Function at 0x41ec90
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x4aaa9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x204
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xb4]
mov dword [esp + 0x10], esi
cmp ecx, ebx
je 0x41ecc9
lea eax, [ecx - 0xb4]
jmp 0x41eccb
xor eax, eax
push ecx
add eax, 8
push 0x40
push 0xd
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], ebx
mov dword [esp + 0x21c], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
or ebp, 0xffffffff
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], ebx
mov byte [esi + 0xd4], bl
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebp
mov dword [esi + 0xd0], ebp
lea edi, [esi + 0x20]
mov byte [esp + 0x21c], 2
mov ecx, edi
call fcn.00441460
mov dword [esi + 0xb0], vtable.IDownloadNotify.0
lea ecx, [esi + 0xe8]
mov byte [esp + 0x21c], 3
mov dword [esi + 0xdc], ebx
mov dword [esi + 0xe0], ebp
mov dword [esi + 0xe4], ebp
call fcn.004270e0
mov dword [esi + 0x120], ebx
mov dword [esi + 0x124], ebx
mov dword [esi], vtable.CInstallProductPage.2.0
mov dword [edi], vtable.CInstallProductPage.1.0
mov dword [esi + 0xb0], vtable.CInstallProductPage.0
mov dword [esi + 0x98], 3
mov dword [esi + 0x58], 0x6c
mov ecx, dword [0x4d1ac8]
lea edx, [esp + 0x14]
push 0x100
mov eax, dword [ecx + 8]
push edx
push 0x8b
push eax
mov byte [esp + 0x22c], 4
lea edi, [esi + 0x5c]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41edc9
mov word [esp + 0x14], bx
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x41ee0b
lea edx, [esp + 0x14]
test edx, edx
jne 0x41edf1
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
push eax
mov ecx, edi
call fcn.00405750
jmp 0x41ee7f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, edi
call fcn.00405750
jmp 0x41ee7f
push 0x1ff
mov ecx, edi
mov ebp, 0x200
call fcn.00405530
mov edi, eax
cmp edi, ebx
je 0x41ee61
mov edx, dword [0x4d1ac8]
push ebp
push edi
push 0x8b
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41ee40
mov word [edi], bx
mov ecx, ebp
sub ecx, eax
cmp ecx, 1
jg 0x41ee61
add ebp, 0x100
lea ecx, [esi + 0x5c]
lea edx, [ebp - 1]
push edx
call fcn.00405530
mov edi, eax
cmp edi, ebx
jne 0x41ee22
lea edi, [esi + 0x5c]
mov ecx, edi
call fcn.00405940
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
mov word [edx + eax*2], bx
mov eax, dword [esi + 0x98]
lea ecx, [esi + 0x20]
push eax
call fcn.004288b0
mov ecx, eax
call fcn.0043d630
cmp eax, ebx
je 0x41ef5f
cmp dword [eax + 4], ebx
je 0x41ef5f
mov dword [esi + 0x48], 2
mov ecx, dword [0x4d1ac8]
lea edx, [esp + 0x14]
push 0x100
mov eax, dword [ecx + 8]
push edx
push 0x8a
push eax
lea ebp, [esi + 0x4c]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41eed8
mov word [esp + 0x14], bx
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x41ef17
lea edx, [esp + 0x14]
test edx, edx
jne 0x41eefd
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
push eax
mov ecx, ebp
call fcn.00405750
jmp 0x41ef5f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.00405750
jmp 0x41ef5f
push 0x1ff
mov ecx, ebp
mov edi, 0x200
call fcn.00405530
cmp eax, ebx
je 0x41ef56
push edi
push eax
push 0x8a
call fcn.00405b00
mov edx, edi
sub edx, eax
cmp edx, 1
jg 0x41ef56
add edi, 0x100
mov ecx, ebp
lea eax, [edi - 1]
push eax
call fcn.00405530
cmp eax, ebx
jne 0x41ef2c
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004055f0
mov ecx, dword [esp + 0x214]
mov dword [esi + 0x90], 0xa4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x210
ret