Function at 0x403860
Capabilities:
Connect to http server
Create http request
Create process on windows
Get common file path
Get installed programs
Query or enumerate registry value

Disassembly:
sub esp, 0x98c
push ebp
mov ebp, dword [esp + 0x994]
test ebp, ebp
je 0x403ff7
push ebx
mov ebx, dword [esp + 0x99c]
test ebx, ebx
jle 0x403ff6
push edi
mov edi, dword [esp + 0x9a4]
test edi, edi
je 0x403ff5
push esi
mov esi, dword [esp + 0x9ac]
test esi, esi
je 0x403ff4
push 0
push 0
push 0
push 1
push 0
call dword [sym.imp.WININET.dll_InternetOpenW]
push 0
push 0
push 1
push esi
push edi
push ebx
push ebp
push eax
mov dword [esp + 0x60], eax
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edi, eax
push 0x103
lea eax, [esp + 0x9d]
push 0
push eax
mov dword [esp + 0x34], edi
mov byte [esp + 0xa4], 0
call fcn.004050a0
add esp, 0xc
lea ecx, [esp + 0x98]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [esp + 0x98]
push edx
push 0
push 0x413464
mov eax, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
lea ecx, [esp + 0xa8]
push ecx
push 0x413458
xor ebp, ebp
push edi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x38], ebx
call dword [sym.imp.WININET.dll_FtpGetFileA]
cmp eax, 1
jne 0x403967
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0xa0]
push ecx
call fcn.00401f20
mov ebp, dword [esp + 0x30]
add esp, 0xc
push ebx
push 0x4000000
push 3
push ebx
push 1
push ebx
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp ebp, ebx
je 0x403fe4
cmp dword [esp + 0x1c], ebx
jle 0x403fe4
push 0x1ff
lea eax, [esp + 0x2a1]
push ebx
push eax
mov byte [esp + 0x2a8], bl
call fcn.004050a0
push 0xff
lea ecx, [esp + 0x6ad]
push ebx
push ecx
mov byte [esp + 0x6b4], bl
call fcn.004050a0
push 0xff
lea edx, [esp + 0x5b9]
push ebx
push edx
mov byte [esp + 0x5c0], bl
call fcn.004050a0
push 0xff
lea eax, [esp + 0x1c5]
push ebx
push eax
mov byte [esp + 0x1cc], bl
call fcn.004050a0
push 0xff
lea ecx, [esp + 0x4d1]
push ebx
push ecx
mov byte [esp + 0x4d8], bl
call fcn.004050a0
push 0xff
lea edx, [esp + 0x7dd]
push ebx
push edx
mov byte [esp + 0x7e4], bl
call fcn.004050a0
add esp, 0x48
push 0xc8
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x40], ebx
call fcn.004057a4
mov esi, eax
push 0x413544
push esi
call fcn.00405022
mov eax, dword [0x4183c4]
add esp, 0xc
push ebx
push esi
push 0x401
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
cmp dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], ebx
jle 0x403fd2
add ebp, 4
cmp dword [ebp - 4], ebx
mov byte [esp + 0x13], 0
je 0x403fb6
mov edx, dword [ebp]
cmp edx, ebx
je 0x403fb6
mov edi, str.RestManager
mov esi, edx
mov ecx, 0xc
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x403ab0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x403ad3
mov edi, str.RestServer
mov esi, edx
mov ecx, 0xb
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x403acb
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x403fb6
cmp dword [ebp + 8], 0
mov bl, 1
mov dword [esp + 0x38], 0
jle 0x403fb4
xor eax, eax
mov dword [esp + 0x14], eax
lea ecx, [ecx]
test bl, bl
je 0x403b17
mov ecx, dword [ebp + 4]
add eax, ecx
cmp dword [eax + 0x10], 0
je 0x403b17
cmp dword [eax + 0x14], 0
je 0x403b17
cmp dword [eax], 0
je 0x403b17
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x403b17
cmp dword [eax + 0xc], 0
jne 0x403b1e
xor bl, bl
jmp 0x403f66
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea edx, [esp + 0x6a4]
push str._s_s_is1
push edx
xor bl, bl
call fcn.00405022
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push 0xf003f
push 0
lea ecx, [esp + 0x6a8]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403f66
mov ecx, dword [esp + 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x5a0]
push eax
push 0
push 0
push 0x4133cc
mov esi, 0x100
push ecx
mov byte [esp + 0x2b], 1
mov dword [esp + 0x4c], esi
call edi
test eax, eax
jne 0x403f66
lea edx, [esp + 0x59c]
push 0x2e
push edx
call fcn.00404bc0
add esp, 8
test eax, eax
je 0x403f66
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + ecx + 0x14]
add eax, 1
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403be3
test dl, dl
je 0x403bdf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403be3
add eax, 2
add ecx, 2
test dl, dl
jne 0x403bc3
xor eax, eax
jmp 0x403be8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setl bl
test bl, bl
je 0x403f66
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1a0]
push ecx
push 0
push 0
push str.UninstallString
push edx
xor bl, bl
mov dword [esp + 0x38], esi
call edi
test eax, eax
jne 0x403f66
mov esi, dword [esp + 0x20]
lea ebx, [esi - 2]
push ebx
lea eax, [esp + 0x1a1]
push eax
lea ecx, [esp + 0x1a4]
push ecx
call fcn.00405870
lea edx, [esp + 0x1a8]
push 0
mov byte [esp + esi + 0x1aa], 0
push edx
mov byte [esp + esi + 0x1ad], 0
mov dword [esp + 0x34], ebx
call fcn.0041215f
add esp, 0x14
test eax, eax
sete bl
test bl, bl
je 0x403f66
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x4a0]
push ecx
push 0
push 0
push str.InstallLocation
push edx
xor bl, bl
mov dword [esp + 0x48], 0x100
call edi
test eax, eax
jne 0x403f66
push eax
lea eax, [esp + 0x4a0]
push eax
call fcn.0041215f
add esp, 8
test eax, eax
sete bl
test bl, bl
je 0x403f66
push 0xc8
call fcn.004057a4
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [edx + ecx]
push eax
push 0x413534
push esi
call fcn.00405022
mov ecx, dword [0x4183c4]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
add esp, 0x10
push 0
push esi
push 0x401
push ecx
call edi
push 0xff
lea edx, [esp + 0x8a1]
push 0
push edx
mov byte [esp + 0x8a8], 0
call fcn.004050a0
mov eax, dword [ebp + 4]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + eax + 4]
mov eax, dword [ebp - 4]
push edx
push eax
lea ecx, [esp + 0x8b0]
push str._s__s
push ecx
call fcn.00405022
add esp, 0x1c
lea edx, [esp + 0x98]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x98]
push eax
push 0
push 0x413464
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov ecx, dword [esp + 0x28]
push 0
push 0x80
push 2
push 0
lea edx, [esp + 0xa8]
push edx
lea eax, [esp + 0x8b0]
push eax
push ecx
call dword [sym.imp.WININET.dll_FtpGetFileA]
test eax, eax
setne bl
test bl, bl
je 0x403f66
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x7a0]
push eax
push 0
push 0
push str.DisplayName
push ecx
mov dword [esp + 0x54], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x40
lea edx, [esp + 0x5c]
push 0
push edx
mov dword [esp + 0x60], 0x44
call fcn.004050a0
push 0xc8
call fcn.004057a4
mov esi, eax
lea eax, [esp + 0x7ac]
push eax
push 0x4134fc
push esi
call fcn.00405022
mov ecx, dword [0x4183c4]
add esp, 0x1c
push 0
push esi
push 0x401
push ecx
call edi
lea edx, [esp + 0x19c]
push edx
lea eax, [esp + 0x2a0]
push str.__s_
push eax
call fcn.00405022
lea ecx, [esp + eax + 0x2a8]
push str.__SUPPRESSMSGBOXES__VERYSILENT
push ecx
call fcn.00405022
add esp, 0x14
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x58]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [esp + 0x2bc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, dword [esp + 0x44]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call fcn.004057a4
mov ecx, dword [ebp + 4]
mov edx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [edx + ecx]
push eax
push 0x4134c8
push esi
call fcn.00405022
mov ecx, dword [0x4183c4]
add esp, 0x10
push 0
push esi
push 0x401
push ecx
call edi
lea edx, [esp + 0x98]
push edx
lea eax, [esp + 0x2a0]
push str.__s_
push eax
call fcn.00405022
mov esi, eax
lea ecx, [esp + esi + 0x2a8]
push str.__SUPPRESSMSGBOXES
push ecx
call fcn.00405022
add esi, eax
lea edx, [esp + esi + 0x2b0]
push str.__VERYSILENT
push edx
call fcn.00405022
add esi, eax
lea eax, [esp + esi + 0x2b8]
push str.__PASSWORD7060
push eax
call fcn.00405022
lea ecx, [esp + 0x4c0]
push ecx
add esi, eax
lea edx, [esp + esi + 0x2c4]
push str.___DIR_s_
push edx
call fcn.00405022
add esp, 0x30
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x58]
push ecx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea edx, [esp + 0x2bc]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x44]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x4000000
push 3
push 0
push 1
push 0
lea edx, [esp + 0xb0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp byte [esp + 0x13], 0
je 0x403f95
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
add ecx, 1
add eax, 0x18
cmp ecx, dword [ebp + 8]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x14], eax
jl 0x403af0
xor ebx, ebx
mov eax, dword [esp + 0x2c]
add eax, 1
add ebp, 0x10
cmp eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
jl 0x403a80
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004010a0
add esp, 8
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call esi
mov eax, dword [esp + 0x40]
push eax
call esi
pop esi
pop edi
pop ebx
pop ebp
add esp, 0x98c
ret