Function at 0x403160
Capabilities:
Create process on windows
Delete directory
Delete file
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x53b7e6
mov eax, dword fs:[0]
push eax
mov eax, 0x100b4
call fcn.0050cf70
mov eax, dword [0x58b998]
xor eax, esp
mov dword [esp + 0x100b0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x58b998]
xor eax, esp
push eax
lea eax, [esp + 0x100c8]
mov dword fs:[0], eax
mov ebp, ecx
cmp dword [ebp + 0xec], 0
jne 0x4033d2
call fcn.0040e9b0
mov esi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 0x568ab8
call esi
push str.UESaveAndClose
mov ebx, eax
call esi
push ebp
mov dword [esp + 0x18], eax
call fcn.004038f0
mov esi, eax
test esi, esi
je 0x40320c
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
nop
push 0
push 0
push ebx
push esi
call edi
mov ecx, dword [esp + 0x14]
push 0
push 0
push ecx
push eax
call edi
push 0
push 0
push ebx
push esi
call edi
test eax, eax
jne 0x4031f4
push ebp
call fcn.004038f0
mov esi, eax
test esi, esi
jne 0x4031e0
xor edx, edx
push 0xfffe
push edx
lea eax, [esp + 0xce]
push eax
mov word [esp + 0xd0], dx
call fcn.0050cfa0
push 0x44
lea ecx, [esp + 0x38]
push 0
push ecx
call fcn.0050cfa0
xor eax, eax
push str.msiexec
lea edx, [esp + 0xe0]
push 0x7fff
push edx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0x44
call fcn.0050c53d
push str.__i__
lea eax, [esp + 0xec]
push 0x7fff
push eax
call fcn.0050c5ac
lea edi, [ebp + 0xb0]
mov ebp, 8
add esp, 0x30
cmp dword [edi + 0x18], ebp
jb 0x403297
mov eax, dword [edi + 4]
jmp 0x40329a
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0xc8]
push 0x7fff
push ecx
call fcn.0050c5ac
push 0x568af8
lea edx, [esp + 0xd4]
push 0x7fff
push edx
call fcn.0050c5ac
add esp, 0x18
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push 0x20
push ebx
push ebx
push ebx
lea edx, [esp + 0xe4]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x403325
lea ecx, [esp + 0x88]
call fcn.00408560
push 2
lea ecx, [esp + 0x8c]
mov dword [esp + 0x100d4], ebx
call fcn.00408e30
lea esi, [esp + 0x88]
mov dword [esp + 0x100d0], 0xffffffff
call fcn.00403400
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x4033d7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [edi + 0x18], ebp
jb 0x403344
mov eax, dword [edi + 4]
jmp 0x403347
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xffffffffffffffff
push ebx
xor eax, eax
push edi
lea ecx, [esp + 0x78]
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], ebx
mov word [esp + 0x7c], ax
call fcn.00401620
push 1
push 0xffffffffffffffff
push 0x568a54
lea ecx, [esp + 0x78]
mov dword [esp + 0x100dc], 1
call fcn.00403c00
cmp eax, 0xffffffff
je 0x4033a2
push 0xffffffffffffffff
push eax
lea ecx, [esp + 0x74]
call fcn.004019c0
mov eax, dword [esp + 0x70]
cmp dword [esp + 0x84], ebp
jae 0x4033b3
lea eax, [esp + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp dword [esp + 0x84], ebp
jb 0x4033d7
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0040dd3a
add esp, 4
jmp 0x4033d7
call fcn.0040e995
mov ecx, dword [esp + 0x100c8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100b0]
xor ecx, esp
call fcn.0050bda6
add esp, 0x100c0
ret