Function at 0x41bfc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push 0xffffffffffffffff
push 0x4aa7cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esi + 0xb0]
mov dword [esp + 0x14], esi
cmp ecx, ebx
je 0x41bff9
lea eax, [ecx - 0xb0]
jmp 0x41bffb
xor eax, eax
push ecx
add eax, 8
push 0x40
push 0xd
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [esi + 4], ebx
mov dword [esp + 0x220], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
or eax, 0xffffffff
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
mov byte [esi + 0xd0], bl
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
lea edi, [esi + 0x20]
mov byte [esp + 0x220], 2
mov ecx, edi
call fcn.00441460
lea ecx, [esi + 0xd8]
mov byte [esp + 0x220], 3
call fcn.00429770
mov eax, 4
mov dword [esi], vtable.CInstallCompletePage.1.0
mov dword [edi], vtable.CInstallCompletePage.0
mov dword [esi + 0x98], eax
mov dword [esi + 0x58], 0x85
mov ecx, dword [0x4d1ac8]
lea edx, [esp + 0x18]
mov byte [esp + 0x220], al
mov eax, dword [ecx + 8]
push 0x100
push edx
push 0x8c
push eax
lea edi, [esi + 0x5c]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41c0c7
mov word [esp + 0x18], bx
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x41c109
lea edx, [esp + 0x18]
test edx, edx
jne 0x41c0ef
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
mov ecx, edi
call fcn.00405750
jmp 0x41c17d
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, edi
call fcn.00405750
jmp 0x41c17d
push 0x1ff
mov ecx, edi
mov ebp, 0x200
call fcn.00405530
mov edi, eax
cmp edi, ebx
je 0x41c15f
mov edx, dword [0x4d1ac8]
push ebp
push edi
push 0x8c
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41c13e
mov word [edi], bx
mov ecx, ebp
sub ecx, eax
cmp ecx, 1
jg 0x41c15f
add ebp, 0x100
lea ecx, [esi + 0x5c]
lea edx, [ebp - 1]
push edx
call fcn.00405530
mov edi, eax
cmp edi, ebx
jne 0x41c120
lea edi, [esi + 0x5c]
mov ecx, edi
call fcn.00405940
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
mov dword [ecx - 8], eax
mov edx, dword [edi]
mov word [edx + eax*2], bx
mov eax, dword [esi + 0x98]
lea ecx, [esi + 0x20]
push eax
call fcn.004288b0
mov ecx, eax
call fcn.0043d630
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x10], edi
je 0x41c267
cmp dword [edi + 4], ebx
je 0x41c267
mov dword [esi + 0x68], 2
mov ecx, dword [0x4d1ac8]
lea edx, [esp + 0x18]
push 0x100
mov eax, dword [ecx + 8]
push edx
push 0x8a
push eax
lea ebp, [esi + 0x6c]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
jne 0x41c1dc
mov word [esp + 0x18], bx
mov ecx, 0x100
sub ecx, eax
cmp ecx, 1
jle 0x41c21b
lea edx, [esp + 0x18]
test edx, edx
jne 0x41c201
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
mov ecx, ebp
call fcn.00405750
jmp 0x41c267
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [esp + 0x18]
push ecx
push eax
mov ecx, ebp
call fcn.00405750
jmp 0x41c267
push 0x1ff
mov ecx, ebp
mov edi, 0x200
call fcn.00405530
cmp eax, ebx
je 0x41c25a
push edi
push eax
push 0x8a
call fcn.00405b00
mov edx, edi
sub edx, eax
cmp edx, 1
jg 0x41c25a
add edi, 0x100
mov ecx, ebp
lea eax, [edi - 1]
push eax
call fcn.00405530
cmp eax, ebx
jne 0x41c230
push 0xffffffffffffffff
mov ecx, ebp
call fcn.004055f0
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x218]
mov dword [edi], ebx
mov dword [esi + 0x90], 0xa5
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x214
ret