Function at 0x41ced1
Capabilities:
Create process on windows
Set registry value

Disassembly:
push 0x2cc
mov eax, 0x46f29a
call fcn.00454bef
mov ebx, ecx
lea eax, [ebx + 0x160]
push str.Bootstrapper::initialize
push eax
mov dword [ebp - 0x274], ebx
call fcn.004087a0
and dword [ebp - 4], 0
mov eax, dword [ebx]
pop ecx
pop ecx
mov ecx, ebx
call dword [eax + 0x34]
and dword [ebp - 0x230], 0
mov ecx, dword [ebx + 0x134]
sub esp, 0x10
mov dword [ebp - 0x234], 0x424eb1
mov dword [ebp - 0x22c], ebx
mov edi, esp
lea esi, [ebp - 0x234]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add ecx, 0x10
movsd dword es:[edi], dword [esi]
call fcn.004284c8
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xcc]
lea ecx, [ebp - 0x23c]
push eax
call fcn.00408580
mov byte [ebp - 4], 1
mov ecx, dword [ebx + 0x134]
cmp dword [ebp - 0x228], 8
mov eax, dword [ecx]
lea esi, [ebp - 0x23c]
cmovae esi, dword [ebp - 0x23c]
call dword [eax + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 0
call fcn.00408690
mov ecx, ebx
call fcn.0041dd40
cmp dword [0x4a5fd4], 0
mov cl, byte [ebx + 0x4d]
mov dword [ebp - 0x270], ecx
jne 0x41cff8
test cl, cl
je 0x41cfe8
push str.OLEAUT32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41cfc9
push str.RegisterTypeLibForUser
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a5fd4], eax
jmp 0x41cfce
mov eax, dword [0x4a5fd4]
mov ecx, dword [ebp - 0x270]
xor edx, edx
movzx ecx, cl
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x270], ecx
test cl, cl
jne 0x41cff2
mov eax, dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov dword [0x4a5fd4], eax
mov byte [0x4a5fc7], cl
lea esi, [ebx + 0x160]
cmp cl, byte [ebx + 0x4d]
je 0x41d016
push str.::GetProcAddress_hmodOleAut___RegisterTypeLibForUser___FAILED__install_farced_to_global_mode
push esi
call fcn.004087a0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x270]
mov byte [ebx + 0x4d], cl
call fcn.004416e7
movzx eax, al
push eax
push str.IsVistaPlus___d
push esi
call fcn.004087a0
add esp, 0xc
call fcn.004416e7
test al, al
je 0x41d060
call fcn.0044174f
movzx eax, al
push eax
push str.IsElevated___d
push esi
call fcn.004087a0
add esp, 0xc
call fcn.004417e8
movzx eax, al
push eax
push str.IsUacEnabled___d
jmp 0x41d08e
call fcn.0041b889
movzx eax, al
push eax
push str.IsWinXP___d
push esi
call fcn.004087a0
add esp, 0xc
call fcn.0041b889
test al, al
je 0x41d097
call fcn.0041bb04
movzx eax, al
push eax
push str.IsAdminRunning___d
push esi
call fcn.004087a0
add esp, 0xc
cmp byte [ebx + 0x4d], 0
je 0x41d14f
cmp byte [ebx + 0x4a], 0
je 0x41d139
mov esi, dword [ebx + 0x134]
push 0
mov edi, dword [esi]
push str.Debug
call fcn.004416e7
mov ecx, str.This_is_not_Vista
test al, al
mov edx, str.This_is_Vista
cmove edx, ecx
push edx
mov ecx, esi
call dword [edi + 4]
call fcn.004416e7
test al, al
je 0x41d131
mov esi, dword [ebx + 0x134]
call fcn.0044174f
mov edx, dword [esi]
mov cl, al
push 0
test cl, cl
mov eax, str.This_is_Elevated
mov edi, str.This_is_not_Elevated
push str.Debug
cmove eax, edi
push eax
mov ecx, esi
call dword [edx + 4]
call fcn.0044174f
test al, al
je 0x41d131
mov ecx, dword [ebx + 0x134]
push 4
mov eax, dword [ecx]
push str.DEBUG
push str.Do_you_want_an_all_user_install_
call dword [eax + 4]
cmp eax, 7
sete al
mov byte [ebx + 0x4d], al
lea esi, [ebx + 0x160]
jmp 0x41d14f
call fcn.004416e7
test al, al
je 0x41d14f
call fcn.0044174f
test al, al
je 0x41d14f
mov byte [ebx + 0x4d], 0
movzx eax, byte [ebx + 0x4d]
push eax
push str.perUser___d
push esi
call fcn.004087a0
add esp, 0xc
push 0xc
call fcn.004501aa
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41d17e
mov al, byte [ebx + 0x4d]
and dword [ecx + 8], 0
mov dword [ecx], ebx
mov byte [ecx + 4], al
jmp 0x41d180
xor ecx, ecx
mov eax, dword [ebx + 0x138]
push eax
mov dword [ebx + 0x138], ecx
call fcn.0044f82f
mov dword [esp], str.Bootstrapper::initialize___calling_loadPrevVersions
push esi
call fcn.004087a0
pop ecx
pop ecx
mov ecx, ebx
call fcn.00424139
lea eax, [ebp - 0x254]
push eax
mov ecx, ebx
call fcn.00402310
mov byte [ebp - 4], 2
cmp dword [ebp - 0x244], 0
jne 0x41d1d2
push str.isUpdating__false
push esi
call fcn.004087a0
pop ecx
pop ecx
jmp 0x41d218
cmp dword [ebp - 0x240], 0x10
lea eax, [ebp - 0x254]
cmovae eax, dword [ebp - 0x254]
push eax
push str.isUpdating__true___s
push esi
call fcn.004087a0
mov eax, dword [ebx]
add esp, 0xc
mov ecx, ebx
call dword [eax + 0xf0]
test al, al
je 0x41d218
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xf4]
test al, al
je 0x41d218
mov byte [ebx + 0x98], 1
cmp byte [ebx + 0x4b], 0
jne 0x41d224
cmp byte [ebx + 0x4c], 0
jne 0x41d22f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
test al, al
je 0x41d236
mov byte [ebx + 0x98], 1
mov ecx, dword [ebx + 0x134]
mov al, byte [ebx + 0x98]
mov byte [ecx + 8], al
cmp byte [ebx + 0x4d], 0
jne 0x41d469
call fcn.004416e7
test al, al
je 0x41d469
call fcn.0044174f
test al, al
jne 0x41d469
call fcn.004417e8
test al, al
je 0x41d414
push str.re_launching_elevated
push esi
call fcn.004087a0
and dword [ebp - 0x22c], 0
pop ecx
pop ecx
push 0
lea ecx, [ebp - 0x23c]
mov dword [ebp - 0x228], 7
call fcn.0040a470
xor esi, esi
mov byte [ebp - 4], 3
inc esi
cmp esi, dword [0x4a5328]
jge 0x41d2fd
cmp dword [ebp - 0x22c], 0
je 0x41d2c9
push 0x47c760
lea ecx, [ebp - 0x23c]
call fcn.00408710
push 0x22
push 1
lea ecx, [ebp - 0x23c]
call fcn.00426f09
mov eax, dword [0x4a5330]
lea ecx, [ebp - 0x23c]
push dword [eax + esi*4]
call fcn.00408710
push 0x22
push 1
lea ecx, [ebp - 0x23c]
call fcn.00426f09
inc esi
jmp 0x41d2a8
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x2d4]
push 0
push eax
call fcn.00454000
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 0x228], 8
lea eax, [ebp - 0x224]
mov dword [ebp - 0x2c8], eax
lea eax, [ebp - 0x23c]
cmovae eax, dword [ebp - 0x23c]
mov dword [ebp - 0x2c4], eax
lea eax, [ebp - 0x2d8]
push eax
mov dword [ebp - 0x2d8], 0x3c
mov dword [ebp - 0x2d4], ecx
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 0x2cc], str.runas
mov dword [ebp - 0x2c0], ecx
mov dword [ebp - 0x2bc], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41d3a2
lea eax, [ebx + 0x160]
push str.ShellExecuteEx_succeeded
push eax
call fcn.004087a0
pop ecx
pop ecx
jmp 0x41d3d6
lea ecx, [ebp - 0x270]
call fcn.0042d9e8
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebx + 0x160]
push str.ShellExecuteEx_failed:__S
push eax
call fcn.004087a0
add esp, 0xc
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 3
call fcn.00410c00
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x284]
mov dword [ebp - 0x270], str.InstallerError
call fcn.0044f8e7
and dword [ebp - 0x278], 0
mov dword [ebp - method.std::logic_error.virtual_0], vtable.installer_error_exception.0
push 0x48ee34
lea eax, [ebp - 0x284]
push eax
call fcn.00454ac3
cmp byte [ebx + 0x4b], 0
je 0x41d42c
mov ecx, dword [ebx + 0x134]
push 0
mov eax, dword [ecx]
push str.This_operation_requires_administrator_priveleges
call dword [eax + 0x1c]
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x298]
mov dword [ebp - 0x270], str.InstallerError
call fcn.0044f8e7
mov dword [ebp - method.std::logic_error.virtual_0], vtable.installer_error_exception.0
mov dword [ebp - 0x28c], 8
push 0x48ee34
lea eax, [ebp - 0x298]
jmp 0x41d40e
push ecx
xor eax, eax
cmp byte [ebx + 0x4d], al
push ecx
push 0x2001f
sete al
push ecx
push ecx
push str.SoftwareClasses
lea ecx, [ebx + 0x13c]
add eax, 0x80000001
push eax
call fcn.0042cf40
mov edx, str.Failed_to_create_HKSoftwareClasses
mov ecx, eax
call fcn.0042d96a
cmp byte [ebx + 0x4d], 0
mov ecx, str.HKEY_LOCAL_MACHINE
mov eax, str.HKEY_CURRENT_USER
cmove eax, ecx
push eax
push str.classesKey___sSoftwareClasses
push esi
call fcn.004087a0
add esp, 0xc
lea ecx, [ebp - 0x23c]
call fcn.004466cd
cmp dword [eax + 0x10], 0
lea ecx, [ebp - 0x23c]
sete bl
call fcn.00408690
test bl, bl
je 0x41d545
push 0
xor edx, edx
push 0
push 1
inc edx
lea ecx, [ebp - 0x23c]
call fcn.0042ff61
add esp, 0xc
mov byte [ebp - 4], 6
cmp dword [ebp - 0x228], 8
lea ecx, [ebp - 0x23c]
cmovae ecx, dword [ebp - 0x23c]
call fcn.00420068
push str.rbxcsettings.rbx
lea edx, [ebp - 0x23c]
lea ecx, [ebp - 0x26c]
call fcn.00428598
pop ecx
mov ecx, eax
call fcn.00446779
lea ecx, [ebp - 0x26c]
call fcn.00408690
lea ecx, [ebp - 0x23c]
call fcn.00408690
lea ecx, [ebp - 0x254]
call fcn.00404060
call fcn.00454b41
ret