Function at 0x408bd5
Capabilities:
Create process on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00409c55
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
lea eax, [ebp - 0x5b8]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x408e2b
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov esi, 0x420b90
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0x12c
push eax
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x408d90
cmp eax, ebx
jne 0x408e08
push 4
push str.ST6UNST_
lea eax, [ebp - 0x1a8]
push 4
push eax
push ebx
push 0x800
call edi
cmp eax, 2
jne 0x408d77
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x7c0]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x7c0]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408d6e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x9c8]
push eax
push ebx
push ebx
push str.AppToUninstall
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408d65
lea eax, [ebp - 0x9c8]
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push esi
push 1
push 0x800
call edi
cmp eax, 2
jne 0x408d65
cmp dword [ebp - 0x14], ebx
jne 0x408d7f
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x3b0]
push eax
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x208
mov byte [ebp - 0x3b0], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408e08
cmp byte [ebp - 0x3b0], bl
je 0x408e08
lea eax, [ebp - 0x3b0]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
jne 0x408e08
inc dword [ebp - 8]
jmp 0x408c2e
push esi
push 0x41c058
push dword [0x424cac]
jmp 0x408e14
cmp dword [ebp - 4], ebx
je 0x408e08
push 0x41c7f8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
lea eax, [ebp - 0x7c]
pop esi
push esi
push ebx
push eax
call fcn.00411ef0
add esp, 0xc
mov dword [ebp - 0x7c], esi
lea eax, [ebp - 0x38]
push 1
pop esi
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov word [ebp - 0x4c], si
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x408de6
push dword [0x424188]
push esi
push 0x30
push esi
jmp 0x408e23
push dword [0x42365c]
push 0x41c25c
push esi
push ebx
push 2
call fcn.0040523a
add esp, 0x14
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408e2b
push esi
push 0x41c058
push dword [0x4243d8]
call fcn.00403c25
add esp, 0xc
push eax
push 1
push 0x30
push 1
call fcn.0040523a
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret