Function at 0x4166cd
Capabilities:
Accept command line arguments
Check if file exists
Create process on windows
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2518
call fcn.0049b9f0
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x24ac], 0
and dword [ebp - 0x24a8], 0
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x24bc]
push eax
lea eax, [ebp - 0x24a8]
push eax
lea eax, [ebp - 0x24b8]
push eax
push str.hasupdate
mov ebx, str.SoftwareJHotNews
push ebx
mov esi, 0x80000001
push esi
mov dword [ebp - 0x24b8], 1
mov dword [ebp - 0x24bc], 4
call edi
test eax, eax
jne 0x416a0f
cmp dword [ebp - 0x24a8], eax
je 0x416a0f
cmp dword [ebp + 8], eax
je 0x41675d
push str.hasupdate
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x8c], ax
lea eax, [ebp - 0x8a]
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x24b4]
push eax
lea eax, [ebp - 0x8c]
push eax
lea eax, [ebp - 0x24b0]
push eax
push str.chkupdate
push ebx
push esi
mov dword [ebp - 0x24b0], 1
mov dword [ebp - 0x24b4], 0x7e
call edi
test eax, eax
jne 0x416a0f
xor edi, edi
cmp word [ebp - 0x8c], di
je 0x416a0f
cmp dword [ebp + 8], edi
je 0x4167d3
push str.chkupdate
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
xor eax, eax
push 0x206
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
push str.Installer
push 0x4fa568
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.Update.exe
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x416a0f
xor eax, eax
push 0x7e
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x10a]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
lea edx, [ebp - 0x10c]
lea ecx, [ebp - 0x414]
call fcn.00417a52
lea eax, [ebp - 0x10c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x416864
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 0x4ddb14
call fcn.0048e160
xor eax, eax
push 0x7e
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push edi
push eax
call fcn.0048e0e0
push 0x3f
push 0xf0
lea ebx, [ebp - 0x20c]
mov ecx, 0x4ddaf0
call fcn.00417983
mov eax, ebx
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.0048912b
add esp, 0x28
test eax, eax
jne 0x416a0f
push 0x7e
mov word [ebp - 0x18c], ax
lea eax, [ebp - 0x18a]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
push 0x3f
pop ebx
lea esi, [ebp - 0x18c]
lea edi, [ebp - 0x414]
call fcn.0041dd5a
test eax, eax
je 0x416a0f
xor eax, eax
cmp ax, word [0x502e50]
jne 0x416916
call fcn.004018d6
jmp 0x41691b
mov eax, 0x502e50
lea ecx, [ebp - 0x18c]
push ecx
push eax
call fcn.0041de17
pop ecx
pop ecx
test eax, eax
jge 0x416a0f
xor eax, eax
push 0x208e
mov word [ebp - 0x24a4], ax
xor esi, esi
lea eax, [ebp - 0x24a2]
push esi
push eax
call fcn.0048e0e0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
xor eax, eax
cmp dword [ebp + 8], esi
push str._upparm:
sete al
push eax
push str._upquit:
push 0x4fa360
push str._uppath:
lea eax, [ebp - 0x414]
push eax
push str.__s___s__s___s_d__s_s
lea eax, [ebp - 0x24a4]
push 0x1047
push eax
call fcn.00488ec0
push 0x40
lea eax, [ebp - 0x2510]
push esi
push eax
call fcn.0048e0e0
xor eax, eax
mov dword [ebp - 0x24cc], esi
lea edi, [ebp - 0x24c8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x34
stosd dword es:[edi], eax
lea eax, [ebp - 0x24cc]
push eax
lea eax, [ebp - 0x2514]
push eax
push esi
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
push esi
lea eax, [ebp - 0x24a4]
push eax
push esi
mov dword [ebp - 0x2514], 0x44
mov dword [ebp - 0x24e8], 0x80
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x416a0f
push dword [ebp - 0x24c8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x24cc]
call esi
mov dword [ebp - 0x24ac], edi
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24ac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00488e60
leave
ret 4