Function at 0x401080
Capabilities:
Create process on windows
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x680
mov eax, dword [0x419004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x208
xor esi, esi
mov dword [ebp - 0x670], 0
lea eax, [ebp - 0x40c]
push esi
push eax
call fcn.00402170
add esp, 0xc
mov dword [ebp - 0x618], pe_nt_image_headers32
lea eax, [ebp - 0x670]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40130c
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x40c]
push eax
push esi
push dword [ebp - 0x670]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40130c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
push 0x208
lea eax, [ebp - 0x614]
mov dword [ebp - 0x66c], 0
push 0
push eax
call fcn.00402170
lea eax, [ebp - 0x40c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push str._s_s
lea eax, [ebp - 0x614]
push 0x208
push eax
call fcn.00401010
add esp, 0x20
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x614]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4012d5
push 0x200
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00402170
add esp, 0xc
mov dword [ebp - 0x61c], 1
lea eax, [ebp - 0x620]
mov dword [ebp - 0x620], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0
push str.BundleUpgradeCode
push dword [ebp - 0x66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4012cd
mov ecx, str.1278D19E_DF3C_41FA_B19C_2F0139AB3702
lea eax, [ebp - 0x204]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40120d
test dx, dx
je 0x401209
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40120d
add eax, 4
add ecx, 4
test dx, dx
jne 0x4011e7
xor eax, eax
jmp 0x401212
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4012cd
lea eax, [ebp - 0x624]
mov dword [ebp - 0x624], 0x200
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x61c]
push eax
push 0
push str.QuietUninstallString
push dword [ebp - 0x66c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4012cd
push 0x40
push eax
lea eax, [ebp - 0x664]
mov dword [ebp - 0x668], 0x44
push eax
call fcn.00402170
add esp, 0xc
mov dword [ebp - 0x63c], 1
xor eax, eax
mov word [ebp - 0x638], ax
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x668]
push eax
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4012cd
push 0xea60
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x67c]
call edi
push dword [ebp - 0x680]
call edi
push dword [ebp - 0x66c]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x618]
mov dword [ebp - 0x618], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x40c]
inc esi
push eax
push esi
push dword [ebp - 0x670]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x401120
pop edi
mov eax, dword [ebp - 0x670]
test eax, eax
je 0x401319
push eax
call ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0040132b
mov esp, ebp
pop ebp
ret