Function at 0x411620
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp edx, 0x111
ja 0x411d85
je 0x4116a4
mov eax, edx
sub eax, 0xf
je 0x411675
sub eax, 1
je case.0x4116c5.207
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x5e8]
push eax
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
lea eax, [ebp - 0x5e8]
push eax
push esi
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
mov eax, edi
shr eax, 0x10
test eax, eax
jne case.0x4116c5.207
movzx eax, di
add eax, 0xffffff33
cmp eax, 0xb
ja case.0x4116c5.207
jmp dword [eax*4 + 0x411fa4]
cmp byte [0x42308c], 0
sete byte [0x42308c]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x42308e], 0
sete byte [0x42308e]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x423088], 0
sete byte [0x423088]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x42308d], 0
sete byte [0x42308d]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x42308a], 0
sete byte [0x42308a]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x42308b], 0
sete byte [0x42308b]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
cmp byte [0x423089], 0
sete byte [0x423089]
call fcn.00410c40
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push dword [0x42269c]
call ebx
push 0
push dword [0x422694]
call ebx
push 0
push 0
push 0x402
push dword [0x4226c4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x423090], eax
cmp eax, 0x256
jne 0x41181b
mov dword [0x423090], 0
cmp byte [0x422635], 0
je 0x41187a
mov eax, 0x451
mov dword [ebp - 0x608], 0
mov word [ebp - 0x604], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x614]
movlpd qword [ebp - 0x602], xmm0
push eax
mov dword [ebp - 0x5fa], 0
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x610], 3
mov dword [ebp - 0x60c], 0x422958
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 0x422750
lea eax, [ebp - 0xd0]
push 0x41dd6c
push eax
call fcn.00401010
add esp, 0xc
lea ecx, [ebp - 0xd0]
call fcn.00412260
test eax, eax
jne 0x4118d5
push 0x1010
push 0x41dd74
push 0x41dd88
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push dword [0x42269c]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push 0x41ddac
push 0x422750
mov dword [ebp - 0x5ec], eax
lea eax, [ebp - 0x198]
push 0x41ddc8
push eax
call fcn.00401010
push str.PROGRAM1_CHM
mov edx, 0x71
lea ecx, [ebp - 0x198]
call fcn.004123b0
push 0x41ddf0
push 0x422750
lea eax, [ebp - 0x198]
push 0x41de0c
push eax
call fcn.00401010
push str.PROGRAM1_EXE
mov edx, 0x6f
lea ecx, [ebp - 0x198]
call fcn.004123b0
push 0x422750
lea eax, [ebp - 0x198]
push str._suninstall.exe
push eax
call fcn.00401010
push 0x41de58
mov edx, 0x72
lea ecx, [ebp - 0x198]
call fcn.004123b0
add esp, 0x38
cmp byte [0x422648], 0
je 0x4119b9
push str.ESTARTsetup.exe
push 0x422750
lea eax, [ebp - 0x198]
push 0x41de98
push eax
call fcn.00401010
push str.PROGRAM2_EXE
mov edx, 0x70
lea ecx, [ebp - 0x198]
call fcn.004123b0
add esp, 0x14
cmp byte [0x42308a], 0
jne 0x4119c9
mov byte [0x423089], 0
push 0x422750
push 0x41d584
mov edx, 0x41d590
mov ecx, 0x41d5b0
call fcn.004122e0
mov edx, eax
mov ecx, 0x41d61c
call fcn.00412bd0
add esp, 8
mov edx, 0x41d65c
mov ecx, 0x41d670
push 0x422d68
push str.DisplayName
call fcn.004122e0
mov edx, eax
mov ecx, 0x41d6dc
call fcn.00412bd0
push 0x422ef8
mov edx, 0x41d704
mov ecx, 0x422750
call fcn.004136f0
add esp, 0xc
mov edx, 0x41d728
mov ecx, 0x41d740
push eax
push 0x41d708
call fcn.004122e0
mov edx, eax
mov ecx, 0x41d7ac
call fcn.00412bd0
add esp, 8
mov edx, 0x41d7f4
mov ecx, 0x41d810
push 0x41d7d4
push str.Publisher
call fcn.004122e0
mov edx, eax
mov ecx, 0x41d87c
call fcn.00412bd0
push 0x422ef8
mov edx, 0x41d8a4
mov ecx, 0x422750
call fcn.004136f0
add esp, 0xc
mov edx, 0x41d8c0
mov ecx, 0x41d8e0
push eax
push 0x41d8a8
call fcn.004122e0
mov edx, eax
mov ecx, 0x41d94c
call fcn.00412bd0
add esp, 8
mov ecx, 2
call fcn.00412ad0
mov ecx, 0x17
call fcn.004128c0
cmp byte [0x423089], 0
mov ecx, 7
je 0x411ada
call fcn.004128c0
jmp 0x411adf
call fcn.00412ad0
xor ecx, ecx
cmp byte [0x423088], cl
je 0x411af0
call fcn.004128c0
jmp 0x411af5
call fcn.00412ad0
lea ecx, [ebp - 0x5a8]
call fcn.00412040
push 0x41e078
mov edx, 0x41e094
lea ecx, [ebp - 0x5a8]
call fcn.004136f0
lea edx, [ebp - 0x3a0]
add esp, 4
sub edx, eax
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x411b20
cmp byte [0x42308d], 0
mov ecx, 0x42
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, 0x4d
cmovne eax, ecx
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e0a0
push 0x41e0b0
call esi
xor eax, eax
cmp byte [0x42308a], al
setne al
add eax, 0x30
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e0cc
push 0x41e0e4
call esi
xor eax, eax
cmp byte [0x42308b], al
setne al
add eax, 0x30
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e100
push 0x41e10c
call esi
xor eax, eax
cmp byte [0x42308c], al
setne al
add eax, 0x30
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e128
push 0x41e134
call esi
xor eax, eax
cmp byte [0x42308e], al
setne al
add eax, 0x30
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e150
push 0x41e160
call esi
push dword [0x423090]
lea eax, [ebp - 0x198]
push 0x41e174
push eax
call fcn.00401010
add esp, 0xc
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x41e17c
push 0x41e18c
call esi
cmp byte [0x422648], 0
je 0x411c9d
push 0x41cf60
push 0x422750
lea eax, [ebp - 0x198]
push 0x41cf80
push eax
call fcn.00401010
add esp, 0x10
lea eax, [ebp - 0x198]
push 0
push 0x41cf8c
push str._VERYSILENT__pccid0255_01__tagcid0255_01__soft
push eax
push 0x41cff4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [ebp + 0xc]
push esi
push edi
push 0x402
push dword [0x42264c]
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0x401
push dword [0x42264c]
mov dword [0x422628], 0x73
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x5ec]
call dword [sym.imp.USER32.dll_SetCursor]
push 1
push dword [0x42269c]
call ebx
push 1
push dword [0x422694]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push edi
push 0x402
push dword [0x42264c]
call ebx
cmp byte [0x422635], 0
je 0x411d59
xor eax, eax
cmp byte [0x422649], al
push esi
push edi
setne al
push 0x401
push dword [0x42264c]
add eax, 0x6f
mov dword [0x422628], eax
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
push esi
push edi
push 0x401
push dword [0x42264c]
mov dword [0x422628], 0x71
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
mov eax, edx
sub eax, 0x401
je 0x411ed5
sub eax, 1
je 0x411db6
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
push dword [0x4226f8]
mov esi, dword [sym.imp.USER32.dll_SetWindowLongW]
push 0xfffffffffffffffc
push dword [0x4226b8]
call esi
push dword [0x4226fc]
push 0xfffffffffffffffc
push dword [0x4226c0]
call esi
push dword [0x422700]
push 0xfffffffffffffffc
push dword [0x4226a8]
call esi
push dword [0x422704]
push 0xfffffffffffffffc
push dword [0x4226bc]
call esi
push dword [0x422708]
push 0xfffffffffffffffc
push dword [0x4226b0]
call esi
push dword [0x42270c]
push 0xfffffffffffffffc
push dword [0x4226b4]
call esi
push dword [0x422710]
push 0xfffffffffffffffc
push dword [0x4226ac]
call esi
push dword [0x422714]
push 0xfffffffffffffffc
push dword [0x4226c4]
call esi
push dword [0x422718]
push 0xfffffffffffffffc
push dword [0x42269c]
call esi
push dword [0x42271c]
push 0xfffffffffffffffc
push dword [0x422694]
call esi
push dword [0x4226e4]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
call esi
push dword [0x4226b8]
call esi
push dword [0x4226c0]
call esi
push dword [0x4226a8]
call esi
push dword [0x4226bc]
call esi
push dword [0x4226b0]
call esi
push dword [0x4226b4]
call esi
push dword [0x4226ac]
call esi
push dword [0x4226c8]
call esi
push dword [0x4226c4]
call esi
push dword [0x42269c]
call esi
push dword [0x422694]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x5f4]
mov dword [ebp - 0x5f4], 8
push eax
mov dword [ebp - 0x5f0], 0x40
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
movd xmm0, dword [0x422630]
cvtdq2pd xmm0, xmm0
push 1
mulsd xmm0, qword [0x41f6d8]
cvttsd2si eax, xmm0
movd xmm0, dword [0x42262c]
cvtdq2pd xmm0, xmm0
push eax
mulsd xmm0, qword [0x41f6e8]
cvttsd2si eax, xmm0
push eax
push dword [0x422644]
push dword [0x422640]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [0x422635], 0
je 0x411f57
push 0x41cef4
mov edx, 0x41cf08
mov ecx, 0x41cf28
jmp 0x411f66
push 0x41cf2c
mov edx, 0x41cf3c
mov ecx, 0x41cf5c
call fcn.004136f0
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, esi
call fcn.00410db0
call fcn.00410c40
push dword [0x422694]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401288
mov esp, ebp
pop ebp
ret