 0xb0], 1
push 0x5c
mov esi, ebx
call fcn.00409761
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.004098d5
mov byte [esp + 0xb0], 2
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x24]
push eax
call fcn.00409782
mov byte [esp + 0xb0], 3
call fcn.004095a4
push 0x22
mov ecx, ebx
call fcn.004042be
push str.__installresults
mov ecx, ebx
call fcn.00409b0f
xor ebx, ebx
cmp byte [ebp + 8], bl
jne 0x41600b
push str.__close
mov ecx, esi
call fcn.00409b0f
mov edx, str.LaunchAs
mov ecx, edi
xor esi, esi
call fcn.00402d99
cmp eax, ebx
je 0x41605d
push str.AsInvoker
push eax
call fcn.00437e0a
test eax, eax
pop ecx
pop ecx
jne 0x41605d
push 3
push 5
inc esi
call fcn.00415732
test al, al
pop ecx
pop ecx
je 0x41605d
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x28]
call fcn.00416a46
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x416103
push 0x40
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x68], 0x44
call fcn.00437d90
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.004061e7
mov byte [esp + 0xb0], 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
call fcn.00414cfc
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
mov edi, eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0040d9aa
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call fcn.0040d9aa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x4160f2
push dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x38]
call esi
mov byte [esp + 0xb0], 3
lea ecx, [esp + 0x24]
call fcn.00401b5e
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.0040549a
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.0040549a
mov byte [esp + 0xb0], 2
lea ecx, [esp + 0x20]
call fcn.00401b5e
mov byte [esp + 0xb0], 1
lea ecx, [esp + 0x14]
call fcn.00401b5e
or dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401b5e
xor ebx, ebx
lea ecx, [esp + 0x28]
call fcn.004061e7
mov dword [esp + 0xb0], 5
lea eax, [esp + 0x1c]
push eax
push 0x474b18
call fcn.0040ef98
mov byte [esp + 0xb0], 6
push dword [eax]
lea eax, [esp + 0x2c]
push str.SOFTWARESlimWare_Utilities_Inc_s
push eax
call fcn.0040247e
add esp, 0xc
mov byte [esp + 0xb0], 5
lea ecx, [esp + 0x1c]
call fcn.00401b5e
mov dword [esp + 0x14], ebx
mov byte [esp + 0xb0], 7
lea eax, [esp + 0x20]
push eax
push 0x20019
push ebx
push dword [esp + 0x34]
mov dword [esp + 0x30], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x416569
lea ecx, [esp + 0x14]
call fcn.004067c8
cmp eax, ebx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
jne 0x416569
lea ecx, [esp + 0x24]
call fcn.004061e7
mov byte [esp + 0xb0], 8
lea ecx, [esp + 0x18]
call fcn.004061e7
mov byte [esp + 0xb0], 9
lea ecx, [esp + 0x2c]
call fcn.004061e7
mov byte [esp + 0xb0], 0xa
push str.InstallScanID
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
xor edi, edi
mov dword [esp + 0x18], ebx
call fcn.00406761
test eax, eax
jne 0x41626a
push dword [esp + 0x10]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x4c], 1
call fcn.00409aec
push str.InstallScanID
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
call fcn.00406761
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.0040549a
push str.InstallScanUrlParams
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
xor edi, edi
mov dword [esp + 0x18], ebx
call fcn.00406761
test eax, eax
jne 0x4162b9
push dword [esp + 0x10]
lea ecx, [esp + 0x30]
call fcn.00409aec
push str.InstallScanUrlParams
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
call fcn.00406761
push 0xffffffffffffffff
lea ecx, [esp + 0x30]
call fcn.0040549a
lea edi, [esp + 0x2c]
call fcn.00416cf4
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x416306
lea eax, [esp + 0x1c]
push eax
call fcn.00415d88
pop ecx
mov byte [esp + 0xb0], 0xb
push dword [esp + 0x2c]
push dword [eax]
lea eax, [esp + 0x2c]
push dword [esp + 0x20]
push dword [esp + 0x3c]
push 0x4607e4
push eax
call fcn.0040247e
add esp, 0x18
mov byte [esp + 0xb0], 0xa
lea ecx, [esp + 0x1c]
call fcn.00401b5e
lea eax, [esp + 0x20]
push eax
call fcn.0041596f
pop ecx
mov byte [esp + 0xb0], 0xc
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], ebx
mov eax, dword [esp + 0x24]
je 0x41650f
cmp dword [eax - 0xc], ebx
je 0x416525
lea edi, [esp + 0x1c]
call fcn.004170f4
mov byte [esp + 0xb0], 0xd
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x24]
call fcn.00416dac
mov byte [esp + 0xb4], 0xe
mov dword [esp], 0x460814
push eax
lea eax, [esp + 0x60]
push eax
call fcn.00405250
add esp, 0xc
mov byte [esp + 0xb0], 0xf
lea ecx, [esp + 0x24]
push ecx
push eax
lea eax, [esp + 0x58]
push eax
call fcn.00416d55
add esp, 0xc
mov byte [esp + 0xb0], 0x10
mov eax, dword [eax]
mov ecx, edi
push ecx
push eax
lea eax, [esp + 0x5c]
push eax
call fcn.0041714c
add esp, 0xc
mov byte [esp + 0xb0], 0x11
mov eax, dword [eax]
cmp eax, ebx
je 0x4163b7
mov eax, dword [eax]
jmp 0x4163b9
xor eax, eax
push eax
lea ecx, [esp + 0x14]
call fcn.0040154d
mov byte [esp + 0xb0], 0x13
lea edi, [esp + 0x54]
call fcn.004170b4
mov byte [esp + 0xb0], 0x14
lea ecx, [esp + 0x50]
call fcn.00401b5e
mov byte [esp + 0xb0], 0x15
lea ecx, [esp + 0x58]
call fcn.00401b5e
mov byte [esp + 0xb0], 0x16
lea ecx, [esp + 0x34]
call fcn.00401b5e
mov byte [esp + 0xb0], 0x17
lea edi, [esp + 0x1c]
call fcn.004170b4
push 0x40
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x68], 0x44
call fcn.00437d90
add esp, 0xc
lea ecx, [esp + 0x30]
mov dword [esp + 0x88], 1
mov word [esp + 0x8c], 3
call fcn.004061e7
mov byte [esp + 0xb0], 0x18
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
call fcn.00414cfc
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x30]
lea ecx, [esp + 0x10]
mov esi, eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x60]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040d9aa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.0040549a
mov ecx, dword [0x474b38]
push ebx
call fcn.00427865
push 0xea60
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x4164d5
push ebx
push 0x415eb2
push dword [esp + 0x4c]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x4164eb
push dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x38]
call esi
mov byte [esp + 0xb0], 0x17
lea ecx, [esp + 0x30]
call fcn.00401b5e
mov byte [esp + 0xb0], 0xc
lea ecx, [esp + 0x10]
call fcn.00401b5e
jmp 0x416525
cmp dword [eax - 0xc], ebx
je 0x416525
push 3
push ebx
push ebx
push eax
push 0x45fba8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0xb0], 0xa
lea ecx, [esp + 0x20]
call fcn.00401b5e
mov byte [esp + 0xb0], 9
lea ecx, [esp + 0x2c]
call fcn.00401b5e
mov byte [esp + 0xb0], 8
lea ecx, [esp + 0x18]
call fcn.00401b5e
mov byte [esp + 0xb0], 7
lea ecx, [esp + 0x24]
call fcn.00401b5e
mov byte [esp + 0xb0], 5
lea ecx, [esp + 0x14]
call fcn.004067c8
or dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.00401b5e
jmp 0x4167b8
cmp byte [ebp + 8], bl
je 0x4167b8
mov edx, 0x45d5e4
mov ecx, edi
call fcn.00402d99
cmp eax, ebx
je 0x4167b8
push ecx
mov ecx, esp
mov dword [esp + 0x38], esp
push eax
call fcn.0040154d
mov dword [esp + 0xb4], 0x19
or dword [esp + 0xb4], 0xffffffff
lea ebx, [esp + 0x14]
call fcn.004157a5
pop ecx
mov dword [esp + 0xb0], 0x1a
push 0x5c
mov esi, ebx
call fcn.00409761
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.004098d5
mov byte [esp + 0xb0], 0x1b
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x18]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00409782
mov byte [esp + 0xb0], 0x1c
call fcn.004095a4
push 0x22
mov ecx, ebx
call fcn.004042be
mov edx, str.LaunchAs
mov ecx, edi
xor ebx, ebx
xor esi, esi
call fcn.00402d99
cmp eax, ebx
je 0x416696
push str.AsInvoker
push eax
call fcn.00437e0a
test eax, eax
pop ecx
pop ecx
jne 0x416696
push 3
push 5
inc esi
call fcn.00415732
test al, al
pop ecx
pop ecx
je 0x416696
push dword [esp + 0x10]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call fcn.00416a46
mov ecx, dword [0x474b38]
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
push ebx
inc edi
call fcn.00427865
cmp edi, ebx
jne 0x41676d
push 0x40
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x68], 0x44
call fcn.00437d90
add esp, 0xc
lea ecx, [esp + 0x28]
call fcn.004061e7
mov byte [esp + 0xb0], 0x1d
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
call fcn.00414cfc
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
mov edi, eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.0040d9aa
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call fcn.0040d9aa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [0x474b38]
push ebx
mov esi, eax
call fcn.00427865
push 0xea60
push dword [esp + 0x3c]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x416746
push ebx
push 0x415eb2
push dword [esp + 0x4c]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x41675c
push dword [esp + 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x38]
call esi
mov byte [esp + 0xb0], 0x1c
lea ecx, [esp + 0x28]
call fcn.00401b5e
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.0040549a
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.0040549a
mov byte [esp + 0xb0], 0x1b
lea ecx, [esp + 0x1c]
call fcn.00401b5e
mov byte [esp + 0xb0], 0x1a
lea ecx, [esp + 0x18]
call fcn.00401b5e
or dword [esp + 0xb0], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401b5e
xor ebx, ebx
mov ecx, dword [0x474b38]
xor eax, eax
cmp dword [0x474bc0], ebx
setne al
inc eax
push eax
call fcn.00426d3b
cmp dword [0x474bc0], ebx
jne 0x416837
cmp byte [ebp + 0xc], bl
je 0x416837
cmp dword [esp + 0x4c], ebx
je 0x41680f
cmp dword [esp + 0x48], ebx
mov eax, 0x45cf00
jne 0x4167f3
mov eax, 0x46013c
mov edx, dword [0x474cb4]
push ebx
push eax
push str.ScanFinished
push str.InstallFinishedButton
call fcn.0040618f
add esp, 0x10
jmp 0x416822
mov edx, dword [0x474cb4]
push ebx
push str.InstallFinishedButton
call fcn.0040618f
pop ecx
pop ecx
mov ecx, dword [0x474cb8]
cmp ecx, ebx
je 0x416837
push ebx
push str.InstallerFinishedButton
call fcn.00413fc4
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret