Function at 0x408d30
Capabilities:
Create process on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00409da8
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
lea eax, [ebp - 0x5b8]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x408f86
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov esi, 0x420c60
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0x12c
push eax
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x408eeb
cmp eax, ebx
jne 0x408f63
push 4
push str.ST6UNST_
lea eax, [ebp - 0x1a8]
push 4
push eax
push ebx
push 0x800
call edi
cmp eax, 2
jne 0x408ed2
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x7c0]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x7c0]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408ec9
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x9c8]
push eax
push ebx
push ebx
push str.AppToUninstall
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408ec0
lea eax, [ebp - 0x9c8]
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push esi
push 1
push 0x800
call edi
cmp eax, 2
jne 0x408ec0
cmp dword [ebp - 0x14], ebx
jne 0x408eda
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x3b0]
push eax
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x208
mov byte [ebp - 0x3b0], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408f63
cmp byte [ebp - 0x3b0], bl
je 0x408f63
lea eax, [ebp - 0x3b0]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
jne 0x408f63
inc dword [ebp - 8]
jmp 0x408d89
push esi
push 0x41c06c
push dword [0x424d74]
jmp 0x408f6f
cmp dword [ebp - 4], ebx
je 0x408f63
push 0x41c8c8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
lea eax, [ebp - 0x7c]
pop esi
push esi
push ebx
push eax
call fcn.00412010
add esp, 0xc
mov dword [ebp - 0x7c], esi
lea eax, [ebp - 0x38]
push 1
pop esi
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov word [ebp - 0x4c], si
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x408f41
push dword [0x424680]
push esi
push 0x30
push esi
jmp 0x408f7e
push dword [0x423734]
push 0x41c30c
push esi
push ebx
push 2
call fcn.00405105
add esp, 0x14
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408f86
push esi
push 0x41c06c
push dword [0x4246b0]
call fcn.00403adc
add esp, 0xc
push eax
push 1
push 0x30
push 1
call fcn.00405105
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret