Function at 0x464601
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x48c414]
sub esp, 0x274
push ebx
push esi
push edi
push str._cleanup
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464645
mov eax, dword [0x48c414]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436ab1
pop ecx
push eax
call fcn.00463fed
pop ecx
pop ecx
jmp 0x464910
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0046418b
test eax, eax
je 0x464910
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
cmp dword [0x48c410], eax
jle 0x464781
mov dword [esp + 0xc], 2
mov edi, 0x46ea80
mov eax, dword [0x48c414]
mov esi, dword [esp + 0x10]
push str._path
push dword [eax + esi*4]
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
mov eax, dword [0x48c414]
je 0x4646e0
push edi
push dword [eax + esi*4]
call fcn.004370f6
push edi
push ebx
call fcn.004370f6
mov ecx, dword [0x48dfec]
add esp, 0x10
mov esi, eax
add ecx, 0x9d5c
mov dl, byte [esi]
inc esi
mov byte [ecx], dl
inc ecx
cmp dl, bl
jne 0x4646b9
mov ecx, dword [0x48dfec]
mov edx, eax
add ecx, 0xa4f5
mov al, byte [edx]
inc edx
mov byte [ecx], al
inc ecx
cmp al, bl
jne 0x4646d1
jmp 0x464769
push str._silent
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4646fb
mov byte [0x48dfe9], 1
jmp 0x464769
mov eax, dword [0x48c414]
push str._resume
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464746
mov eax, dword [esp + 0xc]
mov byte [0x48dfe9], 1
mov byte [0x48dfea], 1
cmp eax, dword [0x48c410]
jge 0x464769
inc dword [esp + 0x10]
mov eax, dword [0x48c414]
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + ecx*4]
inc dword [esp + 0xc]
mov dword [esp + 0x14], eax
jmp 0x464769
mov eax, dword [0x48c414]
push str._noui
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x464769
mov eax, dword [0x48dfec]
mov byte [eax + 0xcbc1], 1
inc dword [esp + 0x10]
mov eax, dword [esp + 0x10]
inc dword [esp + 0xc]
cmp eax, dword [0x48c410]
jl 0x464678
mov esi, 0x103
push esi
lea eax, [esp + 0x17d]
push ebx
push eax
mov byte [esp + 0x184], bl
call fcn.0043b2b0
add esp, 0xc
push 0x104
lea eax, [esp + 0x17c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x178]
push eax
call fcn.00463fd2
mov dword [esp], str.resume.exe
push eax
mov dword [esp + 0x14], eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x464896
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x44
pop edi
push edi
mov dword [esp + 0x18], eax
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.0043b2b0
add esp, 0xc
push esi
lea eax, [esp + 0x75]
push ebx
push eax
mov dword [esp + 0x34], edi
mov byte [esp + 0x7c], bl
call fcn.0043b2b0
lea edi, [esp + 0x7c]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x464820
mov eax, dword [esp + 0xc]
push 5
pop ecx
mov esi, str.install.exe__resume
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x464839
lea edi, [esp + 0x70]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x464847
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x2c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x464900
mov eax, dword [0x48c414]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._uninstall
push dword [eax + 4]
call esi
test eax, eax
jne 0x4648b9
push dword [ebp + 8]
call fcn.0046448c
jmp 0x4648ff
mov eax, dword [0x48c414]
push str._cleanup
push dword [eax + 4]
call esi
test eax, eax
jne 0x4648e5
mov eax, dword [0x48c414]
push dword [eax + 0xc]
push dword [eax + 8]
call fcn.00436ab1
pop ecx
push eax
call fcn.00463fed
jmp 0x4648fe
mov eax, dword [0x48dfec]
movzx eax, byte [eax + 0xcbc1]
mov ecx, dword [esp + 0x14]
push eax
push dword [ebp + 8]
call fcn.004641e9
pop ecx
pop ecx
push ebx
xor ebx, ebx
xor eax, eax
call fcn.0044dd21
pop ecx
call fcn.0046402b
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10