Function at 0x414c50
Capabilities:
Check os version
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x538aa6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e8
push ebx
push ebp
mov dword [esp + 0x38], ecx
push esi
push edi
lea ecx, [esp + 0xf8]
call fcn.004436d0
xor ebp, ebp
lea ecx, [esp + 0x148]
mov dword [esp + 0x300], ebp
call fcn.004132c0
lea ecx, [esp + 0xe8]
mov byte [esp + 0x300], 1
call fcn.00443890
mov eax, dword [0x5ab980]
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x30c]
mov edx, 0x559c1c
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x70], edx
mov dword [esp + 0x74], ebp
mov dword [esp + 0x78], ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x9c], ebp
mov dword [esp + 0xa0], ebp
mov dword [esp + 0xa4], ebp
mov dword [esp + 0xa8], ecx
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xac], edx
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xb4], ebp
mov dword [esp + 0xb8], ebp
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xdc], ebp
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xe4], ecx
mov eax, dword [esp + 0x308]
lea ecx, [esp + 0x24]
push eax
mov byte [esp + 0x304], 8
xor edi, edi
call fcn.00512a6d
lea ecx, [esp + 0x24]
push ecx
call fcn.0041f9c0
mov ecx, dword [esp + 0x28]
add esp, 4
lea edx, [esp + 0x58]
lea eax, [esp + 0xf8]
push ebp
push 1
push edx
push eax
push ecx
lea ecx, [esp + 0xfc]
call fcn.00444400
mov eax, dword [esp + 0xfc]
cmp eax, ebp
mov esi, eax
je 0x4154fa
jmp 0x414dbf
mov esi, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
inc edi
mov dword [esp + 0x4c], edi
call fcn.00422450
mov edx, dword [esi]
mov eax, esi
mov dword [esp + 0x48], edx
mov eax, dword [eax + 8]
mov cl, byte [eax + 4]
test cl, cl
jne 0x4154f0
add eax, 8
lea ecx, [esp + 0x20]
push eax
call fcn.00512a1d
lea eax, [esp + 0x20]
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x58]
push ecx
push edx
call fcn.00512b13
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x304], 9
call fcn.00512a1d
lea ecx, [esp + 0x54]
mov byte [esp + 0x300], 8
call fcn.005128e4
lea ecx, [esp + 0x148]
call fcn.00413680
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x20]
add eax, 0x1c
push ecx
lea ecx, [esp + 0x2e4]
mov dword [esp + 0x2e8], eax
call fcn.00512a1d
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x154]
push 1
push edx
push str.DisplayName
push eax
call fcn.0041efa0
mov ecx, dword [esp + 0x164]
add esp, 0x10
cmp dword [ecx - 8], ebp
je 0x4154f0
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x15c]
push 1
push edx
push str.UninstallString
push eax
call fcn.0041efa0
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x28]
push 1
push ecx
push str.InstallLocation
push edx
call fcn.0041efa0
mov eax, dword [esp + 0x38]
add esp, 0x20
cmp dword [eax - 8], ebp
je 0x414ee1
lea ecx, [esp + 0x18]
push ecx
call fcn.0041f9c0
lea edx, [esp + 0x1c]
push edx
call fcn.0041fe70
add esp, 8
test eax, eax
jne 0x414ee1
lea eax, [esp + 0x18]
lea ecx, [esp + 0x148]
push eax
call fcn.004088b0
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1f4]
push 1
push ecx
push str.Publisher
push edx
call fcn.0041efa0
lea eax, [esp + 0x78]
push 0x4f55
push eax
call fcn.00422640
add esp, 0x18
lea ecx, [esp + 0x154]
lea edx, [esp + 0x64]
push ecx
push eax
push edx
mov byte [esp + 0x30c], 0xa
call fcn.00512b13
mov eax, dword [eax]
push 1
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x308], 0xb
call fcn.00459410
test eax, eax
lea ecx, [esp + 0x64]
mov byte [esp + 0x300], 0xa
setne bl
call fcn.005128e4
lea ecx, [esp + 0x68]
mov byte [esp + 0x300], 8
call fcn.005128e4
test bl, bl
jne 0x41560f
mov eax, dword [esp + 0x104]
push eax
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea ecx, [esp + 0xb0]
call fcn.004594b0
test eax, eax
jne 0x415669
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.WindowsInstaller
push edx
mov dword [esp + 0x20], ebp
call fcn.0041f120
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebp
je 0x415145
lea eax, [esp + 0x220]
mov dword [esp + 0x14c], 0x1e
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x2b8]
call fcn.00512a1d
lea edx, [esp + 0x2b8]
lea ecx, [esp + 0x148]
push edx
call fcn.00414ab0
mov eax, dword [0x5ab980]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x44]
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x2bc]
push ecx
push edx
mov byte [esp + 0x30c], 0x15
call fcn.004222e0
add esp, 0xc
test eax, eax
jne 0x415082
lea eax, [esp + 0x2b4]
push 0x5c
lea ecx, [esp + 0x64]
push eax
push ecx
call fcn.0050dd7d
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x304], 0x16
call fcn.00512cfc
lea ecx, [esp + 0x60]
mov byte [esp + 0x300], 0x15
call fcn.005128e4
lea edx, [esp + 0x1fc]
lea eax, [esp + 0x2c]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x3c], esp
push eax
call fcn.00512659
call fcn.0041fa80
add esp, 8
lea ecx, [esp + 0x148]
call fcn.00414880
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push str.SystemComponent
push edx
mov dword [esp + 0x20], ebp
call fcn.0041f120
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x2cc]
xor ecx, ecx
cmp edi, ebp
setne cl
xor ecx, eax
lea edx, [esp + 0x20]
and ecx, 1
push edx
xor eax, ecx
push str.Version
mov dword [esp + 0x2d4], eax
mov eax, dword [esp + 0x24]
push eax
mov dword [esp + 0x2c], ebp
call fcn.0041f120
mov ecx, dword [esp + 0x2c]
add esp, 0x18
cmp ecx, ebp
jbe 0x41511e
mov edx, ecx
xor eax, eax
shr edx, 0x10
mov al, dh
movzx ax, al
movzx dx, dl
and eax, 0xffff
and edx, 0xffff
shl eax, 0x10
or eax, edx
and ecx, 0xffff
mov dword [esp + 0x21c], eax
mov dword [esp + 0x218], ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x300], 0x14
call fcn.005128e4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x300], 8
call fcn.005128e4
jmp 0x4152b6
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1f0]
push 1
push ecx
push str.LogFile
push edx
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x4151e4
lea eax, [esp + 0x1f0]
lea ecx, [esp + 0x6c]
push eax
push ecx
call fcn.00422000
add esp, 8
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x304], 0x17
call fcn.00512a1d
lea ecx, [esp + 0x6c]
mov byte [esp + 0x300], 8
call fcn.005128e4
mov eax, dword [esp + 0x28]
mov esi, 0x59854c
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4151ce
test cl, cl
je 0x4151ca
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4151ce
add eax, 2
add esi, 2
test cl, cl
jne 0x4151a6
xor eax, eax
jmp 0x4151d3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebp
jne 0x4151e4
mov dword [esp + 0x14c], 0xb
jmp 0x4151f2
cmp dword [esp + 0x14c], 0xb
jne 0x415292
mov eax, dword [0x5ab980]
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1f4]
mov byte [esp + 0x300], 0x19
cmp dword [eax - 8], ebp
jne 0x41522f
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1f4]
push 1
push ecx
push str.RegCompany
push edx
call fcn.0041efa0
add esp, 0x10
lea eax, [esp + 0x34]
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x1f4]
push ecx
push edx
call fcn.004222e0
add esp, 0xc
test eax, eax
jne 0x41526e
lea eax, [esp + 0x1fc]
lea edx, [esp + 0x38]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x58], esp
push edx
call fcn.00512659
call fcn.0041fa80
add esp, 8
lea ecx, [esp + 0x34]
mov byte [esp + 0x300], 0x18
call fcn.005128e4
lea ecx, [esp + 0x38]
mov byte [esp + 0x300], 8
call fcn.005128e4
jmp 0x4152b6
mov eax, dword [esp + 0x15c]
cmp dword [eax - 8], ebp
je 0x4154f0
lea ecx, [esp + 0x148]
call fcn.0040c3a0
test eax, eax
jle 0x4154f0
lea ecx, [esp + 0x120]
call fcn.004436d0
lea ecx, [esp + 0x2e8]
mov byte [esp + 0x300], 0x1a
call fcn.00443890
push str.HKEY_CURRENT_USERSoftwareEisenworldPCRelocatorAppScan
lea ecx, [esp + 0x20]
call fcn.00512952
lea ecx, [esp + 0x1c]
mov byte [esp + 0x300], 0x1b
push ecx
call fcn.0041f9c0
mov ecx, dword [esp + 0x20]
add esp, 4
lea edx, [esp + 0x58]
lea eax, [esp + 0x120]
push ebp
push ebp
push edx
push eax
push ecx
lea ecx, [esp + 0xfc]
call fcn.00444400
mov esi, dword [esp + 0x124]
cmp esi, ebp
je 0x415425
mov eax, esi
mov esi, dword [esi]
mov edi, dword [eax + 8]
mov al, byte [edi + 4]
test al, al
je 0x41536d
mov edx, dword [esp + 0x2e0]
mov eax, dword [edi + 8]
push edx
push eax
call fcn.004f9670
add esp, 8
cmp eax, ebp
jne 0x41536d
mov edi, dword [edi + 8]
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x5c]
push ecx
push edi
push edx
call fcn.0041f120
mov eax, dword [esp + 0x68]
add esp, 0xc
cmp eax, 0xffffffff
je 0x415376
cmp esi, ebp
jne 0x415328
jmp 0x415425
mov eax, dword [0x5ab980]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x30]
push eax
push eax
push str.PC_Relocator_has_found__s_to_have_an_unreadable_installation_state._You_may_encounter_some_problems_relocating_this_application._n_nClick_Yes_to_skip_gathering_information_about__s._n_n_nFor_more_information_on_this_issue_please_contact_our_technical_support_via_email._nEmail:_support_eisenworld.com
push ecx
mov byte [esp + 0x310], 0x1c
call fcn.0050e6c7
add esp, 0x10
lea ecx, [esp + 0x3c]
push str.Skip_Unstable_Application__
call fcn.00512952
push ebp
lea edx, [esp + 0x40]
push 0x34
lea eax, [esp + 0x38]
push edx
push eax
mov byte [esp + 0x310], 0x1d
call fcn.0042e190
add esp, 0x10
lea ecx, [esp + 0x3c]
mov esi, eax
mov byte [esp + 0x300], 0x1c
call fcn.005128e4
cmp esi, 6
mov byte [esp + 0x300], 0x1b
lea ecx, [esp + 0x30]
jne 0x415420
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x300], 0x1a
call fcn.005128e4
lea ecx, [esp + 0x120]
mov byte [esp + 0x300], 8
call fcn.00443720
jmp 0x4154f0
call fcn.005128e4
mov ecx, dword [esp + 0x2e0]
mov edx, dword [esp + 0x1c]
push 0xffffffffffffffff
push ecx
push edx
call fcn.0041e5a0
add esp, 0xc
lea ecx, [esp + 0x148]
call fcn.004140c0
mov eax, dword [esp + 0x2e0]
mov ecx, dword [esp + 0x1c]
push ebp
push eax
push ecx
call fcn.0041e5a0
add esp, 0xc
lea ecx, [esp + 0x1c]
mov byte [esp + 0x300], 0x1a
call fcn.005128e4
lea ecx, [esp + 0x120]
mov byte [esp + 0x300], 8
call fcn.00443720
lea ecx, [esp + 0x148]
call fcn.004080f0
mov edx, dword [esp + 0x1f8]
cmp dword [edx - 8], ebp
je 0x4154af
lea eax, [esp + 0x1f8]
lea ecx, [esp + 0x1b4]
push eax
call fcn.00405a60
push ebp
push ebp
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x5c], esp
push edx
call fcn.00512659
lea ecx, [esp + 0x154]
call fcn.00407760
lea eax, [esp + 0x10]
lea ecx, [esp + 0x158]
push eax
call fcn.00512a1d
lea ecx, [esp + 0x148]
push ecx
mov ecx, dword [esp + 0x44]
call fcn.004157d0
cmp dword [esp + 0x48], ebp
jne 0x414db7
lea ecx, [esp + 0xc8]
mov byte [esp + 0x300], 0x1f
call fcn.005128e4
lea ecx, [esp + 0xc4]
mov byte [esp + 0x300], 0x1e
call fcn.005128e4
lea ecx, [esp + 0xc0]
mov byte [esp + 0x300], 7
call fcn.005128e4
lea ecx, [esp + 0x8c]
mov byte [esp + 0x300], 0x21
call fcn.005128e4
lea ecx, [esp + 0x88]
mov byte [esp + 0x300], 0x20
call fcn.005128e4
lea ecx, [esp + 0x84]
mov byte [esp + 0x300], 6
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x300], 5
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x300], 4
call fcn.005128e4
lea ecx, [esp + 0x28]
mov byte [esp + 0x300], 3
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x300], 2
call fcn.005128e4
lea ecx, [esp + 0x10]
mov byte [esp + 0x300], 1
call fcn.005128e4
lea ecx, [esp + 0x148]
mov byte [esp + 0x300], 0
call fcn.004134c0
lea ecx, [esp + 0xf8]
mov dword [esp + 0x300], 0xffffffff
call fcn.00443720
xor eax, eax
mov ecx, dword [esp + 0x2f8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x2f4
ret 8
lea ecx, [esp + 0xc8]
mov byte [esp + 0x300], 0xd
call fcn.005128e4
lea ecx, [esp + 0xc4]
mov byte [esp + 0x300], 0xc
call fcn.005128e4
lea ecx, [esp + 0xc0]
mov byte [esp + 0x300], 7
call fcn.005128e4
lea ecx, [esp + 0x8c]
mov byte [esp + 0x300], 0xf
call fcn.005128e4
mov byte [esp + 0x300], 0xe
jmp 0x4156c1
lea ecx, [esp + 0xc8]
mov byte [esp + 0x300], 0x11
call fcn.005128e4
lea ecx, [esp + 0xc4]
mov byte [esp + 0x300], 0x10
call fcn.005128e4
lea ecx, [esp + 0xc0]
mov byte [esp + 0x300], 7
call fcn.005128e4
lea ecx, [esp + 0x8c]
mov byte [esp + 0x300], 0x13
call fcn.005128e4
mov byte [esp + 0x300], 0x12
lea ecx, [esp + 0x88]
call fcn.005128e4
lea ecx, [esp + 0x84]
mov byte [esp + 0x300], 6
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x300], 5
call fcn.005128e4
lea ecx, [esp + 0x24]
mov byte [esp + 0x300], 4
call fcn.005128e4
lea ecx, [esp + 0x28]
mov byte [esp + 0x300], 3
call fcn.005128e4
lea ecx, [esp + 0x20]
mov byte [esp + 0x300], 2
call fcn.005128e4
lea ecx, [esp + 0x10]
mov byte [esp + 0x300], 1
call fcn.005128e4
lea ecx, [esp + 0x148]
mov byte [esp + 0x300], 0
call fcn.004134c0
lea ecx, [esp + 0xf8]
mov dword [esp + 0x300], 0xffffffff
call fcn.00443720
mov eax, 0xfffffc19
jmp 0x4155f4