Function at 0x41a730
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x516371
mov eax, dword fs:[0]
push eax
mov eax, 0x1498
call fcn.004ac5b0
mov eax, dword [0x56f790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x1438], esi
call fcn.0040ed70
mov ecx, eax
call fcn.0040cf00
test eax, eax
je 0x41aa8b
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004b17e0
add esp, 0xc
mov dword [ebp - 0x1440], 1
lea eax, [ebp - 0x1424]
mov dword [ebp - 0x1424], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x1440]
push eax
push str.Played
push str.SOFTWARELDSGameCenter
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x142c]
test eax, eax
je 0x41a83b
push str.noplay
call fcn.004093d0
push str.uninstall
lea ecx, [ebp - 0x1430]
mov dword [ebp - 4], 0
call fcn.004093d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1444], esp
mov dword [eax + 0x24], 0
push 1
push 0
lea eax, [ebp - 0x142c]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1430]
push eax
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00470670
mov byte [ebp - 4], 0
jmp 0x41a898
push str.play
call fcn.004093d0
push str.uninstall
lea ecx, [ebp - 0x1430]
mov dword [ebp - 4], 3
call fcn.004093d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1444], esp
mov dword [eax + 0x24], 0
push 1
push 0
lea eax, [ebp - 0x142c]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x1430]
push eax
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00470670
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1430]
or edi, 0xffffffff
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a8b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x142c]
mov eax, edi
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41a8dc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040ed70
mov ecx, eax
call fcn.0040ce80
test eax, eax
jne 0x41a8f8
call fcn.004177b0
xor eax, eax
jmp 0x41b37b
push 2
call fcn.0042bc50
lea eax, [ebp - 0x1428]
push eax
call fcn.00418110
add esp, 4
mov eax, dword [ebp - 0x1428]
mov dword [ebp - 4], 6
cmp dword [eax - 0xc], 0
jne 0x41a929
lea edx, [eax - 0x10]
jmp 0x41aa6b
call fcn.00472210
mov esi, eax
push 0x52e348
push 0xcb
push 0
mov ecx, dword [esi]
push esi
call dword [ecx + 4]
test eax, eax
je 0x41a972
mov eax, dword [esi]
push str.DLL_360BASE
push 0xcc
push 0
push esi
call dword [eax + 8]
test eax, eax
je 0x41a972
push dword [ebp - 0x1428]
call fcn.0048b530
add esp, 4
test eax, eax
je 0x41aa62
xorps xmm0, xmm0
mov dword [ebp - 0x14a4], 0x44
lea eax, [ebp - 0x14a4]
movlpd qword [ebp - 0x14a0], xmm0
push eax
movlpd qword [ebp - 0x1498], xmm0
movlpd qword [ebp - 0x1490], xmm0
movlpd qword [ebp - 0x1488], xmm0
movlpd qword [ebp - 0x1480], xmm0
movlpd qword [ebp - 0x1478], xmm0
movlpd qword [ebp - 0x1470], xmm0
movlpd qword [ebp - 0x1468], xmm0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [ebp - 0x1478], 1
push 0x1000
mov word [ebp - 0x1474], ax
xorps xmm0, xmm0
lea eax, [ebp - 0x1420]
push 0
push eax
movups xmmword [ebp - 0x145c], xmm0
call fcn.004b17e0
push dword [ebp - 0x1438]
lea eax, [ebp - 0x1420]
push dword [ebp - 0x1428]
push 0x52e7e8
push eax
call fcn.00416710
add esp, 0x1c
lea eax, [ebp - 0x145c]
push eax
lea eax, [ebp - 0x14a4]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1420]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41aa62
push dword [ebp - 0x1458]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x145c]
call esi
mov edx, dword [ebp - 0x1428]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41aa84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x41b37b
push 1
call fcn.0042bc50
call fcn.0040ed70
mov ecx, eax
call fcn.0040cef0
or edi, 0xffffffff
test eax, eax
je 0x41ac8f
push esi
lea ecx, [ebp - 0x1428]
call fcn.004093d0
mov dword [ebp - 4], 7
call fcn.0040ed70
mov ecx, eax
call fcn.0040cee0
cmp dword [eax], 0
jne 0x41aaef
push str.__S__NOSTARTMENU__BANUNINSTREG
lea ecx, [ebp - 0x1428]
call fcn.00416bf0
push dword [ebp - 0x1428]
call fcn.0040ed70
mov ecx, eax
call fcn.0040b660
mov edx, dword [ebp - 0x1428]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ab13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1434]
push eax
call fcn.00417dc0
add esp, 4
mov esi, dword [ebp - 0x1434]
mov dword [ebp - 4], 0x10
cmp dword [esi - 0xc], 0
je 0x41b168
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004b17e0
push 0x104
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00475450
lea eax, [ebp - 0x1428]
push eax
call fcn.00439550
add esp, 0x1c
lea ecx, [ebp - 0x1460]
call fcn.00416740
push dword [ebp - 0x1428]
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0x12
push ecx
push str.installed_ver:__s__new_ver:__s_._n
push eax
call fcn.00416980
add esp, 0x10
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x1424]
push eax
call fcn.004093d0
lea eax, [ebp - 0x1428]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x1424]
push eax
call fcn.00475340
mov edx, dword [ebp - 0x1424]
add esp, 8
test eax, eax
mov byte [ebp - 4], 0x11
mov eax, edi
setns byte [ebp - 0x1439]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41abf1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040ed70
cmp byte [ebp - 0x1439], 0
mov ecx, eax
je 0x41b065
call fcn.0040cc10
test eax, eax
jne 0x41b147
call fcn.0040ed70
mov ecx, eax
call fcn.0040cef0
test eax, eax
je 0x41af66
lea ecx, [ebp - 0x1460]
call fcn.00416740
push dword [ebp - 0x1434]
mov byte [ebp - 4], 0x14
push str.Start_game_center:__s.__n
push eax
call fcn.00416980
add esp, 0xc
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x1424]
push eax
call fcn.0040ed70
mov ecx, eax
call fcn.0040b420
mov byte [ebp - 4], 0x15
push 0xffffffffffffffff
push 0
push 0
push 0
push 1
push dword [ebp - 0x1424]
push dword [ebp - 0x1434]
call fcn.00474060
lea ecx, [ebp - 0x1424]
call fcn.00408250
jmp 0x41b11b
call fcn.0040ed70
mov ecx, eax
call fcn.0040cce0
test eax, eax
je 0x41ab13
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004b17e0
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x142c]
add esp, 0xc
mov dword [ebp - 0x1430], 1
mov dword [ebp - 0x142c], 0x104
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x1430]
push eax
push str.Played
push str.SOFTWARELDSGameCenter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x41ad8f
push str.noplay
lea ecx, [ebp - 0x1424]
call fcn.004093d0
push str.nouninstall
lea ecx, [ebp - 0x1438]
mov dword [ebp - 4], 8
call fcn.004093d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1440], esp
mov dword [eax + 0x24], 0
push 1
push 0
lea eax, [ebp - 0x1424]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x1438]
push eax
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00470670
mov edx, dword [ebp - 0x1438]
or edi, 0xffffffff
mov byte [ebp - 4], 8
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ad84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1424]
jmp 0x41ae18
push str.play
lea ecx, [ebp - 0x1438]
call fcn.004093d0
push str.nouninstall
lea ecx, [ebp - 0x1424]
mov dword [ebp - 4], 0xb
call fcn.004093d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1440], esp
mov dword [eax + 0x24], 0
push 1
push 0
lea eax, [ebp - 0x1438]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x1424]
push eax
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 0xc
call fcn.00470670
mov edx, dword [ebp - 0x1424]
or edi, 0xffffffff
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ae12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1438]
mov eax, edi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41ae36
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x150]
call fcn.004767a0
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 4], 0xe
push 0
push eax
call fcn.004b17e0
add esp, 0xc
mov dword [ebp - 0x1430], 1
lea eax, [ebp - 0x142c]
mov dword [ebp - 0x142c], 0x104
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x1430]
push eax
push str.Setup_Path
push str.SOFTWARELDSGameCenter
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41af54
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x1428]
call fcn.004093d0
mov byte [ebp - 4], 0xf
call fcn.0040ed70
mov ecx, eax
call fcn.0040ce80
test eax, eax
jne 0x41aecd
call fcn.004177b0
jmp 0x41af35
call fcn.0040ed70
mov ecx, eax
call fcn.0040cae0
test eax, eax
je 0x41aeef
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x150]
call fcn.004775c0
call fcn.0040ed70
mov ecx, eax
call fcn.0040ca80
test eax, eax
jne 0x41af11
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x150]
call fcn.0047aa60
call fcn.0040ed70
mov ecx, eax
call fcn.0040cac0
test eax, eax
je 0x41af35
lea eax, [ebp - 0x1428]
push eax
push 0
lea ecx, [ebp - 0x150]
call fcn.00477f50
mov edx, dword [ebp - 0x1428]
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41af54
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x150]
call fcn.00476f90
xor eax, eax
jmp 0x41b37b
call fcn.0040ed70
mov ecx, eax
call fcn.0040cee0
lea ecx, [ebp - 0x1460]
cmp dword [eax], 0
je 0x41af99
call fcn.00416740
push str.silent_mode__not_allowed_to_overwrite_newer_version.__n
push eax
mov byte [ebp - 4], 0x16
call fcn.00416980
add esp, 8
jmp 0x41b11b
call fcn.00416740
push str.not_in_silent_mode.__n
push eax
mov byte [ebp - 4], 0x17
call fcn.00416980
add esp, 8
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x1424]
push eax
call fcn.004093d0
lea eax, [ebp - 0x1428]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x1424]
push eax
call fcn.00475340
add esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1424]
mov esi, eax
call fcn.00408250
test esi, esi
jle 0x41b00b
push 4
push 0x52e9f4
push 0
call fcn.0042bca0
cmp eax, 6
jmp 0x41b119
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x1424]
call fcn.004093d0
lea eax, [ebp - 0x1428]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x1424]
push eax
call fcn.00475340
add esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1424]
mov esi, eax
call fcn.00408250
test esi, esi
jne 0x41b147
push 4
push 0x52ea20
push esi
call fcn.0042bca0
cmp eax, 6
jmp 0x41b119
call fcn.0040cb00
test eax, eax
jne 0x41b147
push dword [ebp - 0x1434]
push str.LDSGameCenter.exe
call fcn.00417bb0
add esp, 8
test al, al
jne 0x41b0a4
push dword [ebp - 0x1434]
push str.pgstation.exe
call fcn.00417bb0
add esp, 8
test al, al
je 0x41b147
call fcn.0040ed70
mov ecx, eax
call fcn.0040cef0
test eax, eax
je 0x41b0f7
lea ecx, [ebp - 0x1460]
call fcn.00416740
push dword [ebp - 0x1434]
mov byte [ebp - 4], 0x1a
push str.Start_old_game_center:__s.__n
push eax
call fcn.00416980
add esp, 0xc
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x1424]
push eax
call fcn.0040ed70
mov ecx, eax
call fcn.0040b420
mov byte [ebp - 4], 0x1b
jmp 0x41ac64
call fcn.0040ed70
mov ecx, eax
call fcn.0040cee0
cmp dword [eax], 0
jne 0x41b11b
push 4
push 0x52eac8
push 0
call fcn.0042bca0
cmp eax, 7
jne 0x41b147
mov edx, dword [ebp - 0x1428]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41b1c8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
jmp 0x41b357
mov edx, dword [ebp - 0x1428]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41b168
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040ed70
mov ecx, eax
call fcn.0040cee0
push dword [eax]
call fcn.0042bc80
call fcn.0040ed70
mov ecx, eax
call fcn.0040cab0
test eax, eax
je 0x41b1cf
mov ecx, 0x573640
call fcn.0042cb00
test eax, eax
jne 0x41b1cf
lea ecx, [ebp - 0x1460]
call fcn.00416740
push str.CheckSingleInstance_failed__exit.__n
push eax
mov byte [ebp - 4], 0x1c
call fcn.00416980
add esp, 8
mov byte [ebp - 4], 0x10
push 0
push 0x52eb40
push 0
call fcn.0042bca0
xor esi, esi
jmp 0x41b357
push str.install
call fcn.0046f0b0
mov ecx, eax
call fcn.004710d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1440], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.start
mov byte [ebp - 4], 0x1d
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 0x10
call fcn.00470530
lea eax, [ebp - 0x144c]
push eax
call fcn.0040ed70
mov ecx, eax
call fcn.0040b140
push dword [ebp - 0x144c]
lea ecx, [ebp - 0x1444]
mov byte [ebp - 4], 0x1e
call fcn.004093d0
push str.setup_pid
lea ecx, [ebp - 0x1448]
mov byte [ebp - 4], 0x1f
call fcn.004093d0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1440], esp
mov dword [eax + 0x24], 0
push 0
push 0
lea eax, [ebp - 0x1444]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x1448]
push eax
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 0x20
call fcn.00470670
mov edx, dword [ebp - 0x1448]
mov eax, edi
mov byte [ebp - 4], 0x1f
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41b2a4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1444]
mov eax, edi
mov byte [ebp - 4], 0x1e
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41b2c5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004184d0
test eax, eax
jne 0x41b2e7
mov ecx, 0x573640
call fcn.0042d150
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
jmp 0x41b336
call fcn.00418920
test eax, eax
jne 0x41b323
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x1440], esp
mov dword [eax + 0x24], 0
push 0
push 0
push str.install_file_fail
mov byte [ebp - 4], 0x22
call fcn.0046f0b0
mov ecx, eax
mov byte [ebp - 4], 0x1e
call fcn.00470530
xor esi, esi
jmp 0x41b336
push dword [ebp + 0x14]
push dword [ebp - 0x1438]
call fcn.0041a2d0
add esp, 8
mov esi, eax
mov edx, dword [ebp - 0x144c]
mov ecx, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x41b357
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1434]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x41b379
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac4b8
mov esp, ebp
pop ebp
ret