Function at 0x401110
Capabilities:
Create process on windows
Query or enumerate registry key

Disassembly:
sub esp, 0x588
mov eax, dword [0x417004]
xor eax, esp
mov dword [esp + 0x584], eax
mov eax, dword [esp + 0x594]
lea edx, [esp + 8]
mov ecx, dword [esp + 0x58c]
push ebx
push ebp
push esi
push edi
push edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], ecx
push edx
push eax
push ecx
call section..text
mov edi, dword [esp + 0x24]
add esp, 0x10
cmp edi, 3
je 0x4011b1
cmp edi, 1
jne 0x4013e4
push 0x2a
push edi
call fcn.00402a04
movups xmm0, xmmword [str.SoftwareCaliper_CorporationTransModeler]
mov ebp, eax
push 4
push edi
mov dword [esp + 0x24], ebp
movups xmmword [ebp], xmm0
movups xmm0, xmmword [0x410170]
movups xmmword [ebp + 0x10], xmm0
movq xmm0, qword [0x410180]
movq qword [ebp + 0x20], xmm0
mov cx, word [0x410188]
mov word [ebp + 0x28], cx
call fcn.00402a04
mov ebx, eax
add esp, 0x10
mov dword [ebx], 0x302e33
jmp 0x401220
mov ebx, dword [esp + 0x18]
mov esi, dword [ebx + 4]
mov ecx, esi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011c0
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 1
call fcn.00402a04
mov ebp, eax
add esp, 8
mov ecx, ebp
mov dword [esp + 0x14], ebp
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4011e1
mov esi, dword [ebx + 8]
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4011f6
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 1
call fcn.00402a04
mov ebx, eax
add esp, 8
mov ecx, ebx
sub ecx, esi
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x401213
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea eax, [esp + 0x10]
push eax
push 8
push 0
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401308
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea eax, [esp + 0x18c]
push 0x104
push eax
xor esi, esi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
jne 0x4012fa
nop dword [eax]
mov ecx, ebx
lea eax, [esp + 0x18c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4012a0
test dl, dl
je 0x40129c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4012a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x401280
xor eax, eax
jmp 0x4012a5
sbb eax, eax
or eax, 1
test eax, eax
je 0x401401
lea eax, [esp + 0x18c]
push eax
call fcn.00405e75
fstp qword [esp + 0x28]
push ebx
call fcn.00405e75
movsd xmm0, qword [esp + 0x2c]
add esp, 8
fstp qword [esp + 0x2c]
comisd xmm0, xmmword [esp + 0x2c]
ja 0x401401
push 0x104
lea eax, [esp + 0x190]
inc esi
push eax
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x401270
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x14]
push 0x104
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x394]
push eax
lea eax, [esp + 0x498]
push eax
lea eax, [esp + 0x29c]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x98]
push eax
call fcn.004062c4
push 0x41018c
push str.setup
lea eax, [esp + 0x2b0]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0xac]
push eax
call fcn.0040605b
add esp, 0x28
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test ebp, ebp
je 0x4013a3
push ebp
call fcn.00402a0f
add esp, 4
test ebx, ebx
je 0x4013b0
push ebx
call fcn.00402a0f
add esp, 4
test edi, edi
je 0x4013d3
mov esi, dword [esp + 0x18]
test esi, esi
je 0x4013cb
mov eax, dword [esi]
test eax, eax
je 0x4013cb
push eax
call fcn.00402a0f
add esp, 4
add esi, 4
sub edi, 1
jne 0x4013b8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4013e4
push eax
call fcn.00402a0f
add esp, 4
mov ecx, dword [esp + 0x594]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040140d
add esp, 0x588
ret 0x10
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4013e4