Function at 0x404010
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x478ad0
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x491090]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.IsWow64Process
push 0x47c488
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40407f
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea eax, [ebp - 0x11c]
push eax
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x124]
mov dword [ebp - 0x120], 0
push eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x124], 4
push eax
xor esi, esi
push esi
push esi
push str.Release
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4040e3
cmp dword [ebp - 0x120], 0x80ea8
mov eax, 1
cmovae esi, eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xd6
lea eax, [ebp - 0xea]
push 0
push eax
call fcn.00423270
movups xmm0, xmmword [str.DotNetFramework48_ndp48_x86_x64_allos_enu.exe]
mov eax, dword [0x47c4f8]
add esp, 0xc
mov dword [ebp - 0xf0], eax
test esi, esi
mov ax, word [0x47c4fc]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
movups xmmword [ebp - 0x118], xmm0
mov word [ebp - 0xec], ax
lea eax, [ebp - 0x118]
movups xmm0, xmmword [0x47c4e0]
mov dword [ebp - 0x164], 0x3c
mov dword [ebp - 0x154], eax
movups xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0x15c], 0
movq xmm0, qword [0x47c4f0]
movq qword [ebp - 0xf8], xmm0
mov dword [ebp - 0x158], str.open
mov dword [ebp - 0x150], 0x47c28c
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x148], 5
mov dword [ebp - 0x160], 0x40
mov dword [ebp - 0x144], 0x1d
jne 0x4041d7
lea eax, [ebp - 0x164]
push eax
call esi
mov eax, dword [ebp - 0x12c]
test eax, eax
je 0x4041d7
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x12c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x11c]
push eax
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x120]
push eax
push 0
push 0
push str.Release
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x120], 0x80ea8
jb 0x404298
push 1
push 0x40
push 1
push str.MSIorg.manager_x86.msi
lea ecx, [ebp - 0x21c]
call fcn.00401390
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax + 4]
test byte [ebp + eax - 0x210], 6
jne 0x404270
movups xmm0, xmmword [str.MSIorg.manager_x86.msi]
movups xmmword [ebp - 0x118], xmm0
movq xmm0, qword [0x47c518]
movq qword [ebp - 0x108], xmm0
lea ecx, [ebp - 0x21c]
call fcn.00402340
lea eax, [ebp - 0x118]
mov dword [ebp - 0x154], eax
lea eax, [ebp - 0x164]
push eax
call esi
jmp 0x4042ac
push 0
push str.org.manager_Setup
push str.The_installation_of_.NET_Framework_4.8_was_not_successful._The_Setup_will_be_stopped.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00420b6e
mov esp, ebp
pop ebp
ret 0x10