Function at 0x41621e
Capabilities:
Create process on windows
Create process suspended
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x455770
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x470d08]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, 0x475cc8
mov edx, 0x45e6c8
mov ecx, edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.00402d3a
mov edx, 0x4619b4
mov ecx, edi
mov esi, eax
call fcn.00402d3a
cmp dword [0x475ba0], ebx
mov dword [esp + 0x28], eax
jne 0x416a72
cmp esi, ebx
je 0x41684a
cmp eax, ebx
je 0x41684a
mov edx, 0x45e6ec
mov ecx, edi
mov dword [esp + 0x34], 1
call fcn.00402d3a
cmp eax, ebx
je 0x416498
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push eax
call fcn.0040151b
mov dword [esp + 0xa4], ebx
or dword [esp + 0xa4], 0xffffffff
lea ebx, [esp + 0x18]
call fcn.00415917
pop ecx
mov dword [esp + 0xa0], 1
push 0x5c
mov esi, ebx
call fcn.00409847
push eax
lea eax, [esp + 0x1c]
push eax
mov ecx, ebx
call fcn.004099c7
mov byte [esp + 0xa0], 2
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x18]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00409868
mov byte [esp + 0xa0], 3
call fcn.0040968a
push 0x22
mov ecx, ebx
call fcn.004042ee
push str.__installresults
mov ecx, ebx
call fcn.00409c01
xor ebx, ebx
cmp byte [ebp + 8], bl
jne 0x416355
push str.__close
mov ecx, esi
call fcn.00409c01
mov edx, str.LaunchAs
mov ecx, edi
xor esi, esi
call fcn.00402d3a
cmp eax, ebx
je 0x4163a7
push str.AsInvoker
push eax
call fcn.0043801a
test eax, eax
pop ecx
pop ecx
jne 0x4163a7
push 3
push 5
inc esi
call fcn.004158a4
test al, al
pop ecx
pop ecx
je 0x4163a7
push dword [esp + 0x14]
push dword [esp + 0x1c]
push dword [esp + 0x34]
call fcn.00416d00
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jne 0x41644d
push 0x40
lea eax, [esp + 0x54]
push ebx
push eax
mov dword [esp + 0x58], 0x44
call fcn.00437fa0
add esp, 0xc
lea ecx, [esp + 0x24]
call fcn.004061fb
mov byte [esp + 0xa0], 4
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
call fcn.00414e6e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x24]
lea ecx, [esp + 0x18]
mov edi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0040da04
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x34]
call fcn.0040da04
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, ebx
je 0x41643c
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 3
lea ecx, [esp + 0x24]
call fcn.00406225
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.004054ab
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.004054ab
mov byte [esp + 0xa0], 2
lea ecx, [esp + 0x2c]
call fcn.00406225
mov byte [esp + 0xa0], 1
lea ecx, [esp + 0x18]
call fcn.00406225
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00406225
xor ebx, ebx
lea ecx, [esp + 0x30]
call fcn.004061fb
mov dword [esp + 0xa0], 5
lea eax, [esp + 0x2c]
push eax
push 0x475af8
call fcn.0040f067
mov byte [esp + 0xa0], 6
push dword [eax]
lea eax, [esp + 0x34]
push str.SOFTWARESlimWare_Utilities_Inc_s
push eax
call fcn.0040241f
add esp, 0xc
mov byte [esp + 0xa0], 5
lea ecx, [esp + 0x2c]
call fcn.00406225
mov dword [esp + 0x18], ebx
mov byte [esp + 0xa0], 7
lea eax, [esp + 0x2c]
push eax
push 0x20019
push ebx
push dword [esp + 0x3c]
mov dword [esp + 0x3c], ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x416823
lea ecx, [esp + 0x18]
call fcn.0040676a
cmp eax, ebx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
jne 0x416823
lea ecx, [esp + 0x2c]
call fcn.004061fb
mov byte [esp + 0xa0], 8
lea ecx, [esp + 0x20]
call fcn.004061fb
mov byte [esp + 0xa0], 9
lea ecx, [esp + 0x1c]
call fcn.004061fb
mov byte [esp + 0xa0], 0xa
push str.InstallScanID
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x1c], ebx
call fcn.00406703
test eax, eax
jne 0x4165b4
push dword [esp + 0x14]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], 1
call fcn.00409bde
push str.InstallScanID
lea ecx, [esp + 0x1c]
push ecx
mov edi, eax
call fcn.00406703
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004054ab
push str.InstallScanUrlParams
lea eax, [esp + 0x1c]
push eax
lea esi, [esp + 0x1c]
xor edi, edi
mov dword [esp + 0x1c], ebx
call fcn.00406703
test eax, eax
jne 0x416608
push dword [esp + 0x14]
lea ecx, [esp + 0x20]
call fcn.00409bde
push str.InstallScanUrlParams
lea ecx, [esp + 0x1c]
push ecx
mov edi, eax
call fcn.00406703
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call fcn.004054ab
mov eax, 0x461a5c
lea edi, [esp + 0x1c]
call fcn.0041702b
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], ebx
je 0x416655
lea eax, [esp + 0x14]
push eax
call fcn.004160fa
pop ecx
mov byte [esp + 0xa0], 0xb
push dword [esp + 0x1c]
push dword [eax]
lea eax, [esp + 0x34]
push dword [esp + 0x28]
push dword [esp + 0x34]
push 0x461a60
push eax
call fcn.0040241f
add esp, 0x18
mov byte [esp + 0xa0], 0xa
lea ecx, [esp + 0x14]
call fcn.00406225
lea eax, [esp + 0x24]
push eax
call fcn.00415ae1
pop ecx
mov byte [esp + 0xa0], 0xc
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], ebx
mov byte [esp + 0x13], bl
jne 0x4166ab
lea edi, [esp + 0x28]
mov byte [esp + 0x13], 1
call fcn.00415fe7
mov byte [esp + 0xa0], 0xd
push eax
lea ecx, [esp + 0x28]
call fcn.00401af4
mov byte [esp + 0xa0], 0xc
mov ecx, edi
call fcn.00406225
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], ebx
mov esi, dword [esp + 0x2c]
je 0x4167c9
cmp dword [esi - 0xc], ebx
je 0x4167df
movzx ecx, byte [esp + 0x13]
push ecx
push esi
push eax
lea eax, [esp + 0x20]
push eax
call fcn.00416091
mov byte [esp + 0xb0], 0xe
push 0x40
lea eax, [esp + 0x64]
push ebx
push eax
mov dword [esp + 0x68], 0x44
call fcn.00437fa0
add esp, 0x1c
lea ecx, [esp + 0x28]
mov dword [esp + 0x78], 1
mov word [esp + 0x7c], 3
call fcn.004061fb
mov byte [esp + 0xa0], 0xf
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x2c]
call fcn.00414e6e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x28]
lea ecx, [esp + 0x14]
mov esi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040da04
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
mov esi, eax
call fcn.004054ab
mov ecx, dword [0x475b18]
push ebx
call fcn.00427a77
push 0xea60
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x41678f
push ebx
push 0x4161fd
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x4167a5
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 0xe
lea ecx, [esp + 0x28]
call fcn.00406225
mov byte [esp + 0xa0], 0xc
lea ecx, [esp + 0x14]
call fcn.00406225
jmp 0x4167df
cmp dword [esi - 0xc], ebx
je 0x4167df
push 3
push ebx
push ebx
push esi
push 0x460cd0
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0xa0], 0xa
lea ecx, [esp + 0x24]
call fcn.00406225
mov byte [esp + 0xa0], 9
lea ecx, [esp + 0x1c]
call fcn.00406225
mov byte [esp + 0xa0], 8
lea ecx, [esp + 0x20]
call fcn.00406225
mov byte [esp + 0xa0], 7
lea ecx, [esp + 0x2c]
call fcn.00406225
mov byte [esp + 0xa0], 5
lea ecx, [esp + 0x18]
call fcn.0040676a
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x30]
call fcn.00406225
jmp 0x416a72
cmp byte [ebp + 8], bl
je 0x416a72
mov edx, 0x45e6ec
mov ecx, edi
call fcn.00402d3a
cmp eax, ebx
je 0x416a72
push ecx
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call fcn.0040151b
mov dword [esp + 0xa4], 0x10
or dword [esp + 0xa4], 0xffffffff
lea ebx, [esp + 0x18]
call fcn.00415917
pop ecx
mov dword [esp + 0xa0], 0x11
push 0x5c
mov esi, ebx
call fcn.00409847
push eax
lea eax, [esp + 0x24]
push eax
mov ecx, ebx
call fcn.004099c7
mov byte [esp + 0xa0], 0x12
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 0xc]
mov ecx, dword [esp + 0x20]
sub eax, dword [ecx - 0xc]
mov ecx, ebx
dec eax
push eax
lea eax, [esp + 0x30]
push eax
call fcn.00409868
mov byte [esp + 0xa0], 0x13
call fcn.0040968a
push 0x22
mov ecx, ebx
call fcn.004042ee
mov edx, str.LaunchAs
mov ecx, edi
xor ebx, ebx
xor esi, esi
call fcn.00402d3a
cmp eax, ebx
je 0x416950
push str.AsInvoker
push eax
call fcn.0043801a
test eax, eax
pop ecx
pop ecx
jne 0x416950
push 3
push 5
inc esi
call fcn.004158a4
test al, al
pop ecx
pop ecx
je 0x416950
push dword [esp + 0x14]
push dword [esp + 0x24]
push dword [esp + 0x34]
call fcn.00416d00
mov ecx, dword [0x475b18]
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
push ebx
inc edi
call fcn.00427a77
cmp edi, ebx
jne 0x416a27
push 0x40
lea eax, [esp + 0x54]
push ebx
push eax
mov dword [esp + 0x58], 0x44
call fcn.00437fa0
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.004061fb
mov byte [esp + 0xa0], 0x14
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x34]
call fcn.00414e6e
pop ecx
xor ecx, ecx
test eax, eax
setge cl
mov eax, ecx
neg eax
sbb eax, eax
and eax, dword [esp + 0x30]
lea ecx, [esp + 0x20]
mov edi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x50]
push eax
call fcn.0040da04
push eax
neg esi
push ebx
sbb esi, esi
and esi, 0x1000000
push esi
push ebx
push ebx
push ebx
lea ecx, [esp + 0x34]
call fcn.0040da04
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [0x475b18]
push ebx
mov esi, eax
call fcn.00427a77
push 0xea60
push dword [esp + 0x40]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x416a00
push ebx
push 0x4161fd
push dword [esp + 0x50]
call dword [sym.imp.USER32.dll_EnumThreadWindows]
cmp esi, ebx
je 0x416a16
push dword [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x3c]
call esi
mov byte [esp + 0xa0], 0x13
lea ecx, [esp + 0x30]
call fcn.00406225
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.004054ab
push 0xffffffffffffffff
lea ecx, [esp + 0x24]
call fcn.004054ab
mov byte [esp + 0xa0], 0x12
lea ecx, [esp + 0x2c]
call fcn.00406225
mov byte [esp + 0xa0], 0x11
lea ecx, [esp + 0x20]
call fcn.00406225
or dword [esp + 0xa0], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00406225
xor ebx, ebx
mov ecx, dword [0x475b18]
xor eax, eax
cmp dword [0x475ba0], ebx
setne al
inc eax
push eax
call fcn.00426f4d
cmp dword [0x475ba0], ebx
jne 0x416af1
cmp byte [ebp + 0xc], bl
je 0x416af1
cmp dword [esp + 0x34], ebx
je 0x416ac9
cmp dword [esp + 0x38], ebx
mov eax, 0x45e008
jne 0x416aad
mov eax, 0x461264
mov edx, dword [0x475c94]
push ebx
push eax
push str.ScanFinished
push str.InstallFinishedButton
call fcn.004061a3
add esp, 0x10
jmp 0x416adc
mov edx, dword [0x475c94]
push ebx
push str.InstallFinishedButton
call fcn.004061a3
pop ecx
pop ecx
mov ecx, dword [0x475c98]
cmp ecx, ebx
je 0x416af1
push ebx
push str.InstallerFinishedButton
call fcn.0041401c
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret