Function at 0x414850
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x457218
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x46e3d8]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e3d8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x6c], 2
cmp byte [edi + 0x3e], 0
mov dword [esp + 0x1c], 0x1000
je 0x414b67
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x414b41
mov edx, 0x45e624
call fcn.00401ee0
test eax, eax
je 0x41490b
mov ecx, 0x45e624
call fcn.00401f80
jmp 0x414916
push edi
mov ecx, 0x45e628
call fcn.00412a70
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x414920
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x414920
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, esi
sar ecx, 1
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [esp + 0x1c]
push 1
push ebp
push str.InstallPath
push eax
call ebx
lea ecx, [esp + 0x40]
push ecx
call fcn.00426aa0
mov edx, dword [esp + 0x48]
add esp, 4
cmp dword [esp + 0x58], 8
jae 0x414965
lea edx, [esp + 0x44]
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414970
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Version
push ecx
call ebx
cmp dword [edi + 0x34], ebp
mov edx, 0x45ddc8
jne 0x4149a1
mov edx, 0x45ddd0
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4149a6
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Reboot
push ecx
call ebx
cmp dword [edi + 0x38], ebp
mov edx, str.success
je 0x4149d7
mov edx, str.failure
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4149e0
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Install
push ecx
call ebx
mov ecx, dword [0x470c20]
add ecx, 0xa38
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
cmp si, bp
jne 0x414a13
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 0x14]
push edx
push ecx
push 1
push ebp
push 0x45e688
push eax
call ebx
mov ecx, dword [edi + 0x44]
mov eax, dword [ecx]
lea ebp, [edi + 0x40]
mov esi, ebp
mov edi, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
lea ebx, [ebx]
test esi, esi
mov edx, dword [ebp + 4]
mov dword [esp + 0x3c], edx
je 0x414a5f
cmp esi, ebp
je 0x414a64
call fcn.0043e955
cmp edi, dword [esp + 0x3c]
je 0x414ad4
test esi, esi
jne 0x414a73
call fcn.0043e955
cmp edi, dword [esi + 4]
jne 0x414a7d
call fcn.0043e955
cmp byte [edi + 0x28], 0
je 0x414abe
cmp edi, dword [esi + 4]
jne 0x414a8d
call fcn.0043e955
cmp dword [edi + 0x24], 8
lea ebx, [edi + 0xc]
jb 0x414a9b
mov eax, dword [ebx + 4]
jmp 0x414a9e
lea eax, [ebx + 4]
cmp word [eax], 0x40
je 0x414ab8
cmp edi, dword [esi + 4]
jne 0x414aae
call fcn.0043e955
push ebx
lea esi, [esp + 0x24]
call fcn.0040da30
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea esi, [esp + 0x30]
call fcn.00424500
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
jmp 0x414a50
xor ecx, ecx
mov eax, 0x1000
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0043ce31
mov esi, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x28]
call fcn.0043b910
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [ecx + ecx]
push edx
push esi
push 7
push 0
push str.InstallConfig
push eax
call ebx
push esi
call fcn.0043ed74
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x414b37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
xor ebp, ebp
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x414b67
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
push ecx
call fcn.00411dd0
mov edx, dword [esp + 0x28]
add esp, 4
push edx
call fcn.0043e965
add esp, 4
cmp dword [esp + 0x58], 8
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
jb 0x414b87
mov eax, dword [esp + 0x44]
push eax
call fcn.0043e965
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
je 0x414ba7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0043d02a
add esp, 0x5c
ret 4