Function at 0x405ff6
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x416c1d
call fcn.0040ef50
sub esp, 0x11c
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
push str.CMainFrame::UnInstall2___n
call fcn.004024eb
pop ecx
lea ebx, [esi + 0x84]
lea eax, [esi + 0x1c]
mov ecx, ebx
push eax
call fcn.00401618
mov ecx, ebx
call fcn.00401b7a
test eax, eax
je 0x40604a
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 2
xor eax, eax
jmp 0x406415
push edi
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push ebx
call fcn.004013ef
mov ecx, esi
call fcn.0040520c
mov edi, 0x420bb0
lea ecx, [ebp - 0x18]
push edi
call fcn.00401595
and dword [ebp - 4], 0
push str.CMainFrame::UnInstall2___Close_icon_n
call fcn.004024eb
pop ecx
push 0x10
call fcn.0040efd0
pop ecx
mov dword [ebp - 0x14], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x4060ce
push ebx
lea eax, [ebp - 0x24]
push str.SoftwareEPSONSTM3Driver_
push eax
call fcn.004017d5
add esp, 0xc
mov dword [ebp - 0x10], 1
push 0x20019
push 0
push 0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00401e04
mov ecx, dword [ebp - 0x14]
push eax
push 0x80000002
call fcn.0040dc20
mov dword [ebp - 0x20], eax
jmp 0x4060d2
and dword [ebp - 0x20], 0
test byte [ebp - 0x10], 1
mov dword [ebp - 4], 1
je 0x4060e7
lea ecx, [ebp - 0x24]
call fcn.00401563
mov eax, dword [ebp - 0x20]
and byte [ebp - 4], 0
cmp dword [eax + 8], 0
je 0x406251
push edi
lea ecx, [ebp - 0x10]
call fcn.00401595
mov ecx, dword [ebp - 0x20]
mov ebx, 0x100
lea eax, [ebp - 0x10]
push ebx
push eax
lea eax, [ebp - 0x14]
push str.E_SENV
push eax
mov byte [ebp - 4], 3
call fcn.0040df98
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.00401618
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00401563
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401563
lea ecx, [ebp - 0x18]
call fcn.00401b7a
test eax, eax
jne 0x406242
lea eax, [ebp - 0x18]
push 0x41c670
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040176a
add esp, 0xc
push edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00401595
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x24]
push str.ModelID
push eax
mov byte [ebp - 4], 6
call fcn.0040df98
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00401563
lea ecx, [ebp - 0x24]
call fcn.00401b7a
test eax, eax
jne 0x4061f9
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push str.__M_
push eax
call fcn.004017d5
add esp, 0xc
push 0x41c3a8
push eax
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.0040176a
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0xa
call fcn.00401a26
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 9
call fcn.00401563
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
call fcn.00401563
push str.CMainFrame::UnInstall2___Execute_e_senv_n
call fcn.004024eb
pop ecx
push 5
lea ecx, [ebp - 0x10]
call fcn.00401e04
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x406228
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 8
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.00401563
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00401563
jmp 0x40625f
push 3
mov dword [esi + 0x74], 0x3c
pop edi
mov dword [esi + 0x70], edi
jmp 0x406262
mov dword [esi + 0x70], 5
mov dword [esi + 0x74], 3
push 3
pop edi
push str.CMainFrame::UnInstall2___delete_registry_EPLTarget_n
call fcn.004024eb
pop ecx
lea eax, [esi + 0x84]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.softwareEPSONSTM3STMDataEPLTarget
call fcn.00401595
and byte [ebp - 4], 0
mov ebx, 0x80000001
push ebx
mov ecx, esi
call fcn.00406423
test eax, eax
jne 0x4062b2
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], 0x3d
push str.CMainFrame::UnInstall2___delete_registry_EPNTarget_n
call fcn.004024eb
pop ecx
lea eax, [esi + 0x84]
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.004013ef
push ecx
mov byte [ebp - 4], 0xc
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.softwareEPSONSTM3STMDataEPNTarget
call fcn.00401595
and byte [ebp - 4], 0
push ebx
mov ecx, esi
call fcn.00406423
test eax, eax
jne 0x4062fd
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], 0x3e
mov eax, dword [esi + 0x78]
cmp eax, 2
je 0x406309
cmp eax, edi
jne 0x406310
mov ecx, esi
call fcn.00405230
mov ecx, esi
call fcn.0040565c
mov ecx, esi
call fcn.004067c9
mov ecx, esi
call fcn.0040cb86
mov ecx, esi
call fcn.0040c074
mov ecx, esi
call fcn.00405b2c
test eax, eax
je 0x40634b
push str.CMainFrame::UnInstall2___delete_registry_n
call fcn.004024eb
pop ecx
mov ecx, esi
call fcn.00405d23
jmp 0x4063b0
push str.CMainFrame::UnInstall2___Execute_e_senv_n
call fcn.004024eb
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00401b7a
test eax, eax
jne 0x4063b0
lea eax, [ebp - 0x18]
push 0x41c60c
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0040176a
add esp, 0xc
push 5
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.00401e04
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
lea ecx, [ebp - 0x1c]
sbb ebx, ebx
and byte [ebp - 4], 0
neg ebx
call fcn.00401563
test bl, bl
je 0x4063b0
mov dword [esi + 0x70], 4
mov dword [esi + 0x74], 7
push str.CMainFrame::UnInstall2___delete_shortcut_icon_n
call fcn.004024eb
pop ecx
mov ecx, esi
call fcn.00405916
test eax, eax
je 0x4063e8
lea eax, [ebp - 0x128]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x128]
mov ecx, esi
push eax
call fcn.0040b536
push str.CMainFrame::UnInstall2___uninstall_ebapi_n
call fcn.004024eb
pop ecx
mov ecx, esi
call fcn.00408616
push str.CMainFrame::UnInstall2___exit_n
call fcn.004024eb
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00401563
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret