Function at 0x41ed80
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5679ce
mov eax, dword fs:[0]
push eax
sub esp, 0x6c0
mov eax, dword [0x5d51c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x68c], edx
mov ebx, ecx
xor eax, eax
mov dword [ebp - 4], 0
push 0x206
push eax
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push eax
mov dword [ebp - 0x680], 0x104
mov dword [ebp - 0x688], 1
call fcn.0054cbf0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push eax
call fcn.0054cbf0
add esp, 0x18
call fcn.004206b9
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x41ee26
push 0x80004005
call fcn.00405730
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x678], esi
mov byte [ebp - 4], 1
call fcn.004206b9
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x41ee56
push 0x80004005
call fcn.00405730
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x684], eax
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 2
push eax
push 0x20019
push 0
push str.SOFTWAREHNCSharedInstall_InformationHOffice96
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41eeed
lea eax, [ebp - 0x680]
push eax
push 0
push 0
push 0
push str.Path
push dword [ebp - 0x67c]
call edi
test eax, eax
jne 0x41eeed
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push str.Path
push dword [ebp - 0x67c]
call edi
push str.HncUtilsLanguagePackSetupTool.exe
lea eax, [ebp - 0x424]
push 0x104
push eax
call fcn.0054b5e8
add esp, 0xc
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x67c]
push eax
push 0x20019
push 0
push str.SOFTWAREHNCSharedExecuteOption96
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41ef5d
lea eax, [ebp - 0x680]
push eax
push 0
push 0
push 0
push str.LightSizeProductName
push dword [ebp - 0x67c]
call edi
test eax, eax
jne 0x41ef5d
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x688]
push eax
push 0
push str.LightSizeProductName
push dword [ebp - 0x67c]
call edi
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68c]
mov ecx, 0x409
test eax, eax
cmove eax, ecx
push eax
lea eax, [ebp - 0x684]
push 0x5b25cc
push eax
call fcn.004051e0
mov edi, dword [ebp - 0x684]
add esp, 0xc
dec ebx
je 0x41f00c
dec ebx
je 0x41efa1
xor bl, bl
jmp 0x41f0ed
push 9
push str._product:
lea ecx, [ebp - 0x678]
call fcn.00405780
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41efc0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x678]
call fcn.00408fb0
push 7
push str.__lang:
lea ecx, [ebp - 0x678]
call fcn.00408fb0
push dword [edi - 0xc]
lea ecx, [ebp - 0x678]
push edi
call fcn.00408fb0
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
push eax
jmp 0x41f050
push 9
push str._product:
lea ecx, [ebp - 0x678]
call fcn.00405780
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f027
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x678]
call fcn.00408fb0
push 0x14
push str.__updatelist__silent
lea ecx, [ebp - 0x678]
call fcn.00408fb0
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [ebp - 0x678]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41f0e4
push 0x3c
lea eax, [ebp - 0x6c8]
push 0
push eax
call fcn.0054cbf0
add esp, 0xc
mov dword [ebp - 0x6c8], 0x3c
lea eax, [ebp - 0x424]
mov dword [ebp - 0x6bc], str.open
mov dword [ebp - 0x6b8], eax
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6b4], esi
push eax
mov dword [ebp - 0x6ac], 5
mov dword [ebp - 0x6c4], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0x690]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov bl, 1
lea edx, [edi - 0x10]
mov byte [ebp - 4], 1
or edi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, edi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x41f10d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41f12a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 8]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x41f14b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0054a22c
mov esp, ebp
pop ebp
ret