Function at 0x418701
Capabilities:
Accept command line arguments
Create process on windows
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push ebx
push esi
push edi
mov esi, ecx
push dword [0x4825f8]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x482adc
mov ecx, esi
call fcn.0041d6f6
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
mov byte [ebp - 0x198], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x198]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x198]
lea ecx, [ebp - 0x1c]
push eax
call fcn.0041efa5
push 1
push ebx
push 0x42fb94
lea ecx, [ebp - 0x1c]
call fcn.0041f9a1
cmp eax, 0xffffffff
je 0x418787
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
dec ecx
inc eax
push ecx
push eax
lea ecx, [ebp - 0x1c]
call fcn.0041f56f
push 0x44
lea eax, [ebp - 0x94]
pop esi
push esi
push ebx
push eax
call fcn.00428300
push 0x10
lea eax, [ebp - 0x50]
push ebx
push eax
mov dword [ebp - 0x94], esi
call fcn.00428300
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.0041ef35
mov ecx, 0x482adc
call fcn.0041ff07
push eax
lea eax, [ebp - 0x10]
push 0x4300ec
push eax
call fcn.0041f62d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp byte [esi], 0x22
jne 0x4187fd
lea edi, [esi + 1]
push 0x22
push edi
call fcn.004286b0
pop ecx
test eax, eax
pop ecx
je 0x4187fd
push ebx
push 0x22
push edi
call fcn.004286b0
pop ecx
inc eax
pop ecx
jmp 0x418817
push 0x20
push esi
call fcn.004286b0
pop ecx
test eax, eax
pop ecx
je 0x418820
push ebx
inc esi
push 0x20
push esi
call fcn.004286b0
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.0041f20d
lea eax, [ebp - 0x50]
lea ecx, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0041ff07
push eax
push ebx
push 0x4000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x10]
call fcn.0041ff07
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x418873
cmp byte [0x48375c], bl
jne 0x418978
push ebx
push str.Failed_to_launch_installer.__CreateProcess_failed_
push ebx
mov ecx, 0x482408
call fcn.0041e1f3
jmp 0x418978
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp dword [0x482b00], ebx
jle 0x4188b2
push esi
mov ecx, 0x482af4
call fcn.00421fff
mov ecx, eax
call fcn.0041ff07
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc esi
cmp esi, dword [0x482b00]
jl 0x418890
mov edi, 0x482ae8
lea ecx, [ebp - 0x40]
push edi
call fcn.0041f009
push ebx
push str.installer
lea ecx, [ebp - 0x40]
call fcn.0041f20d
lea ecx, [ebp - 0x40]
call fcn.0041ff07
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push eax
call esi
push edi
lea ecx, [ebp - 0x28]
call fcn.0041f009
push ebx
push str._slideshow
lea ecx, [ebp - 0x28]
call fcn.0041f20d
lea ecx, [ebp - 0x28]
call fcn.0041ff07
push eax
call esi
push edi
lea ecx, [ebp - 0x34]
call fcn.0041f009
push ebx
push str.3rd_party
lea ecx, [ebp - 0x34]
call fcn.0041f20d
lea ecx, [ebp - 0x34]
call fcn.0041ff07
push eax
call esi
mov ecx, 0x482ae8
call fcn.0041ff07
push eax
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x50]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], ebx
setne al
cmp byte [0x4837ad], bl
je 0x41895e
cmp al, bl
sete bl
jmp 0x418960
mov bl, al
lea ecx, [ebp - 0x34]
call fcn.0041f06b
lea ecx, [ebp - 0x28]
call fcn.0041f06b
lea ecx, [ebp - 0x40]
call fcn.0041f06b
lea ecx, [ebp - 0x10]
call fcn.0041f06b
lea ecx, [ebp - 0x1c]
call fcn.0041f06b
pop edi
mov al, bl
pop esi
pop ebx
leave
ret