Function at 0x41c8ac
Capabilities:
Create process on windows
Set registry value

Disassembly:
push ebp
sub esp, 0x24c
lea ebp, [esp - 4]
mov eax, dword [0x493350]
xor eax, ebp
mov dword [ebp + 0x24c], eax
push 0x90
mov eax, 0x46dd13
call fcn.00451210
mov ebx, ecx
lea esi, [ebx + 0x1ac]
push str.Bootstrapper::initialize
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], esi
call fcn.00406fa0
and dword [ebp - 4], 0
mov eax, dword [ebx]
pop ecx
mov ecx, ebx
call dword [eax + 0x34]
sub esp, 0x10
mov eax, 0x424dc7
mov dword [ebp + 0x34], eax
mov eax, dword [ebx + 0x160]
xor ecx, ecx
mov dword [ebp + 0x38], ecx
mov dword [ebp + 0x3c], ebx
mov edi, esp
lea esi, [ebp + 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add eax, 0x10
push eax
movsd dword es:[edi], dword [esi]
call fcn.0042a0b3
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc4]
lea ecx, [ebp + 0x28]
call fcn.00406dd0
mov byte [ebp - 4], 1
cmp dword [ebp + 0x40], 8
mov ecx, dword [ebx + 0x160]
mov esi, dword [ebp + 0x2c]
jae 0x41c94a
lea esi, [ebp + 0x2c]
mov eax, dword [ecx]
call dword [eax + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea esi, [ebp + 0x28]
mov byte [ebp - 4], 0
call fcn.00406e40
mov ecx, ebx
call fcn.0041d61e
cmp dword [0x49d9a8], 0
mov al, byte [ebx + 0x59]
mov byte [ebp - 0x14], al
jne 0x41c9c2
test al, al
je 0x41c9b1
push str.OLEAUT32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41c99d
push str.RegisterTypeLibForUser
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x49d9a8], eax
cmp dword [0x49d9a8], 0
jne 0x41c9aa
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x14]
test al, al
jne 0x41c9bd
mov ecx, dword [sym.imp.OLEAUT32.dll_QueryPathOfRegTypeLib]
mov dword [0x49d9a8], ecx
mov byte [0x49d99a], al
mov edi, dword [ebp - 0x18]
cmp al, byte [ebx + 0x59]
je 0x41c9da
push str.::GetProcAddress_hmodOleAut___RegisterTypeLibForUser___FAILED__install_farced_to_global_mode
mov esi, edi
call fcn.00406fa0
mov al, byte [ebp - 0x14]
pop ecx
mov byte [ebx + 0x59], al
call fcn.00443c10
movzx eax, al
push eax
push str.IsVistaPlus___d
mov esi, edi
call fcn.00406fa0
pop ecx
pop ecx
call fcn.00443c10
test al, al
je 0x41ca22
call fcn.00443c7a
movzx eax, al
push eax
push str.IsElevated___d
call fcn.00406fa0
pop ecx
pop ecx
call fcn.00443d1f
movzx eax, al
push eax
push str.IsUacEnabled___d
jmp 0x41ca50
call fcn.0041b0c8
movzx eax, al
push eax
push str.IsWinXP___d
mov esi, edi
call fcn.00406fa0
pop ecx
pop ecx
call fcn.0041b0c8
test al, al
je 0x41ca59
call fcn.0041b382
movzx eax, al
push eax
push str.IsAdminRunning___d
mov esi, edi
call fcn.00406fa0
pop ecx
pop ecx
cmp byte [ebx + 0x59], 0
je 0x41cafc
cmp byte [ebx + 0x56], 0
je 0x41cae6
call fcn.00443c10
test al, al
mov eax, str.This_is_Vista
jne 0x41ca7c
mov eax, str.This_is_not_Vista
mov ecx, dword [ebx + 0x160]
mov edx, dword [ecx]
push 0
mov esi, str.Debug
push esi
push eax
call dword [edx + 4]
call fcn.00443c10
test al, al
je 0x41cafc
call fcn.00443c7a
test al, al
mov eax, str.This_is_Elevated
jne 0x41caac
mov eax, str.This_is_not_Elevated
mov ecx, dword [ebx + 0x160]
mov edx, dword [ecx]
push 0
push esi
push eax
call dword [edx + 4]
call fcn.00443c7a
test al, al
je 0x41cafc
mov ecx, dword [ebx + 0x160]
mov eax, dword [ecx]
push 4
push str.DEBUG
push str.Do_you_want_an_all_user_install_
call dword [eax + 4]
cmp eax, 7
sete al
mov byte [ebx + 0x59], al
jmp 0x41cafc
call fcn.00443c10
test al, al
je 0x41cafc
call fcn.00443c7a
test al, al
je 0x41cafc
mov byte [ebx + 0x59], 0
movzx eax, byte [ebx + 0x59]
push eax
push str.perUser___d
mov esi, edi
call fcn.00406fa0
pop ecx
pop ecx
push 0xc
call fcn.0044d0eb
pop ecx
test eax, eax
je 0x41cb29
mov cl, byte [ebx + 0x59]
and dword [eax + 8], 0
mov dword [eax], ebx
mov byte [eax + 4], cl
jmp 0x41cb2b
xor eax, eax
lea ecx, [ebx + 0x164]
mov edx, dword [ecx]
push edx
mov dword [ecx], eax
call fcn.0044cce2
mov esi, edi
mov dword [esp], str.Bootstrapper::initialize___calling_loadPrevVersions
call fcn.00406fa0
pop ecx
call fcn.00423fc9
lea ecx, [ebp + 0xc]
mov esi, ebx
call fcn.00401d40
mov byte [ebp - 4], 2
cmp dword [ebp + 0x20], 0
jne 0x41cb73
mov esi, dword [ebp - 0x18]
push str.isUpdating__false
call fcn.00406fa0
pop ecx
jmp 0x41cbb2
cmp dword [ebp + 0x24], 0x10
mov eax, dword [ebp + 0x10]
jae 0x41cb7f
lea eax, [ebp + 0x10]
mov esi, dword [ebp - 0x18]
push eax
push str.isUpdating__true___s
call fcn.00406fa0
mov eax, dword [ebx]
pop ecx
pop ecx
mov ecx, ebx
call dword [eax + 0xe8]
test al, al
je 0x41cbb2
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xec]
test al, al
je 0x41cbb2
mov byte [ebx + 0xb8], 1
cmp byte [ebx + 0x57], 0
jne 0x41cbbe
cmp byte [ebx + 0x58], 0
jne 0x41cbc9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x7c]
test al, al
je 0x41cbd0
mov byte [ebx + 0xb8], 1
mov eax, dword [ebx + 0x160]
mov cl, byte [ebx + 0xb8]
mov byte [eax + 8], cl
cmp byte [ebx + 0x59], 0
jne 0x41cd63
call fcn.00443c10
test al, al
je 0x41cd63
call fcn.00443c7a
test al, al
jne 0x41cd63
call fcn.00443d1f
test al, al
je 0x41cd33
mov esi, dword [ebp - 0x18]
push str.re_launching_elevated
call fcn.00406fa0
xor esi, esi
xor eax, eax
pop ecx
mov dword [ebp + 0x40], 7
mov dword [ebp + 0x3c], esi
mov word [ebp + 0x2c], ax
xor edi, edi
mov byte [ebp - 4], 3
inc edi
cmp edi, dword [0x49cdc4]
jge 0x41cc78
cmp dword [ebp + 0x3c], esi
je 0x41cc52
lea eax, [ebp + 0x28]
push eax
mov eax, 0x474860
call fcn.00406ea0
push 0x22
lea esi, [ebp + 0x28]
call fcn.00425950
mov eax, esi
push eax
mov eax, dword [0x49cdcc]
mov eax, dword [eax + edi*4]
call fcn.00406ea0
push 0x22
call fcn.00425950
inc edi
xor esi, esi
jmp 0x41cc37
push 0x104
lea eax, [ebp + 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x38
lea eax, [ebp - 0x5c]
push esi
push eax
call fcn.00450ab0
lea eax, [ebp + 0x44]
add esp, 0xc
cmp dword [ebp + 0x40], 8
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x60], 0x3c
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], str.runas
jae 0x41ccbd
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41cceb
push str.ShellExecuteEx_succeeded
lea esi, [ebx + 0x1ac]
call fcn.00406fa0
pop ecx
jmp 0x41cd19
lea eax, [ebp - 0x18]
push eax
call fcn.0042fa0c
pop ecx
mov byte [ebp - 4], 4
push dword [eax]
lea esi, [ebx + 0x1ac]
push str.ShellExecuteEx_failed:__S
call fcn.00406fa0
pop ecx
pop ecx
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0040c440
push 0
lea esi, [ebp - 0x8c]
call fcn.0042e833
push 0x486754
mov eax, esi
push eax
call fcn.00450dab
cmp byte [ebx + 0x57], 0
je 0x41cd4d
mov ebx, dword [ebx + 0x160]
mov eax, dword [ebx]
push 0
push str.This_operation_requires_administrator_priveleges
mov ecx, ebx
call dword [eax + 0x1c]
push 8
lea esi, [ebp - 0x9c]
call fcn.0042e833
push 0x486754
mov eax, esi
jmp 0x41cd2d
xor eax, eax
cmp byte [ebx + 0x59], al
push str.Failed_to_create_HKSoftwareClasses
sete al
push str.SoftwareClasses
lea ecx, [ebx + 0x168]
add eax, 0x80000001
push eax
mov eax, 0x2001f
call fcn.0042e7d0
mov ecx, eax
call fcn.0042f972
cmp byte [ebx + 0x59], 0
pop ecx
mov eax, str.HKEY_CURRENT_USER
jne 0x41cda3
mov eax, str.HKEY_LOCAL_MACHINE
mov esi, dword [ebp - 0x18]
push eax
push str.classesKey___sSoftwareClasses
call fcn.00406fa0
pop ecx
pop ecx
lea ebx, [ebp + 0x28]
call fcn.00446efc
xor ebx, ebx
cmp dword [eax + 0x14], ebx
lea esi, [ebp + 0x28]
sete byte [ebp - 0x14]
call fcn.00406e40
cmp byte [ebp - 0x14], bl
je 0x41ce1e
push ebx
push ebx
push 1
lea eax, [ebp + 0x28]
push 1
push eax
call fcn.0043290e
add esp, 0x14
mov byte [ebp - 4], 6
cmp dword [ebp + 0x40], 8
mov eax, dword [ebp + 0x2c]
jae 0x41cdf3
lea eax, [ebp + 0x2c]
push eax
call fcn.0041fc52
pop ecx
lea eax, [ebp + 0x28]
push eax
mov ebx, str.rbxcsettings.rbx
lea esi, [ebp - 0x7c]
call fcn.00409470
pop ecx
call fcn.00446fa9
call fcn.00406e40
lea esi, [ebp + 0x28]
call fcn.00406e40
lea ecx, [ebp + 0xc]
call fcn.00406d50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x24c]
xor ecx, ebp
call fcn.0044cced
add ebp, 0x250
leave
ret