Function at 0x403f1f
Capabilities:
Accept command line arguments
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push esi
push edi
push 6
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 8
push eax
mov dword [esp + 0x30], 0x20
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
sub esp, 0xc
call fcn.0040514d
test eax, eax
jns 0x403f82
push 0x10
push esi
push str.Initialization_failed.
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4041df
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x18], 2
mov edi, eax
je 0x403fa4
cmp dword [esp + 0x18], 3
jne 0x403fcc
push 0x41bdf0
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x403fcc
cmp dword [esp + 0x18], 3
jne 0x403fc0
mov esi, dword [edi + 8]
mov ecx, esi
call fcn.00403e6e
jmp 0x4041df
call fcn.00401f84
push eax
lea ecx, [esp + 0x28]
call fcn.00401d98
call fcn.00401581
test al, al
mov edx, str.46C3BCD6_F992_4D94_9C03_4960FF5F5A81
mov ecx, str.7DABE060_FEE3_405e_9CE3_99578A7F88A1
cmove ecx, edx
push ecx
lea ecx, [esp + 0x24]
call fcn.00401c28
push str.InstallLocation
lea ecx, [esp + 0x14]
call fcn.00401c28
lea eax, [esp + 0x24]
push eax
lea edx, [esp + 0x14]
lea ecx, [esp + 0x24]
call fcn.00401659
pop ecx
mov ecx, dword [esp + 0x10]
mov bl, al
add ecx, 0xfffffff0
call fcn.00402350
test bl, bl
je 0x4040c8
cmp dword [esp + 0x18], 2
jne 0x404055
push 0x41beb8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x404055
push esi
call fcn.004039c7
pop ecx
jmp 0x4041c2
push esi
lea ecx, [esp + 0x34]
call fcn.00403708
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004042b0
cmp eax, 2
je 0x4041b9
push esi
call fcn.004039c7
pop ecx
test al, al
je 0x4041b9
push str.Installation_succeeded.
lea ecx, [esp + 0x14]
call fcn.00401c28
push esi
lea eax, [esp + 0x14]
push eax
push 0x6e
pop edx
lea ecx, [esp + 0x1c]
call fcn.00401292
pop ecx
xor edx, edx
mov ecx, eax
call fcn.0040130e
pop ecx
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0x10]
jmp 0x4041b1
push 1
call fcn.004039c7
pop ecx
push 1
lea ecx, [esp + 0x34]
call fcn.00403708
push ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [esp + 0x38]
call fcn.004042b0
cmp eax, 6
jne 0x4041b9
push str.OutlookFreeware.com_Runtime_is_not_installed_on_this_machine__it_is_required_to_install_and_run_this_utility._n_nYou_will_be_redirected_to_OutlookFreeware.com_Runtime_download_page_now.
lea ecx, [esp + 0x14]
call fcn.00401c28
push 0x65
lea eax, [esp + 0x14]
push eax
push 0x6a
pop edx
lea ecx, [esp + 0x24]
call fcn.00401292
pop ecx
xor edx, edx
mov ecx, eax
call fcn.0040130e
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402350
push 0x41c08c
lea ecx, [esp + 0x14]
call fcn.00401c28
push str._runtime.aspx_srcss
lea eax, [esp + 0x14]
push eax
push 0x74
pop edx
lea ecx, [esp + 0x30]
call fcn.00401292
pop ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00404252
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.004018d8
pop ecx
mov ecx, dword [esp + 0x1c]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0x28]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.00402350
push 1
push esi
push esi
push dword [esp + 0x20]
push str.open
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
call fcn.00402350
lea ecx, [esp + 0x30]
call fcn.00403915
call fcn.004050bb
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0x24]
lea ecx, [ecx - 0x10]
call fcn.00402350
mov ecx, dword [esp + 0xdc]
xor eax, eax
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040743d
mov esp, ebp
pop ebp
ret 0x10