Function at 0x412120
Capabilities:
Create process on windows
Delete registry key

Disassembly:
jmp 0x412120
sub esp, 0xd2c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xd28], eax
push esi
mov esi, dword [esp + 0xd34]
test esi, esi
jne 0x412158
xor eax, eax
pop esi
mov ecx, dword [esp + 0xd28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xd2c
ret
push 0x4b0
lea eax, [esp + 0x880]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
push 0x200
lea ecx, [esp + 0x68c]
push 0
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x80]
push 0
push edx
call fcn.0041be10
xor eax, eax
push 0x44
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
lea eax, [esp + 0x4c]
push eax
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x2a0]
push 0
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x4b4]
push 0
push edx
call fcn.0041be10
add esp, 0x48
call fcn.0040128a
test eax, eax
jne 0x41220a
mov eax, 5
pop esi
mov ecx, dword [esp + 0xd28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xd2c
ret
lea eax, [esp + 0x474]
push edi
push eax
call fcn.0040124e
add esp, 4
test eax, eax
je 0x41241f
lea ecx, [esp + 0x680]
push ecx
call fcn.00401244
add esp, 4
test eax, eax
je 0x41241f
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x684]
push eax
push str._Lang_
push esi
call fcn.00401203
add esp, 0x10
test eax, eax
je 0x41241f
mov eax, 0x44f818
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x412266
sub eax, edx
sar eax, 1
lea ecx, [eax*2 + 0x44f816]
push ecx
push 0x44f818
call fcn.00401113
lea edx, [esp + 0x70]
mov esi, eax
push edx
mov eax, edx
push eax
call fcn.00401113
mov edi, eax
mov ecx, edi
add esp, 0x10
or ecx, esi
je 0x4122c5
push 0x435874
lea edx, [esp + 0x274]
push 0x104
push edx
call fcn.0041c22f
add esp, 0xc
cmp esi, edi
jne 0x4122df
lea eax, [esp + 0x6a]
jmp 0x4122e3
push str._s_s__s___s___NOEULA
lea eax, [esp + 0x274]
push 0x104
push eax
call fcn.0041c22f
add esp, 0xc
lea eax, [esp + 0x68]
lea ecx, [esp + 0x478]
push ecx
push str.SOFTWARECanonIJAppInstaller
push eax
push 0x44f818
lea edx, [esp + 0x280]
push edx
lea eax, [esp + 0x894]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [esp + 0x8a0]
push eax
push 0
mov dword [esp + 0x4c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x41241f
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x14]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
push eax
call esi
mov edi, 1
push edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push str.APPLICATION_COMPLETED
push str.SOFTWARECanonIJAppInstaller
mov esi, 4
push 0x80000002
mov dword [esp + 0x28], esi
call fcn.00401028
add esp, 0x1c
test eax, eax
je 0x4123a5
cmp dword [esp + 8], edi
je 0x4123be
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xd28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xd2c
ret
push edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push str.REBOOT
push str.SOFTWARECanonIJAppInstaller
push 0x80000002
mov dword [esp + 0x28], esi
call fcn.00401028
add esp, 0x1c
test eax, eax
je 0x41241f
cmp dword [esp + 8], edi
jne 0x41241f
push str.SOFTWARECanonIJAppInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop edi
mov eax, 6
pop esi
mov ecx, dword [esp + 0xd28]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xd2c
ret
push str.SOFTWARECanonIJAppInstaller
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0xd30]
pop edi
pop esi
xor ecx, esp
mov eax, 5
call fcn.0041bdf4
add esp, 0xd2c
ret