Function at 0x4641a8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x488c94]
sub esp, 0x15c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._cleanup
push dword [eax + 4]
call ebx
test eax, eax
jne 0x4641e9
mov eax, dword [0x488c94]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00433f5a
pop ecx
push eax
call fcn.00463b98
pop ecx
pop ecx
jmp 0x4644a8
call fcn.00463d36
test eax, eax
je 0x4644a8
xor eax, eax
inc eax
push esi
push edi
mov dword [ebp - 4], eax
cmp dword [0x488c90], eax
jl 0x4642df
mov edi, 0x46c5b8
mov eax, dword [0x488c94]
mov esi, dword [ebp - 4]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x488c94]
je 0x464274
push edi
push dword [eax + esi*4]
call fcn.00433f7b
push edi
push 0
call fcn.00433f7b
mov ecx, dword [0x48a86c]
add esp, 0x10
mov esi, eax
add ecx, 0x8a5c
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
test dl, dl
jne 0x464250
mov ecx, dword [0x48a86c]
mov edx, eax
add ecx, 0x91f5
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
test al, al
jne 0x464268
jmp 0x4642cd
push str._silent
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x46428b
mov byte [0x48a869], 1
jmp 0x4642cd
mov eax, dword [0x488c94]
push str._resume
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x4642ae
mov byte [0x48a869], 1
mov byte [0x48a86a], 1
jmp 0x4642cd
mov eax, dword [0x488c94]
push str._noui
push dword [eax + esi*4]
call ebx
test eax, eax
jne 0x4642cd
mov eax, dword [0x48a86c]
mov byte [eax + 0xb7c2], 1
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [0x488c90]
jle 0x46420f
push 0x103
xor esi, esi
lea eax, [ebp - 0x15b]
push esi
push eax
mov byte [ebp - 0x15c], 0
call fcn.004384e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x15c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push str.resume.exe
push eax
call fcn.00463b7d
pop ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x464436
lea eax, [ebp - 0x15c]
push 0x46c5e0
push eax
call fcn.00463b7d
pop ecx
push eax
call ebx
test eax, eax
jne 0x46435c
push esi
push esi
push dword [0x48a86c]
push 0x15
call fcn.00461c88
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c5ec
push eax
call fcn.00463b7d
pop ecx
push eax
call ebx
test eax, eax
jne 0x464387
push esi
push esi
push dword [0x48a86c]
push 0x16
call fcn.00461c88
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c5f8
push eax
call fcn.00463b7d
pop ecx
push eax
call ebx
test eax, eax
jne 0x4643b2
push esi
push esi
push dword [0x48a86c]
push 0x17
call fcn.00461c88
add esp, 0x10
lea eax, [ebp - 0x15c]
push 0x46c604
push eax
call fcn.00463b7d
pop ecx
push eax
call ebx
test eax, eax
jne 0x4643dd
push esi
push esi
push dword [0x48a86c]
push 0x18
call fcn.00461c88
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov ebx, eax
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004384e0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push str.install.exe__resume
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464496
mov eax, dword [0x488c94]
push str._uninstall
push dword [eax + 4]
call ebx
test eax, eax
jne 0x464453
push dword [ebp + 8]
call fcn.00464014
jmp 0x464495
mov eax, dword [0x488c94]
push str._cleanup
push dword [eax + 4]
call ebx
test eax, eax
jne 0x46447f
mov eax, dword [0x488c94]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00433f5a
pop ecx
push eax
call fcn.00463b98
jmp 0x464494
mov eax, dword [0x48a86c]
movzx eax, byte [eax + 0xb7c2]
push eax
push dword [ebp + 8]
call fcn.00463d96
pop ecx
pop ecx
push esi
xor ebx, ebx
xor eax, eax
call fcn.0044b1da
pop ecx
call fcn.00463bd6
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10