Function at 0x405b3d
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
sub esp, 0xbbc
push ebx
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 4], eax
push edi
call fcn.004061fc
test eax, eax
jne 0x405b64
mov eax, dword [0x41295c]
jmp 0x4061b1
push 0x208
mov esi, 0x412ff0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.0040b8df
add esp, 4
mov esi, 0x413240
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
call fcn.0040b8df
add esp, 4
xor esi, esi
cmp dword [0x40f748], esi
je 0x405e5b
call fcn.0040b63c
push eax
lea ecx, [ebp - 0x7ac]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x7ac]
push ecx
push 0xf003f
push esi
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405e5b
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x39c]
mov dword [ebp - 0x1c], 0x12c
push ebx
push ebx
push ebx
push ecx
push edx
push dword [ebp - 0x28]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x6c], eax
cmp eax, 0x103
je 0x405d47
cmp eax, ebx
jne 0x405da1
push 4
lea eax, [ebp - 0x39c]
push str.ST5UNST_
push 4
push eax
push ebx
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x405d3b
lea eax, [ebp - 0x39c]
lea ecx, [ebp - 0x7ac]
push eax
lea edx, [ebp - 0xbbc]
push ecx
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 8]
lea edx, [ebp - 0xbbc]
push ecx
push 0xf003f
push ebx
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x405df8
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x9b4]
mov dword [ebp - 0xc], 0x208
push eax
push ecx
push ebx
push ebx
push str.AppToUninstall
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405d2a
push 0xffffffffffffffff
lea eax, [ebp - 0x9b4]
push eax
push 0xffffffffffffffff
push 0x40f228
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x405d2a
cmp dword [ebp - 0x18], ebx
jne 0x405dbe
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x5a4]
push eax
mov byte [ebp - 0x5a4], bl
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], 0x208
push ecx
push ebx
push ebx
push str.UninstallString
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x405ddb
cmp byte [ebp - 0x5a4], bl
je 0x405ddb
lea esi, [ebp - 0x5a4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x405df8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x6c], ebx
je 0x405be5
xor ebx, ebx
test esi, esi
je 0x405e3e
push 0x410910
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
lea eax, [ebp - 0x68]
push ebx
mov edi, 1
push eax
call fcn.00407010
add esp, 0xc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x68], 0x44
mov word [ebp - 0x38], di
push eax
lea ecx, [ebp - 0x68]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x405e15
mov eax, dword [0x41320c]
push eax
jmp 0x4061b7
push 0x40f228
mov eax, dword [0x41323c]
push 0x410588
push eax
call fcn.004010c4
add esp, 0xc
jmp 0x4061b1
push 0x40f228
mov eax, dword [0x4136c0]
push 0x410588
push eax
call fcn.004010c4
add esp, 0xc
jmp 0x4061b1
push 0x40f228
mov eax, dword [0x41323c]
push 0x410588
push eax
call fcn.004010c4
add esp, 0xc
jmp 0x4061b1
push 0x40f228
mov eax, dword [0x41323c]
push 0x410588
push eax
call fcn.004010c4
add esp, 0xc
jmp 0x4061b1
mov eax, dword [0x412730]
push eax
push 0x41086c
push 1
push 0
push 2
xor edi, edi
call fcn.004027d8
add esp, 0x14
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4061c3
push 0x40f228
mov eax, dword [0x41323c]
push 0x410588
push eax
call fcn.004010c4
add esp, 0xc
jmp 0x4061b1
call fcn.00405787
cmp eax, 1
je 0x405e6f
mov edi, 1
jmp 0x4061c3
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x208
push 0x412740
push 0xfffffffffffffffa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405ea2
mov eax, dword [0x412964]
jmp 0x4061b1
push 0x5c
push 0x412740
call fcn.00404167
add esp, 8
mov byte [eax + 1], 0
push 0x412ff0
call fcn.00402488
add esp, 4
test eax, eax
jne 0x405ed0
mov edi, 1
jmp 0x4061c3
mov eax, dword [0x412bb4]
push eax
call fcn.00402438
add esp, 4
cmp eax, 0xfffffffe
jne 0x405eed
mov edi, 1
jmp 0x4061c3
call fcn.004057fa
test eax, eax
jne 0x405f00
mov edi, 1
jmp 0x4061c3
mov edi, str.SETUP.LST
mov esi, 0x410674
push edi
push 0x412740
push esi
push 0x413450
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push edi
push 0x412ff0
push esi
push 0x4129a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
call fcn.00403557
test eax, eax
je 0x405f5f
mov eax, dword [0x413204]
push eax
push edi
push str._s_n_n_s
mov edi, 1
push edi
push 0x10
push edi
call fcn.004027d8
add esp, 0x18
jmp 0x4061c3
push 0x4129a0
push 0x40fba0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, str.Setup
push eax
push eax
push str.SETUP.LST
call fcn.0040320e
add esp, 0xc
test eax, eax
je 0x405f93
push eax
push 0x40f998
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, str.Title
push esi
push str.Setup
push str.SETUP.LST
call fcn.0040320e
add esp, 0xc
test eax, eax
je 0x4061ac
push 0x208
lea ecx, [ebp - 0x270]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov byte [ebp - 0x69], 0
lea ecx, [ebp - 0x270]
push ecx
call fcn.00401098
add esp, 4
push eax
push esi
call fcn.00402450
add esp, 8
cmp eax, 0xfffffffe
jne 0x405ff2
mov edi, 1
jmp 0x4061c3
lea eax, [ebp - 4]
push eax
push str.BootStrap
call fcn.00406e18
add esp, 8
mov esi, eax
cmp dword [ebp - 4], 1
jne 0x406015
mov edi, 1
jmp 0x4061c3
lea eax, [ebp - 4]
push eax
push str.Files
call fcn.00406e18
add esp, 8
mov ebx, eax
cmp dword [ebp - 4], 1
jne 0x406038
mov edi, 1
jmp 0x4061c3
test esi, esi
jne 0x40612d
test ebx, ebx
jne 0x40612d
mov edi, 1
mov eax, dword [0x40f754]
push eax
mov dword [ebp - 0x10], edi
call fcn.00405a29
add esp, 4
push 0
push str.BootStrap
call fcn.004043b8
add esp, 8
cmp eax, edi
jne 0x4061c3
push str.BootStrap
call fcn.00404e8b
add esp, 4
call fcn.00406342
test eax, eax
jge 0x4060ca
push eax
lea ecx, [ebp - 0x162]
push str._08X
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x162]
push ecx
push 0x410588
push dword [0x41367c]
call fcn.004010c4
add esp, 0xc
push eax
push 1
push 0x30
push 1
call fcn.004027d8
add esp, 0x10
mov eax, dword [0x413680]
push eax
call fcn.00402438
add esp, 4
cmp eax, 0xfffffffe
jne 0x4060e7
mov edi, 1
jmp 0x4061c3
cmp byte [0x40f998], 0
je 0x406101
call fcn.00404cc1
cmp eax, 1
sbb edi, edi
neg edi
jmp 0x4061c3
xor edi, edi
mov eax, dword [0x40f74c]
push edi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x412730]
push eax
push 0x41086c
push 1
push edi
push 2
call fcn.004027d8
add esp, 0x14
jmp 0x4061c3
mov edi, 1
mov eax, dword [0x412ddc]
push eax
mov dword [0x40f780], edi
push 0x41086c
push edi
push 0x31
push 2
call fcn.004027d8
add esp, 0x14
cmp eax, 2
je 0x4061c3
test esi, esi
je 0x406170
mov edi, 1
push edi
push str.BootStrap
call fcn.004043b8
add esp, 8
cmp eax, edi
jne 0x4061c3
test ebx, ebx
je 0x40618b
mov edi, 1
push edi
push str.BootStrap
call fcn.004043b8
add esp, 8
cmp eax, edi
jne 0x4061c3
call fcn.0040675f
test eax, eax
jne 0x40619b
mov edi, 1
jmp 0x4061c3
push 1
mov edi, 1
call fcn.00406d0a
add esp, 4
jmp 0x4061c3
mov eax, dword [0x412dd8]
push eax
mov edi, 1
push edi
push 0x30
push edi
call fcn.004027d8
add esp, 0x10
call fcn.004023eb
cmp edi, 0xffffffff
jne 0x4061cf
xor edi, edi
cmp dword [0x40f740], 0
je 0x4061e4
cmp edi, 1
sbb eax, eax
neg eax
mov dword [0x40f744], eax
cmp dword [ebp - 0x10], 0
jne 0x4061ec
xor edi, edi
push edi
call fcn.0040559a
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret