Function at 0x405530
Capabilities:
Create process on windows
Get common file path
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaa4
mov eax, dword [0x5ad040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, ecx
push edi
push 0
push str.taskkill__F__T__IM_HncUpdateService.exe
mov dword [ebp - 0xa40], ebx
call esi
push 0
push str.taskkill__F__T__IM_HncUpdateTray.exe
call esi
push 0
push str.taskkill__F__T__IM_SmartInput.exe
call esi
push 0
push str.taskkill__F__T__IM_CloudClipboard.exe
call esi
push 0
push str.taskkill__F__T__IM_CefSharp.BrowserSubprocess.exe
call esi
push 0
push str.taskkill__F__T__IM_HNetCom.Agent.exe
call esi
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push eax
call fcn.00530d50
add esp, 0xc
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.msiexec.exe
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.0052f62b
mov eax, dword [0x58d59c]
mov esi, dword [ebx + 0xae4]
mov dword [ebp - 0x210], eax
mov eax, dword [0x58d5a0]
push 0x200
mov dword [ebp - 0x20c], eax
lea eax, [ebp - 0x208]
push 0
push eax
call fcn.00530d50
add esp, 0x18
lea eax, [ebp - 0xa38]
lea ecx, [ebx + 0xa8]
push eax
call fcn.004081f0
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0052f62b
mov ecx, str.__qb
test esi, esi
mov eax, str.__qn
cmovne eax, ecx
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0052f62b
push str.__norestart
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0052f62b
push 0x3c
push 0
lea eax, [ebp - 0xa84]
push eax
call fcn.00530d50
lea eax, [ebp - 0x628]
mov dword [ebp - 0xa84], 0x3c
mov dword [ebp - 0xa74], eax
add esp, 0x30
lea eax, [ebp - 0x210]
mov dword [ebp - 0xa78], str.open
mov dword [ebp - 0xa70], eax
lea eax, [ebp - 0xa84]
mov dword [ebp - 0xa68], 5
push eax
mov dword [ebp - 0xa80], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push dword [ebp - 0xa4c]
call esi
test eax, eax
je 0x40573c
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push 1
push 0
push 0
push 0
lea eax, [ebp - 0xaa0]
push eax
call edi
test eax, eax
je 0x405711
lea eax, [ebp - 0xaa0]
push eax
call ebx
lea eax, [ebp - 0xaa0]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push dword [ebp - 0xa4c]
call esi
cmp eax, 0xffffffff
je 0x405736
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [ebp - 0xa4c]
call esi
test eax, eax
jne 0x4056e6
mov ebx, dword [ebp - 0xa40]
xor eax, eax
mov dword [ebp - 0xa3c], 0
push 0x206
push eax
mov word [ebp - 0x830], ax
lea eax, [ebp - 0x82e]
push eax
mov dword [ebp - 0xa44], 1
call fcn.00530d50
xor eax, eax
mov dword [ebp - 0xa48], 0x104
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.00530d50
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0052f5cf
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0052f62b
add esp, 0x30
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40581e
lea eax, [ebp - 0xa48]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xa44]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40581e
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052e288
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov byte [ebx + 0x21a9], 1
xor ecx, ebp
pop ebx
call fcn.0052e288
mov esp, ebp
pop ebp
ret