Function at 0x403200
Capabilities:
Create process on windows
Get installed programs
Query or enumerate registry value

Disassembly:
sub esp, 0x880
push ebx
push esi
mov esi, dword [esp + 0x88c]
xor ebx, ebx
cmp esi, ebx
je 0x403469
push 0x1ff
lea eax, [esp + 0x18d]
push ebx
push eax
mov byte [esp + 0x194], bl
call fcn.004050a0
push 0xff
lea ecx, [esp + 0x599]
push ebx
push ecx
mov byte [esp + 0x5a0], bl
call fcn.004050a0
push 0xff
lea edx, [esp + 0x7a5]
push ebx
push edx
mov byte [esp + 0x7ac], bl
call fcn.004050a0
push 0xff
lea eax, [esp + 0xb1]
push ebx
push eax
mov byte [esp + 0xb8], bl
call fcn.004050a0
push 0xff
lea ecx, [esp + 0x3bd]
push ebx
push ecx
mov byte [esp + 0x3c4], bl
call fcn.004050a0
push 0xff
lea edx, [esp + 0x6c9]
push ebx
push edx
mov byte [esp + 0x6d0], bl
call fcn.004050a0
add esp, 0x48
push 0xff
lea eax, [esp + 0x48d]
push ebx
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], ebx
mov byte [esp + 0x494], bl
call fcn.004050a0
lea edx, [esp + 0x494]
add esp, 0xc
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x4032f0
lea eax, [esp + 0x488]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x403306
mov ecx, dword [str.index.xml]
mov edx, dword [0x413524]
mov dword [eax], ecx
mov cx, word [0x413528]
mov dword [eax + 4], edx
mov dl, byte [0x41352a]
mov word [eax + 8], cx
mov byte [eax + 0xa], dl
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x490]
push edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
call fcn.00401f20
add esp, 0xc
cmp eax, 1
jne 0x403469
cmp dword [esp + 0x14], ebx
mov dword [esp + 0x28], ebx
jle 0x403457
push ebp
mov ebp, dword [esp + 0x20]
push edi
add ebp, 4
jmp 0x403380
cmp dword [ebp - 4], ebx
mov byte [esp + 0x13], 0
je 0x40343d
mov edx, dword [ebp]
cmp edx, ebx
je 0x40343d
mov edi, str.RestManager
mov esi, edx
mov ecx, 0xc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4033b0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4033cf
mov edi, str.RestServer
mov esi, edx
mov ecx, 0xb
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4033cb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x40343d
cmp dword [ebp + 8], 0
mov bl, 1
mov dword [esp + 0x28], 0
jle 0x40343b
xor esi, esi
mov dword [esp + 0x20], esi
test bl, bl
je 0x40340c
mov eax, dword [ebp + 4]
add eax, esi
cmp dword [eax + 0x10], 0
je 0x40340c
cmp dword [eax + 0x14], 0
je 0x40340c
cmp dword [eax], 0
je 0x40340c
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x40340c
cmp dword [eax + 0xc], 0
jne 0x403472
xor bl, bl
cmp byte [esp + 0x13], 0
je 0x403424
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
add eax, 1
add esi, 0x18
cmp eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], esi
jl 0x4033e5
xor ebx, ebx
mov eax, dword [esp + 0x30]
add eax, 1
add ebp, 0x10
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
jl 0x403380
pop edi
pop ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.004010a0
add esp, 8
pop esi
pop ebx
add esp, 0x880
ret
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [esp + 0x598]
push str._s_s_is1
push ecx
xor bl, bl
call fcn.00405022
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x59c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40340e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x794]
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push 0x4133cc
push eax
mov byte [esp + 0x2b], 1
mov dword [esp + 0x44], 0x100
call edi
test eax, eax
jne 0x403415
lea ecx, [esp + 0x790]
push 0x2e
push ecx
call fcn.00404bc0
add esp, 8
test eax, eax
je 0x403415
mov edx, dword [ebp + 4]
mov ecx, dword [esi + edx + 0x14]
add esi, edx
add eax, 1
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403532
test dl, dl
je 0x40352e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403532
add eax, 2
add ecx, 2
test dl, dl
jne 0x403512
xor eax, eax
jmp 0x403537
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setl bl
test bl, bl
je 0x403415
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 4]
mov edx, dword [esp + 0x894]
push eax
push ecx
push edx
lea eax, [esp + 0x19c]
push str._s__s__s
push eax
call fcn.00405022
lea ecx, [esp + 0x1a4]
push 0
push ecx
call fcn.0041215f
add esp, 0x1c
test eax, eax
sete bl
test bl, bl
je 0x403415
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x94]
push eax
push 0
push 0
push str.UninstallString
push ecx
xor bl, bl
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
jne 0x403415
mov esi, dword [esp + 0x18]
lea ebx, [esi - 2]
push ebx
lea edx, [esp + 0x95]
push edx
lea eax, [esp + 0x98]
push eax
call fcn.00405870
lea ecx, [esp + 0x9c]
push 0
mov byte [esp + esi + 0x9e], 0
push ecx
mov byte [esp + esi + 0xa1], 0
mov dword [esp + 0x2c], ebx
call fcn.0041215f
add esp, 0x14
test eax, eax
sete bl
test bl, bl
je 0x403415
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x394]
push eax
push 0
push 0
push str.InstallLocation
mov esi, 0x100
push ecx
xor bl, bl
mov dword [esp + 0x50], esi
call edi
test eax, eax
jne 0x403415
push eax
lea edx, [esp + 0x394]
push edx
call fcn.0041215f
add esp, 8
test eax, eax
sete bl
test bl, bl
je 0x403415
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x694]
push ecx
push 0
push 0
push str.DisplayName
push edx
mov dword [esp + 0x4c], esi
call edi
push 0x40
lea eax, [esp + 0x54]
push 0
push eax
mov dword [esp + 0x58], 0x44
call fcn.004050a0
push 0xc8
call fcn.004057a4
lea ecx, [esp + 0x6a0]
push ecx
mov esi, eax
push 0x4134fc
push esi
call fcn.00405022
mov edx, dword [0x4183c4]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
add esp, 0x1c
push 0
push esi
push 0x401
push edx
call edi
lea eax, [esp + 0x90]
push eax
lea ecx, [esp + 0x194]
push str.__s_
push ecx
call fcn.00405022
lea edx, [esp + eax + 0x19c]
push str.__SUPPRESSMSGBOXES__VERYSILENT
push edx
call fcn.00405022
add esp, 0x14
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x50]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea edx, [esp + 0x1b0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x3c]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call fcn.004057a4
mov edx, dword [ebp + 4]
mov esi, eax
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + edx]
push ecx
push 0x4134c8
push esi
call fcn.00405022
mov edx, dword [0x4183c4]
add esp, 0x10
push 0
push esi
push 0x401
push edx
call edi
mov eax, dword [esp + 0x894]
push eax
lea ecx, [esp + 0x194]
push 0x4134c4
push ecx
call fcn.00405022
mov edx, dword [ebp - 4]
push edx
mov esi, eax
lea eax, [esp + esi + 0x1a0]
push 0x4134c0
push eax
call fcn.00405022
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x38]
add esi, eax
mov eax, dword [edx + ecx + 4]
push eax
lea ecx, [esp + esi + 0x1ac]
push 0x4134b8
push ecx
call fcn.00405022
add esi, eax
lea edx, [esp + esi + 0x1b4]
push str.__SUPPRESSMSGBOXES
push edx
call fcn.00405022
add esi, eax
lea eax, [esp + esi + 0x1bc]
push str.__VERYSILENT
push eax
call fcn.00405022
add esi, eax
lea ecx, [esp + esi + 0x1c4]
push str.__PASSWORD7060
push ecx
call fcn.00405022
lea edx, [esp + 0x3cc]
push edx
add esi, eax
lea eax, [esp + esi + 0x1d0]
push str.___DIR_s_
push eax
call fcn.00405022
add esp, 0x48
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x50]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea eax, [esp + 0x1b0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x3c]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403415