Function at 0x41601b
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x455498
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x46fd08]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 0x474cc8
mov edx, str.InstallScanEvent
mov ecx, edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call fcn.00402d59
mov edx, str.InstallScanResultUrl
mov ecx, edi
mov esi, eax
call fcn.00402d59
cmp dword [0x474ba0], ebx
mov dword [esp + 0x24], eax
jne 0x416857
cmp esi, ebx
je 0x41662f
cmp eax, ebx
je 0x41662f
mov edx, 0x45d744
mov ecx, edi
mov dword [esp + 0x30], 1
call fcn.00402d59
cmp eax, ebx
je 0x416295
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00401541
mov dword [esp + 0xa4], ebx
or dword [esp + 0xa4], 0xffffffff
lea ebx, [esp + 0x14]
call fcn.00415914
pop ecx
mov dword [esp + 0xa0], 1
push 0x5c
mov esi, ebx
call fcn.004099d1
push eax
lea eax, [esp + 0x18]
push eax
mov ecx, ebx
call fcn.00409b4d
mov byte [esp + 0xa0], 2
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x14]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004099f2
mov byte [esp + 0xa0], 3
call fcn.00409814
push 0x22
mov ecx, ebx
call fcn.0040427e
push str.__installresults
mov ecx, ebx
call fcn.00409d87
xor ebx, ebx
cmp byte [ebp + 8], bl
jne 0x416152
push str.__close
mov ecx, esi
call fcn.00409d87
mov edx, 0x45d770
mov ecx, edi
xor esi, esi
call fcn.00402d59
cmp eax, ebx
je 0x4161a4
push 0x45d784
push eax
call fcn.00437c6a
test eax, eax
pop ecx
pop ecx
jne 0x4161a4
push 3
push 5
inc esi
call fcn.004158a1
test al, al
pop ecx
pop ecx
je 0x4161a4
push dword [esp + 0x10]
push dword [esp + 0x18]
push dword [esp + 0x30]
call fcn.00416ae5
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x41624a
push 0x40
lea eax, [esp + 0x54]
push ebx
push eax
mov dword [esp + 0x58], 0x44
call fcn.00437bf0
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.00401b4c
mov byte [esp + 0xa0], 4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x24]
call fcn.00414e6b
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x20]
lea ecx, [esp + 0x14]
mov edi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00409a4a
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call fcn.00409a4a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x416239
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 3
lea ecx, [esp + 0x20]
call fcn.00406294
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405539
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.00405539
mov byte [esp + 0xa0], 2
lea ecx, [esp + 0x28]
call fcn.00406294
mov byte [esp + 0xa0], 1
lea ecx, [esp + 0x14]
call fcn.00406294
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00406294
xor ebx, ebx
lea ecx, [esp + 0x2c]
call fcn.00401b4c
mov dword [esp + 0xa0], 5
lea eax, [esp + 0x28]
push eax
push 0x474af8
call fcn.0040f2b3
mov byte [esp + 0xa0], 6
push dword [eax]
lea eax, [esp + 0x30]
push str.SOFTWARESlimWare_Utilities_Inc_s
push eax
call fcn.00402475
add esp, 0xc
mov byte [esp + 0xa0], 5
lea ecx, [esp + 0x28]
call fcn.00406294
mov dword [esp + 0x14], ebx
mov byte [esp + 0xa0], 7
lea eax, [esp + 0x28]
push eax
push 0x20019
push ebx
push dword [esp + 0x38]
mov dword [esp + 0x38], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x416608
lea ecx, [esp + 0x14]
call fcn.0040688f
cmp eax, ebx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
jne 0x416608
lea ecx, [esp + 0x20]
call fcn.00401b4c
mov byte [esp + 0xa0], 8
lea ecx, [esp + 0x1c]
call fcn.00401b4c
mov byte [esp + 0xa0], 9
lea ecx, [esp + 0x18]
call fcn.00401b4c
mov byte [esp + 0xa0], 0xa
push str.InstallScanID
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
xor edi, edi
mov dword [esp + 0x18], ebx
call fcn.00406828
test eax, eax
jne 0x4163b1
push dword [esp + 0x10]
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 1
call fcn.00409d64
push str.InstallScanID
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
call fcn.00406828
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00405539
push str.InstallScanUrlParams
lea eax, [esp + 0x18]
push eax
lea esi, [esp + 0x18]
xor edi, edi
mov dword [esp + 0x18], ebx
call fcn.00406828
test eax, eax
jne 0x416400
push dword [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.00409d64
push str.InstallScanUrlParams
lea ecx, [esp + 0x18]
push ecx
mov edi, eax
call fcn.00406828
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00405539
lea edi, [esp + 0x18]
call fcn.00416dba
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], ebx
je 0x41644d
lea eax, [esp + 0x10]
push eax
call fcn.00415ef7
pop ecx
mov byte [esp + 0xa0], 0xb
push dword [esp + 0x18]
push dword [eax]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push dword [esp + 0x30]
push 0x460914
push eax
call fcn.00402475
add esp, 0x18
mov byte [esp + 0xa0], 0xa
lea ecx, [esp + 0x10]
call fcn.00406294
lea eax, [esp + 0x28]
push eax
call fcn.00415ade
pop ecx
mov byte [esp + 0xa0], 0xc
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], ebx
mov eax, dword [esp + 0x20]
je 0x4165ae
cmp dword [eax - 0xc], ebx
je 0x4165c4
push 0x45e0fc
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.004052ef
add esp, 0xc
mov byte [esp + 0xa0], 0xd
lea ecx, [esp + 0x20]
push ecx
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00416e1b
add esp, 0xc
mov byte [esp + 0xa0], 0xf
lea ecx, [esp + 0x38]
call fcn.00406294
push 0x40
lea eax, [esp + 0x54]
push ebx
push eax
mov dword [esp + 0x58], 0x44
call fcn.00437bf0
add esp, 0xc
lea ecx, [esp + 0x24]
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], 3
call fcn.00401b4c
mov byte [esp + 0xa0], 0x10
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
call fcn.00414e6b
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
lea ecx, [esp + 0x10]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00409a4a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.00405539
mov ecx, dword [0x474b18]
push ebx
call fcn.004276c7
push 0xea60
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x416574
push ebx
push 0x415ffa
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x41658a
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 0xf
lea ecx, [esp + 0x24]
call fcn.00406294
mov byte [esp + 0xa0], 0xc
lea ecx, [esp + 0x10]
call fcn.00406294
jmp 0x4165c4
cmp dword [eax - 0xc], ebx
je 0x4165c4
push 3
push ebx
push ebx
push eax
push 0x45fcd8
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0xa0], 0xa
lea ecx, [esp + 0x28]
call fcn.00406294
mov byte [esp + 0xa0], 9
lea ecx, [esp + 0x18]
call fcn.00406294
mov byte [esp + 0xa0], 8
lea ecx, [esp + 0x1c]
call fcn.00406294
mov byte [esp + 0xa0], 7
lea ecx, [esp + 0x20]
call fcn.00406294
mov byte [esp + 0xa0], 5
lea ecx, [esp + 0x14]
call fcn.0040688f
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x2c]
call fcn.00406294
jmp 0x416857
cmp byte [ebp + 8], bl
je 0x416857
mov edx, 0x45d744
mov ecx, edi
call fcn.00402d59
cmp eax, ebx
je 0x416857
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00401541
mov dword [esp + 0xa4], 0x11
or dword [esp + 0xa4], 0xffffffff
lea ebx, [esp + 0x14]
call fcn.00415914
pop ecx
mov dword [esp + 0xa0], 0x12
push 0x5c
mov esi, ebx
call fcn.004099d1
push eax
lea eax, [esp + 0x20]
push eax
mov ecx, ebx
call fcn.00409b4d
mov byte [esp + 0xa0], 0x13
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x1c]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004099f2
mov byte [esp + 0xa0], 0x14
call fcn.00409814
push 0x22
mov ecx, ebx
call fcn.0040427e
mov edx, 0x45d770
mov ecx, edi
xor ebx, ebx
xor esi, esi
call fcn.00402d59
cmp eax, ebx
je 0x416735
push 0x45d784
push eax
call fcn.00437c6a
test eax, eax
pop ecx
pop ecx
jne 0x416735
push 3
push 5
inc esi
call fcn.004158a1
test al, al
pop ecx
pop ecx
je 0x416735
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x30]
call fcn.00416ae5
mov ecx, dword [0x474b18]
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
push ebx
inc edi
call fcn.004276c7
cmp edi, ebx
jne 0x41680c
push 0x40
lea eax, [esp + 0x54]
push ebx
push eax
mov dword [esp + 0x58], 0x44
call fcn.00437bf0
add esp, 0xc
lea ecx, [esp + 0x2c]
call fcn.00401b4c
mov byte [esp + 0xa0], 0x15
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
call fcn.00414e6b
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x2c]
lea ecx, [esp + 0x1c]
mov edi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.00409a4a
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call fcn.00409a4a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [0x474b18]
push ebx
mov esi, eax
call fcn.004276c7
push 0xea60
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x4167e5
push ebx
push 0x415ffa
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x4167fb
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 0x14
lea ecx, [esp + 0x2c]
call fcn.00406294
push 0xffffffffffffffff
lea ecx, [esp + 0x14]
call fcn.00405539
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.00405539
mov byte [esp + 0xa0], 0x13
lea ecx, [esp + 0x28]
call fcn.00406294
mov byte [esp + 0xa0], 0x12
lea ecx, [esp + 0x1c]
call fcn.00406294
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00406294
xor ebx, ebx
mov ecx, dword [0x474b18]
xor eax, eax
cmp dword [0x474ba0], ebx
setne al
inc eax
push eax
call fcn.00426b9d
cmp dword [0x474ba0], ebx
jne 0x4168d6
cmp byte [ebp + 0xc], bl
je 0x4168d6
cmp dword [esp + 0x30], ebx
je 0x4168ae
cmp dword [esp + 0x34], ebx
mov eax, 0x45d060
jne 0x416892
mov eax, 0x46026c
mov edx, dword [0x474c94]
push ebx
push eax
push str.ScanFinished
push str.InstallFinishedButton
call fcn.0040623c
add esp, 0x10
jmp 0x4168c1
mov edx, dword [0x474c94]
push ebx
push str.InstallFinishedButton
call fcn.0040623c
pop ecx
pop ecx
mov ecx, dword [0x474c98]
cmp ecx, ebx
je 0x4168d6
push ebx
push str.InstallerFinishedButton
call fcn.00414128
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret