Function at 0x4017c4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46c390]
sub esp, 0x15c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x401805
mov eax, dword [0x46c390]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0043b69e
pop ecx
push eax
call fcn.00401786
pop ecx
pop ecx
jmp 0x401ad7
call fcn.00401546
test eax, eax
je 0x401ad7
xor eax, eax
push ebx
inc eax
xor ebx, ebx
cmp dword [0x46c38c], eax
push edi
mov dword [ebp - 4], eax
jl 0x401911
mov edi, 0x454b50
mov esi, dword [ebp - 4]
mov eax, dword [0x46c390]
push str._path
shl esi, 2
push dword [esi + eax]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x46c390]
je 0x401894
push edi
push dword [esi + eax]
call fcn.0043b6bf
push edi
push ebx
call fcn.0043b6bf
mov ecx, dword [0x46d5b8]
add esp, 0x10
mov esi, eax
add ecx, 0x8a44
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x401870
mov ecx, dword [0x46d5b8]
mov edx, eax
add ecx, 0x91dd
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x401888
jmp 0x4018f9
push str._silent
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4018af
mov byte [0x46d5b5], 1
jmp 0x4018f9
mov eax, dword [0x46c390]
push str._resume
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4018d6
mov byte [0x46d5b5], 1
mov byte [0x46d5b6], 1
jmp 0x4018f9
mov eax, dword [0x46c390]
push str._noui
push dword [esi + eax]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4018f9
mov eax, dword [0x46d5b8]
mov byte [eax + 0xafaa], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x46c38c]
jle 0x40182d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x103
lea eax, [ebp - 0x15b]
push ebx
push eax
mov byte [ebp - 0x15c], bl
call fcn.004454d0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x15c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push str.resume.exe
push eax
call fcn.00401000
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x401a65
lea eax, [ebp - 0x15c]
push 0x454b78
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x40198b
push ebx
push ebx
push dword [0x46d5b8]
push 0x15
call fcn.004044dd
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x454b84
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x4019b6
push ebx
push ebx
push dword [0x46d5b8]
push 0x16
call fcn.004044dd
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x454b90
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x4019e1
push ebx
push ebx
push dword [0x46d5b8]
push 0x17
call fcn.004044dd
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x454b9c
push eax
call fcn.00401000
pop ecx
push eax
call esi
test eax, eax
jne 0x401a0c
push ebx
push ebx
push dword [0x46d5b8]
push 0x18
call fcn.004044dd
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop esi
push esi
mov edi, eax
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.004454d0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push str.install.exe__resume
push ebx
mov dword [ebp - 0x58], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401ac5
mov eax, dword [0x46c390]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x401a82
push dword [ebp + 8]
call fcn.0040116c
jmp 0x401ac4
mov eax, dword [0x46c390]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x401aae
mov eax, dword [0x46c390]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.0043b69e
pop ecx
push eax
call fcn.00401786
jmp 0x401ac3
mov eax, dword [0x46d5b8]
movzx eax, byte [eax + 0xafaa]
push eax
push dword [ebp + 8]
call fcn.0040130a
pop ecx
pop ecx
push ebx
push ebx
xor edi, edi
call fcn.0041bab4
pop ecx
pop ecx
call fcn.004015a5
pop edi
pop ebx
xor eax, eax
pop esi
leave
ret 0x10