Function at 0x49dc80
Capabilities:
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f66d4
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x6b000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ax, word [0x639ee0]
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push 0
push eax
call fcn.00588800
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x2f
push dword [esi + 0x904]
call fcn.005884c3
add esp, 8
or edi, 0xffffffff
test eax, eax
je 0x49dd5e
mov ecx, dword [esi + 0x904]
sub eax, ecx
sar eax, 1
cmp eax, edi
je 0x49dd5e
add ecx, 2
lea eax, [ecx + eax*2]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040c380
mov dword [ebp - 4], 0
lea eax, [ebp - 0x218]
push 0x103
push dword [ebp - 0x21c]
push eax
call fcn.005b8058
add esp, 0xc
mov dword [ebp - 4], edi
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49dd77
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x49dd77
push 0x103
lea eax, [ebp - 0x218]
push str.downloadinstall.exe
push eax
call fcn.005b8058
add esp, 0xc
mov ecx, esi
lea eax, [esi + 0x900]
neg ecx
sbb ecx, ecx
and ecx, eax
lea eax, [ebp - 0x218]
push ecx
push eax
push dword [esi + 0x904]
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x21c]
call fcn.00413470
push 0
test eax, eax
jne 0x49ded1
lea ecx, [ebp - 0x224]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CWaitCursor::constructor_struct_HWND____]
mov dword [ebp - 4], 2
mov edx, str.Installing
push 0x650a3c
lea ecx, [ebp - 0x21c]
call fcn.004db870
add esp, 4
mov byte [ebp - 4], 3
mov ecx, esi
push dword [eax]
push str.Title
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49de0d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [esi + 0x908], 3
lea ecx, [ebp - 0x218]
je 0x49de7d
mov edx, 0x6517c0
call fcn.004ddb80
mov edx, dword [esi + 0x908]
lea ecx, [ebp - 0x21c]
call fcn.004dd8f0
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], 0
je 0x49de5c
push 5
push 0
push 0
push eax
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x49deb2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x49deb2
mov edx, str.__VERYSILENT__NORESTART__NOCLOSEAPPLICATIONS__NORESTARTAPPLICATIONS__SUPPRESSMSGBOXES
call fcn.004ddb80
push 4
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x21c], 0
push eax
push 4
push str.Decode
push dword [0x6b9660]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CWindowWnd::Close_unsigned_int_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::CWaitCursor::destructor_void_]
jmp 0x49df2e
push str.progress
mov ecx, esi
call dword [sym.imp.ycomuiu.dll_public:_void___thiscall_DuiLib::WindowImplBase::ShowWindow_wchar_t_const___bool_]
push 0x650a3c
mov edx, str.DownloadErr
lea ecx, [ebp - 0x21c]
call fcn.004db870
add esp, 4
mov dword [ebp - 4], 7
mov ecx, esi
push dword [eax]
push str.Title
call dword [sym.imp.ycomuiu.dll_public:_int___thiscall_DuiLib::WindowImplBase::SetDlgItemTextW_wchar_t_const___wchar_t_const__]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x49df2e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055f9be
mov esp, ebp
pop ebp
ret