Function at 0x419cf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [0x4aa6b4]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea esi, [esp + 0x4c]
call fcn.004032e0
cmp dword [esp + 0x58], 0
je 0x419e06
mov eax, dword [0x4ad5c0]
cmp eax, 0xffffffff
jne 0x419d38
call fcn.0040a7a0
mov dword [0x4ad5c0], eax
test eax, eax
jne 0x419d43
push 0x804
jmp 0x419d4d
cmp eax, 0x38
jne 0x419d64
push 0x409
cmp byte [0x4ad5bc], 0
jne 0x419d5e
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
jmp 0x419d64
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0x6a
lea esi, [esp + 0x34]
call fcn.004110d0
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419d80
mov ebx, dword [eax]
jmp 0x419d82
mov ebx, eax
push 0x80
lea esi, [esp + 0x18]
call fcn.004110d0
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419d9a
mov eax, dword [eax]
push 0x30
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x28], edi
jb 0x419db9
mov eax, dword [esp + 0x14]
push eax
call fcn.0041da61
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp dword [esp + 0x44], edi
jb 0x419de3
mov edx, dword [esp + 0x30]
push edx
call fcn.0041da61
add esp, 4
cmp dword [esp + 0x60], 0
je 0x41a3cf
mov eax, dword [esp + 0x54]
test eax, eax
je 0x41a3cf
mov ecx, dword [esp + 0x64]
push ecx
call eax
jmp 0x41a3cf
push str.__EDataStoreSetup__
push 0
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [esp + 0x10], eax
test eax, eax
jne 0x419e80
push str.__EDataStoreSetup__
push 1
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFC35EB43_F4A0_43B4_BEB1_66A470045416_is1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x419fd3
call fcn.0040a710
push 0x6a
lea esi, [esp + 0x34]
call fcn.004110d0
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419f0b
mov ebx, dword [eax]
jmp 0x419f0d
call fcn.0040a710
push 0x6a
lea esi, [esp + 0x34]
call fcn.004110d0
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419ea1
mov ebx, dword [eax]
jmp 0x419ea3
mov ebx, eax
push 0x69
lea esi, [esp + 0x18]
call fcn.004110d0
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419eb8
mov eax, dword [eax]
push 0x30
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [esp + 0x28], edi
jb 0x419ed7
mov edx, dword [esp + 0x14]
push edx
call fcn.0041da61
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
cmp dword [esp + 0x44], edi
jb 0x419f01
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041da61
add esp, 4
mov edx, dword [esp + 0x10]
push edx
jmp 0x41a3c9
mov ebx, eax
push 0x6b
lea esi, [esp + 0x18]
call fcn.004110d0
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x419f22
mov eax, dword [eax]
push 0x24
push ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
sete bl
cmp dword [esp + 0x28], edi
jb 0x419f47
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0041da61
add esp, 4
xor esi, esi
xor edx, edx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], esi
mov word [esp + 0x14], dx
cmp dword [esp + 0x44], edi
jb 0x419f6f
mov eax, dword [esp + 0x30]
push eax
call fcn.0041da61
add esp, 4
test bl, bl
je 0x419fb5
lea ecx, [esp + 0xc]
push ecx
lea esi, [esp + 0x50]
call fcn.004013d0
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x60], edi
jae 0x419f8d
mov eax, esi
push 5
push 0x49a5ac
push 0x49a5ac
push eax
push 0x49a5ac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [esp + 0x4c]
call fcn.00401860
jmp 0x41a3a9
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x419fc8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x10]
cmp eax, esi
jmp 0x41a3c6
push edi
call fcn.00436236
add esp, 4
lea ecx, [esp + 0x68]
call fcn.00434140
mov ebx, vtable.DuiLib::CNotifyPump.0
push 0x53
lea ecx, [esp + 0x80]
mov dword [esp + 0x7c], ebx
call fcn.00434dd7
lea ecx, [esp + 0x94]
mov dword [esp + 0x68], vtable.DuiLib::WindowImplBase.0
mov dword [esp + 0x78], vtable.DuiLib::WindowImplBase.1.0
mov dword [esp + 0x88], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + 0x8c], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x90], vtable.DuiLib::WindowImplBase.4.0
call fcn.00437385
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + 0x6c], vtable.CPageDialog1.0
mov dword [esp + 0x7c], vtable.CPageDialog1.1.0
mov dword [esp + 0x8c], 0x49b4f4
mov dword [esp + 0x90], 0x49b4fc
mov dword [esp + 0x94], 0x49b504
call fcn.004110d0
mov edi, 8
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41a084
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x8c]
call fcn.00434756
cmp dword [esp + 0x44], edi
jb 0x41a0c6
mov edx, dword [esp + 0x30]
push edx
call fcn.0041da61
add esp, 4
lea ecx, [esp + 0x68]
call fcn.004342a0
lea ecx, [esp + 0x68]
call fcn.004341c7
cmp byte [0x4af58c], 0
jne 0x41a0f0
lea eax, [esp + 0x68]
push eax
call fcn.00418d10
jmp 0x41a3a9
lea ecx, [esp + 0x398]
call fcn.00434140
push 0x53
lea ecx, [esp + 0x3b0]
mov dword [esp + 0x3ac], ebx
call fcn.00434dd7
mov ebx, vtable.DuiLib::WindowImplBase.4.0
lea ecx, [esp + 0x3c4]
mov dword [esp + method.std::error_category.virtual_4], vtable.DuiLib::WindowImplBase.0
mov dword [esp + method.DuiLib::WindowImplBase.1.virtual_0], vtable.DuiLib::WindowImplBase.1.0
mov dword [esp + fcn.00435d6c], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x3c0], ebx
call fcn.00437385
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + method.CPageDialog1.virtual_0], 0x49b50c
mov dword [esp + method.DuiLib::WindowImplBase.1.virtual_0], 0x49b59c
mov dword [esp + 0x3bc], 0x49b5a4
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], 0x49b5ac
mov dword [esp + method.DuiLib::CTxtWinHost.virtual_88], 0x49b5b4
call fcn.004110d0
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41a1a1
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x3bc]
call fcn.00434756
cmp dword [esp + 0x44], edi
jb 0x41a1e3
mov ecx, dword [esp + 0x30]
push ecx
call fcn.0041da61
add esp, 4
lea ecx, [esp + 0x398]
call fcn.004342a0
lea ecx, [esp + 0x398]
call fcn.004341c7
cmp byte [0x4af58c], 0
jne 0x41a220
lea edx, [esp + 0x398]
push edx
call fcn.00418d10
lea eax, [esp + 0x68]
push eax
call fcn.00418d10
jmp 0x41a3a9
lea ecx, [esp + 0x6c8]
push ecx
call fcn.00418600
push 0x68
lea esi, [esp + 0x34]
mov dword [esp + 0x6cc], 0x49b5bc
mov dword [esp + 0x6dc], 0x49b64c
mov dword [esp + 0x6ec], 0x49b654
mov dword [esp + 0x6f0], 0x49b65c
mov dword [esp + 0x6f4], 0x49b664
mov dword [esp + 0xa0c], 0
call fcn.004110d0
add esp, 4
cmp dword [eax + 0x14], edi
jb 0x41a284
mov eax, dword [eax]
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x100
push 0x96c80000
push eax
push 0
lea ecx, [esp + 0x6ec]
call fcn.00434756
cmp dword [esp + 0x44], edi
jb 0x41a2c6
mov edx, dword [esp + 0x30]
push edx
call fcn.0041da61
add esp, 4
lea ecx, [esp + 0x6c8]
call fcn.004342a0
lea ecx, [esp + 0x6c8]
call fcn.004341c7
cmp byte [0x4af58c], 0
jne 0x41a310
lea eax, [esp + 0x6c8]
push eax
call fcn.0041a3f0
lea ecx, [esp + 0x398]
push ecx
call fcn.00418d10
lea edx, [esp + 0x68]
push edx
call fcn.00418d10
jmp 0x41a3a9
call fcn.004196d0
lea eax, [esp + 0x6c8]
push eax
call fcn.0041a3f0
mov esi, vtable.DuiLib::WindowImplBase.0
mov edi, vtable.DuiLib::WindowImplBase.1.0
lea ecx, [esp + 0x3c4]
mov dword [esp + 0x398], esi
mov dword [esp + 0x3a8], edi
mov dword [esp + fcn.00435d6c], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + method.DuiLib::WindowImplBase.3.virtual_0], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x3c0], ebx
call fcn.00437a7a
lea ecx, [esp + 0x3ac]
call fcn.00435413
lea ecx, [esp + 0x94]
mov dword [esp + 0x68], esi
mov dword [esp + 0x78], edi
mov dword [esp + 0x88], vtable.DuiLib::WindowImplBase.2.0
mov dword [esp + 0x8c], vtable.DuiLib::WindowImplBase.3.0
mov dword [esp + 0x90], ebx
call fcn.00437a7a
lea ecx, [esp + 0x7c]
call fcn.00435413
mov eax, dword [esp + 0xc]
test eax, eax
je 0x41a3c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41a3cf
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xa1c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0041d331
mov esp, ebp
pop ebp
ret 0x10