Function at 0x4056a0
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac4
mov eax, dword [0x5a8040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xa84]
push esi
push edi
push eax
push 0x20019
push 0
push str.SOFTWAREHNCSharedInstall_InformationHOffice130
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [ebp - 0xa84], 0
call ebx
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
test esi, esi
jne 0x4059d3
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push esi
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
mov word [ebp - 0x620], ax
push 0x206
push eax
lea eax, [ebp - 0x61e]
push eax
call fcn.0052c790
mov ecx, dword [edi + 0xd7c]
mov eax, 0x2aaaaaab
sub ecx, dword [edi + 0xd78]
add esp, 0xc
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x405924
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [edi + 0x118]
push esi
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00408e80
lea eax, [ebp - 0x210]
push str.TARGET
push eax
call fcn.0052b195
lea ecx, [ebp - 0x210]
add esp, 8
cmp ecx, eax
jne 0x40586f
xor eax, eax
mov dword [ebp - 0xa88], 1
push 0x206
push eax
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push eax
call fcn.0052c790
add esp, 0xc
mov dword [ebp - 0xa7c], 0x104
lea eax, [ebp - 0xa80]
push eax
push str.SOFTWAREHNCSharedInstall_InformationHOffice130
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0xa88]
push eax
push 0
push str.Path
push dword [ebp - 0xa80]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
lea eax, [ebp - 0x202]
push eax
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x210]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4058f2
push 0x3c
lea eax, [ebp - 0xac4]
push 0
push eax
call fcn.0052c790
lea eax, [ebp - 0x210]
mov dword [ebp - 0xac4], 0x3c
mov dword [ebp - 0xab4], eax
add esp, 0xc
lea eax, [ebp - 0x620]
mov dword [ebp - 0xab8], str.open
mov dword [ebp - 0xab0], eax
lea eax, [ebp - 0xac4]
mov dword [ebp - 0xaa8], 5
push eax
mov dword [ebp - 0xac0], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [ebp - 0xa8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0xd7c]
mov eax, 0x2aaaaaab
sub ecx, dword [edi + 0xd78]
inc esi
imul ecx
lea ecx, [edi + 0x118]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jl 0x405777
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [edi + 0xd90], 0
jl 0x40597f
lea eax, [ebp - 0xa7c]
mov dword [ebp - 0xa7c], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREHNCSharedHncUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x40597f
mov eax, dword [edi + 0xd90]
push 4
mov dword [ebp - 0xa80], eax
lea eax, [ebp - 0xa80]
push eax
push 4
push 0
push str.Auto
push dword [ebp - 0xa7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [edi + 0x1be8]
push eax
lea eax, [ebp - 0x828]
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
call fcn.00408f40
lea ecx, [edi + 0x200e]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4059b0
sub ecx, edx
sar ecx, 1
je 0x4059cc
lea ecx, [edi + 0x118]
call fcn.004080e0
call fcn.004082b0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00529d59
mov esp, ebp
pop ebp
ret