Function at 0x416450
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e458
mov eax, dword fs:[0]
push eax
sub esp, 0xa74
mov eax, dword [0x4786a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
mov dword [ebp - 4], ebx
push ecx
mov byte [ebp - 0xa19], bl
mov word [ebp - 0x218], ax
call fcn.00449910
push 0x7fe
lea eax, [ebp - 0xa16]
xor edx, edx
push ebx
push eax
mov word [ebp - 0xa18], dx
call fcn.00449910
add esp, 0x18
lea ecx, [ebp - 0x218]
push ecx
push ebx
push ebx
xor eax, eax
push 0x25
push ebx
mov dword [ebp - 0xa30], eax
mov dword [ebp - 0xa2c], eax
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa24], eax
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
test eax, eax
js 0x416737
push 0x46a86c
lea edx, [ebp - 0x218]
push 0x104
push edx
call fcn.004461f0
push 0x4695fc
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.004461f0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0xa18]
push 0x400
push edx
call fcn.004461f0
push 0x46a888
lea eax, [ebp - 0xa18]
push 0x400
push eax
call fcn.004461f0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xa18]
push 0x400
push edx
call fcn.004461f0
push 0x44
lea eax, [ebp - 0xa80]
push ebx
push eax
call fcn.00449910
add esp, 0x48
xor ecx, ecx
cmp byte [ebp + 0xc], bl
lea edx, [ebp - 0xa30]
push edx
lea eax, [ebp - 0xa80]
push eax
push ebx
push ebx
setne cl
push 0xc000020
push ebx
push ebx
push ebx
mov dword [ebp - 0xa80], 0x44
mov dword [ebp - 0xa54], 1
mov word [ebp - 0xa50], cx
lea ecx, [ebp - 0xa18]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4165fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x104], eax
lea edi, [esi + 0x100]
cmp eax, ebx
je 0x4165ef
push eax
push str.CreateProcess_failed._Error:__d.
call fcn.00422e30
add esp, 8
jmp 0x416737
mov edx, str.CreateProcess_failed.
call fcn.004011b0
jmp 0x416737
push ebx
push ecx
mov edx, esp
mov dword [ebp - 0xa34], esp
push edx
mov ecx, str.msiexec.exe
call fcn.00401110
call fcn.00416870
xor ebx, ebx
cmp al, bl
je 0x416669
mov eax, dword [ebp - 0xa30]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x416669
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x104], eax
lea edi, [esi + 0x100]
cmp eax, ebx
je 0x41665a
push eax
push str.WaitForSingleObject_failed._Error:__d.
call fcn.00422e30
add esp, 8
jmp 0x416737
mov edx, str.WaitForSingleObject_failed.
call fcn.004011b0
jmp 0x416737
mov edx, dword [ebp - 0xa30]
lea ecx, [ebp - 0xa20]
push ecx
push edx
mov dword [ebp - 0xa20], ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x4166bc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x104], eax
lea edi, [esi + 0x100]
cmp eax, ebx
je 0x4166b0
push eax
push str.GetExitCodeProcess_failed._Error:__d.
call fcn.00422e30
add esp, 8
jmp 0x416737
mov edx, str.GetExitCodeProcess_failed.
call fcn.004011b0
jmp 0x416737
mov eax, dword [ebp - 0xa20]
cmp eax, ebx
je 0x416730
cmp eax, 0x103
je 0x416730
cmp eax, 0x642
jne 0x4166ee
mov dword [esi + 0x104], ebx
mov byte [esi + 0x109], 1
add esi, 0x100
call fcn.004013e0
jmp 0x416737
cmp byte [ebp + 0xc], bl
jne 0x41671d
cmp eax, ebx
jle 0x416701
and eax, 0xffff
or eax, 0x80070000
push eax
push str._The_installation_failed._Error:__d.
lea edi, [esi + 0x100]
mov dword [esi + 0x104], eax
call fcn.00422e30
add esp, 8
jmp 0x416737
mov dword [esi + 0x104], ebx
add esi, 0x100
call fcn.004013e0
jmp 0x416737
mov byte [ebp - 0xa19], 1
mov eax, dword [ebp - 0xa30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x41674a
push eax
call esi
mov eax, dword [ebp - 0xa2c]
test eax, eax
je 0x416757
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41677d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp - 0xa19]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445447
mov esp, ebp
pop ebp
ret 8