Function at 0x408000
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
jmp 0x408000
sub esp, 0x6b8
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x6b4], eax
push esi
mov esi, dword [esp + 0x6c0]
test esi, esi
jne 0x408038
xor eax, eax
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
cmp dword [esp + 0x6c4], 0
je 0x408020
cmp dword [esp + 0x6c8], 0
je 0x408020
push edi
push 0x208
lea eax, [esp + 0x6c]
push 0
push eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0x226
mov dword [esp + 0x2c], 1
call fcn.0041be10
push 0x44c
lea ecx, [esp + 0x280]
push 0
push ecx
call fcn.0041be10
xor eax, eax
push 0x44
push eax
lea edx, [esp + 0x44]
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
call fcn.0041be10
add esp, 0x24
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [esp + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea ecx, [esp + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 8]
push edx
push 0x20019
push 0
lea eax, [esp + 0x74]
push eax
push 0x80000002
call edi
test eax, eax
je 0x408113
cmp dword [0x44fe24], 5
jl 0x408113
lea ecx, [esp + 8]
push ecx
push 0x20119
push 0
lea edx, [esp + 0x74]
push edx
push 0x80000002
call edi
test eax, eax
jne case.0x408190.0
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x274]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.UninstallString
push eax
mov dword [esp + 0x24], 0x44c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40816a
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x47964c], 1
jne case.default.0x408190
push esi
call fcn.0040104b
add esp, 4
cmp eax, 3
ja case.default.0x408190
jmp dword [eax*4 + 0x408278]
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x6b4]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x6b8
ret
lea edx, [esp + 0x270]
push edx
push esi
call fcn.0040101e
add esp, 8
test eax, eax
je case.default.0x408190
cmp word [0x479248], 0
je case.default.0x408190
push 0x435c6c
lea eax, [esp + 0x274]
push 0x226
push eax
call fcn.0041c1b5
push 0x479248
lea ecx, [esp + 0x280]
push 0x226
push ecx
call fcn.0041c1b5
add esp, 0x18
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [esp + 0x290]
push ecx
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x10]
push ecx
call edi
push esi
call fcn.004010c8
mov ecx, dword [esp + 0x6c0]
add esp, 4
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x6b8
ret