Function at 0x412e30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x452378
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x469744]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push esi
push edi
mov eax, dword [0x469744]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x60], ebx
xor ecx, ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x60], 2
mov dword [esp + 0x20], 0x1000
cmp byte [esi + 0x42], bl
je 0x41315e
push ebx
lea edx, [esp + 0x18]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41314a
push 0x4596c4
call fcn.00402130
test eax, eax
je 0x412ef4
mov ecx, 0x4596c4
call fcn.00402200
jmp 0x412f00
mov edx, 0x4596c8
mov ecx, esi
call fcn.00410e00
mov ecx, eax
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x412f05
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, esi
sar ecx, 1
add ecx, ecx
push ecx
push eax
push 1
push ebx
push str.InstallPath
push edx
call edi
xor ecx, ecx
call fcn.004247a0
push edx
push eax
call fcn.00424690
mov ecx, eax
add esp, 8
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x412f43
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x38]
call fcn.00406550
cmp dword [esp + 0x48], 8
mov edx, dword [esp + 0x34]
jae 0x412f69
mov edx, esi
mov eax, edx
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412f70
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebx
push str.Version
push ecx
call edi
mov edx, dword [esp + 0x1c]
cmp dword [edx + 0x38], ebx
mov edx, 0x458eac
jne 0x412fa5
mov edx, 0x458eb4
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412fb0
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebx
push str.Reboot
push ecx
call edi
mov edx, dword [esp + 0x1c]
cmp dword [edx + 0x3c], ebx
mov edx, str.success
je 0x412fe5
mov edx, str.failure
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412ff0
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebx
push str.Install
push ecx
call edi
mov ecx, dword [0x46be98]
add ecx, 0xa38
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
cmp si, bx
jne 0x413023
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 0x14]
push edx
push ecx
push 1
push ebx
push 0x459728
push eax
call edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x48]
mov esi, dword [eax]
cmp esi, eax
je 0x4130bf
cmp byte [esi + 0x28], bl
je 0x41307c
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x413065
mov eax, dword [ecx]
jmp 0x413067
mov eax, ecx
cmp word [eax], 0x40
je 0x41307c
lea edi, [esp + 0x24]
call fcn.0040c7c0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp byte [esi + 0x2d], bl
jne 0x4130b6
mov eax, dword [esi + 8]
cmp byte [eax + 0x2d], bl
jne 0x41309d
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
jne 0x4130b6
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x2d], bl
je 0x413092
jmp 0x4130b6
mov eax, dword [esi + 4]
cmp byte [eax + 0x2d], bl
jne 0x4130b4
cmp esi, dword [eax + 8]
jne 0x4130b4
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x2d], bl
je 0x4130a5
mov esi, eax
mov edx, dword [esp + 0x1c]
cmp esi, dword [edx + 0x48]
jne 0x413053
xor ecx, ecx
mov eax, 0x1000
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004386fc
mov esi, eax
add esp, 4
push esi
lea eax, [esp + 0x24]
lea ebx, [esp + 0x28]
call fcn.00436ff0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
add esp, 4
lea ecx, [eax + eax]
push ecx
push esi
push 7
push 0
push str.InstallConfig
push edx
call edi
push esi
call fcn.0043ad71
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x413121
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x24], 0
mov dword [esp + 0x14], 0
je 0x413148
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov eax, esi
call fcn.0040d800
push esi
call fcn.00439c00
add esp, 4
xor ebx, ebx
cmp dword [esp + 0x48], 8
jb 0x41315e
mov eax, dword [esp + 0x34]
push eax
call fcn.00439c00
add esp, 4
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], cx
cmp eax, ebx
je 0x413180
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00438876
mov esp, ebp
pop ebp
ret 4