Function at 0x40d790
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bd52
mov eax, dword fs:[0]
push eax
sub esp, 0xc94
mov eax, dword [0x5b4450]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
lea eax, [ebp - 0xc2c]
push str.Tool_VDCModuleUninstallExec
push eax
call fcn.0040ac70
add esp, 0xc
mov dword [ebp - 4], 0
call fcn.0040bea0
call fcn.0040dc00
lea ecx, [ebp - 0xc38]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVDC
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d833
push str._t_t_tRegOpenKeyEx
lea edx, [ebp - 0xc2c]
push edx
call fcn.0040b040
push 0x58a8c8
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0040aed0
add esp, 0xc
jmp 0x40dbd1
lea ecx, [ebp - 0xc44]
push ecx
mov ecx, dword [ebp - 0xc38]
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0xc40]
push eax
push 0
push str.UninstallString
push ecx
mov dword [ebp - 0xc44], 0x208
mov dword [ebp - 0xc40], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0xc38]
push edx
test eax, eax
je 0x40d8ad
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._t_t_tRegQueryValueEx
lea eax, [ebp - 0xc2c]
push eax
call fcn.0040b040
push 0x58a8c8
lea ecx, [ebp - 0xc2c]
push 2
push ecx
call fcn.0040aed0
add esp, 0xc
jmp 0x40dbd1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d8cd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc34], eax
mov byte [ebp - 4], 1
call fcn.0044033f
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40d8fd
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc3c], eax
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0xc24]
mov byte [ebp - 4], 2
call fcn.00401210
mov bl, 3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xc24]
mov eax, dword [ecx - 0xc]
test eax, eax
jns 0x40d93c
or esi, 0xffffffff
jmp 0x40d95d
push 0x58c1a8
push ecx
call fcn.00535a9a
add esp, 8
test eax, eax
jne 0x40d953
or esi, 0xffffffff
jmp 0x40d95d
sub eax, dword [ebp - 0xc24]
sar eax, 1
mov esi, eax
push esi
lea edx, [ebp - 0xc30]
push edx
lea ecx, [ebp - 0xc24]
call fcn.00413a00
push eax
lea ecx, [ebp - 0xc34]
mov byte [ebp - 4], 4
call fcn.00401520
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0xc34]
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.00535afa
mov edx, dword [ebp - 0xc24]
mov eax, dword [edx - 0xc]
add esp, 0xc
sub eax, esi
push eax
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ebp - 0xc24]
call fcn.00413980
push eax
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 5
call fcn.00401520
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da13
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0xc3c]
push ebx
lea ecx, [ebp - 0xc20]
push 0x400
push ecx
call fcn.00535afa
add esp, 0xc
push 0x44
lea edx, [ebp - 0xca0]
push 0
push edx
call fcn.005373f0
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0xc54]
push ecx
lea edx, [ebp - 0xca0]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
mov word [ebp - 0xc70], ax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0xca0], 0x44
mov dword [ebp - 0xc74], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40db1b
push str._t_t_tCreateProcess
lea edx, [ebp - 0xc2c]
push edx
call fcn.0040b040
push 0x58a8c8
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0040aed0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40daef
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db0f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea eax, [edi - 0x10]
jmp 0x40dbb8
mov ecx, dword [ebp - 0xc50]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc54]
push ecx
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x40db4c
lea edx, [ebp - 0xc30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call edi
push 0x58a8c8
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.0040aed0
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40db8b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dbab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc34]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40dbd1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 4], 0xffffffff
call fcn.0040ae50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005337cb
mov esp, ebp
pop ebp
ret