Function at 0x4068aa
Capabilities:
Query or enumerate registry value
Read .ini file
Set current directory

Disassembly:
mov eax, 0x41b2ae
call fcn.00411bc4
mov eax, 0x1850
call fcn.00411da0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.00401046
xor ebx, ebx
mov ecx, edi
mov esi, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
call fcn.0040105f
push ebx
mov ecx, esi
call fcn.0040a353
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.00408e3e
cmp eax, ebx
mov dword [ebp - 0x2c], eax
je 0x406ac8
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
lea eax, [ebp - 0x254]
push ebx
push eax
push dword [0x41c590]
call fcn.0040829a
test eax, eax
je 0x406db6
cmp dword [ebp - 0x38], ebx
je 0x406935
lea eax, [ebp - 0x254]
push str.__q:a__c:_install__q_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, 0x104
lea eax, [ebp - 0x358]
push ebx
push eax
push 0x452
call fcn.0040c385
add esp, 0xc
lea eax, [ebp - 0x358]
push str.Microsoft_R__.NET_Framework
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x45c]
mov ecx, esi
push eax
call fcn.0040a8e2
push esi
push 1
pop edi
lea eax, [ebp - 0x254]
push edi
push eax
call fcn.0040d385
cmp eax, 0x2000
je 0x4069c4
cmp eax, 0xbc2
je 0x4069c4
test eax, eax
je 0x406a4b
cmp eax, 0x1008
je 0x406a4b
mov ecx, 0x66d
push eax
push ecx
mov dword [0x425e20], ecx
call fcn.0040c311
pop ecx
pop ecx
jmp 0x406db6
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], 2
and dword [ebp - 4], 0
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00406de3
test eax, eax
jne 0x406a38
and byte [ebp - 0x150], al
push 0x40
pop ecx
lea edi, [ebp - 0x14f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x34]
and dword [ebp - 0x28], 0
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.InstallerLocation
mov dword [ebp - 0x34], ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 1
pop edi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], 0
je 0x406a4b
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
jne 0x406b50
mov ecx, dword [ebp - 0x10]
lea eax, [esi + 0x10]
push eax
call fcn.00407c81
cmp eax, ebx
jne 0x406b4a
mov ecx, esi
call fcn.0040a339
test eax, eax
je 0x406b50
mov ecx, esi
mov dword [ebp - 0x1c], edi
call fcn.0040a26d
mov eax, dword [eax]
dec eax
je 0x406acd
dec eax
jne 0x406b1c
cmp dword [esi + 0x185c], ebx
je 0x406ab2
lea eax, [esi + 0x1860]
push eax
lea eax, [ebp - 0xc5c]
push eax
call fcn.00411630
pop ecx
mov dword [ebp - 0x18], edi
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc5c]
push dword [ebp - 0x18]
push eax
push dword [0x420a10]
jmp 0x406b01
push 1
pop edi
jmp 0x406a4d
cmp dword [esi + 0x1458], ebx
je 0x406aed
lea eax, [esi + 0x145c]
push eax
lea eax, [ebp - 0xc5c]
push eax
call fcn.00411630
pop ecx
mov dword [ebp - 0x18], edi
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc5c]
push dword [ebp - 0x18]
push eax
push dword [0x420a0c]
mov ecx, dword [ebp - 0x10]
call fcn.0040829a
test eax, eax
jne 0x406b1c
mov dword [0x425e20], 0x482
jmp 0x406db6
lea eax, [ebp - 0xc5c]
push eax
call fcn.0040cb2d
test eax, eax
jne 0x406b50
lea ecx, [ebp - 0xc5c]
mov eax, 0x482
push ecx
push eax
mov dword [0x425e20], eax
call fcn.0040c311
pop ecx
pop ecx
jmp 0x406dbb
jg 0x406dbb
and byte [ebp - 0x85c], 0
mov ebx, 0xff
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x85b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ecx, ecx
stosb byte es:[edi], al
cmp dword [esi + 0x1c60], ecx
je 0x406b8d
lea eax, [esi + 0x1c64]
push eax
lea eax, [ebp - 0x85c]
push eax
call fcn.00411630
pop ecx
pop ecx
push 1
pop ecx
lea edx, [ebp - 0x30]
lea eax, [esi + 0x810]
push edx
push ecx
lea ecx, [ebp - 0x85c]
mov dword [ebp - 0x28], eax
push ecx
mov ecx, dword [ebp - 0x10]
push eax
call fcn.0040829a
test eax, eax
je 0x406db6
and byte [ebp - 0x105c], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x105b]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x18], 0
push 1
stosw word es:[edi], ax
pop ebx
push ebx
stosb byte es:[edi], al
call fcn.00407fec
test eax, eax
je 0x406c27
xor edi, edi
xor eax, eax
cmp dword [esi + 0x2064], edi
je 0x406c00
lea eax, [esi + 0x2068]
push eax
lea eax, [ebp - 0x105c]
push eax
call fcn.00411630
pop ecx
mov eax, ebx
pop ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x105c]
push eax
push dword [0x41c58c]
call fcn.0040829a
test eax, eax
je 0x406db6
mov dword [ebp - 0x18], ebx
jmp 0x406c29
xor edi, edi
cmp dword [ebp - 0x1c], edi
je 0x406c41
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc5c]
push eax
call fcn.00407e83
cmp dword [ebp - 0x24], edi
je 0x406c7d
push 0x424f58
lea eax, [ebp - 0x4c]
push 0x400
push eax
push 0x424180
push dword [0x41c550]
push dword [0x41c54c]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x4c], 0x79
je 0x406c7a
cmp byte [ebp - 0x4c], 0x59
mov dword [ebp - 0x14], ebx
jne 0x406c7d
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x24], 2
jne 0x406cac
cmp dword [ebp - 0x14], edi
jne 0x406cac
lea eax, [esi + 0x1018]
push str._ISSCHEDULEREBOOT1
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push str.ISSCHEDULEREBOOT1
push 0x420330
mov ecx, esi
call fcn.0040acfd
cmp dword [ebp - 0x18], 0
mov edi, 0x424184
je 0x406d31
cmp dword [ebp - 0x14], 0
jne 0x406d31
lea eax, [ebp - 0x105c]
push edi
push eax
lea ecx, [ebp - 0x145c]
call fcn.00403656
lea eax, [ebp - 0x105c]
lea ecx, [ebp - 0x145c]
push eax
mov dword [ebp - 4], ebx
call fcn.004036d0
test eax, eax
je 0x406d02
call fcn.004054bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x145c]
call fcn.004036ba
jmp 0x406dbb
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x105c]
push eax
call fcn.004081c7
test eax, eax
je 0x406cee
cmp dword [ebp - 0x2c], 0
je 0x406d22
mov dword [ebp - 0x14], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x145c]
call fcn.004036ba
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0040a353
cmp dword [ebp - 0x30], 3
je 0x406d9a
cmp dword [ebp - 0x14], 0
jne 0x406dbf
lea eax, [ebp - 0x85c]
push edi
push eax
lea ecx, [ebp - 0x185c]
call fcn.00403656
lea eax, [ebp - 0x85c]
lea ecx, [ebp - 0x185c]
push eax
mov dword [ebp - 4], 2
call fcn.004036d0
test eax, eax
je 0x406d8b
call fcn.004054bc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x185c]
jmp 0x406cf8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x185c]
call fcn.004036ba
cmp dword [ebp - 0x14], 0
jne 0x406dbf
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x85c]
push eax
push dword [ebp - 0x28]
call fcn.0040882b
test eax, eax
jne 0x406dbf
call fcn.004054bc
xor eax, eax
jmp 0x406dd4
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x85c]
push dword [ebp - 0x20]
push eax
call fcn.00406e21
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret