Function at 0x412a70
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x586972
mov eax, dword fs:[0]
push eax
sub esp, 0xc94
mov eax, dword [0x5eb770]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
push str.Tool_VDCModuleUninstallExec
push esi
lea ecx, [ebp - 0xc2c]
call fcn.0044ca70
add esp, 0xc
push 0x208
lea eax, [ebp - 0x420]
push esi
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0xc34], esi
call fcn.0055ca80
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x218]
push esi
push ecx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc40], esi
call fcn.0055ca80
add esp, 0xc
push 0x800
lea edx, [ebp - 0xc20]
push esi
push edx
call fcn.0055ca80
add esp, 0xc
push 0x44
lea eax, [ebp - 0xca0]
push esi
push eax
call fcn.0055ca80
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
call fcn.00412f50
lea ecx, [ebp - 0xc34]
push ecx
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVDC
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x412b87
push str._t_t_tRegOpenKeyEx
lea edx, [ebp - 0xc2c]
push edx
call fcn.0044ce30
push 0x5b69a4
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0044cd10
add esp, 0xc
jmp 0x412f22
lea ecx, [ebp - 0xc44]
push ecx
mov ecx, dword [ebp - 0xc34]
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0xc40]
push eax
push esi
push str.UninstallString
push ecx
mov dword [ebp - 0xc44], 0x208
mov dword [ebp - 0xc40], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0xc34]
push edx
cmp eax, esi
je 0x412c00
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._t_t_tRegQueryValueEx
lea eax, [ebp - 0xc2c]
push eax
call fcn.0044ce30
push 0x5b69a4
lea ecx, [ebp - 0xc2c]
push 2
push ecx
call fcn.0044cd10
add esp, 0xc
jmp 0x412f22
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00461e32
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x412c20
push 0x80004005
call fcn.004025a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 1
call fcn.00461e32
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x412c50
push 0x80004005
call fcn.004025a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc3c], eax
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0xc24]
mov byte [ebp - 4], 2
call fcn.00403340
mov bl, 3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xc24]
cmp dword [ecx - 0xc], esi
jge 0x412c8d
or esi, 0xffffffff
jmp 0x412cae
push 0x5b8cf8
push ecx
call fcn.00556fbe
add esp, 8
cmp eax, esi
jne 0x412ca4
or esi, 0xffffffff
jmp 0x412cae
sub eax, dword [ebp - 0xc24]
sar eax, 1
mov esi, eax
push esi
lea edx, [ebp - 0xc30]
push edx
lea ecx, [ebp - 0xc24]
call fcn.0040a240
push eax
lea ecx, [ebp - 0xc38]
mov byte [ebp - 4], 4
call fcn.00404890
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412cf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0xc38]
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.005579b2
mov edx, dword [ebp - 0xc24]
mov eax, dword [edx - 0xc]
add esp, 0xc
sub eax, esi
push eax
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ebp - 0xc24]
call fcn.0040a1c0
push eax
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 5
call fcn.00404890
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412d64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0xc3c]
push ebx
lea ecx, [ebp - 0xc20]
push 0x400
push ecx
call fcn.005579b2
add esp, 0xc
push 0x44
lea edx, [ebp - 0xca0]
push 0
push edx
call fcn.0055ca80
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0xc54]
push ecx
lea edx, [ebp - 0xca0]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
mov word [ebp - 0xc70], ax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0xca0], 0x44
mov dword [ebp - 0xc74], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x412e6c
push str._t_t_tCreateProcess
lea edx, [ebp - 0xc2c]
push edx
call fcn.0044ce30
push 0x5b69a4
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0044cd10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412e40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412e60
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea eax, [edi - 0x10]
jmp 0x412f09
mov ecx, dword [ebp - 0xc50]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc54]
push ecx
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x412e9d
lea edx, [ebp - 0xc30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call edi
push 0x5b69a4
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0044cd10
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412edc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412efc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc38]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x412f22
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0044cc70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055649d
mov esp, ebp
pop ebp
ret