Function at 0x416230
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x564b12
mov eax, dword fs:[0]
push eax
sub esp, 0xc94
mov eax, dword [0x5c0490]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
push esi
lea eax, [ebp - 0xc2c]
push str.Tool_VDCModuleUninstallExec
push eax
call fcn.00401190
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x420]
push esi
mov dword [ebp - 4], esi
push ecx
mov dword [ebp - 0xc34], esi
call fcn.00541d20
add esp, 0xc
push 0x208
lea edx, [ebp - 0x218]
push esi
push edx
mov dword [ebp - 0xc44], esi
mov dword [ebp - 0xc40], esi
call fcn.00541d20
add esp, 0xc
push 0x800
lea eax, [ebp - 0xc20]
push esi
push eax
call fcn.00541d20
add esp, 0xc
push 0x44
lea ecx, [ebp - 0xca0]
push esi
push ecx
call fcn.00541d20
xor eax, eax
add esp, 0xc
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
call fcn.00414850
call fcn.00416720
lea edx, [ebp - 0xc34]
push edx
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallVDC
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x41634c
push str._t_t_tRegOpenKeyEx
lea eax, [ebp - 0xc2c]
push eax
call fcn.00414780
push 0x5988ec
lea ecx, [ebp - 0xc2c]
push 2
push ecx
call fcn.00401410
add esp, 0xc
jmp 0x4166e7
lea edx, [ebp - 0xc44]
push edx
mov edx, dword [ebp - 0xc34]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xc40]
push ecx
push esi
push str.UninstallString
push edx
mov dword [ebp - 0xc44], 0x208
mov dword [ebp - 0xc40], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov eax, dword [ebp - 0xc34]
push eax
je 0x4163c5
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._t_t_tRegQueryValueEx
lea ecx, [ebp - 0xc2c]
push ecx
call fcn.00414780
push 0x5988ec
lea edx, [ebp - 0xc2c]
push 2
push edx
call fcn.00401410
add esp, 0xc
jmp 0x4166e7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00448c3f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x4163e5
push 0x80004005
call fcn.00404160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc38], eax
mov byte [ebp - 4], 1
call fcn.00448c3f
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x416415
push 0x80004005
call fcn.00404160
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc3c], eax
lea ecx, [ebp - 0x420]
push ecx
lea ecx, [ebp - 0xc24]
mov byte [ebp - 4], 2
call fcn.00404f00
mov bl, 3
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0xc24]
cmp dword [ecx - 0xc], esi
jge 0x416452
or esi, 0xffffffff
jmp 0x416473
push 0x596fb0
push ecx
call fcn.0053d6a8
add esp, 8
cmp eax, esi
jne 0x416469
or esi, 0xffffffff
jmp 0x416473
sub eax, dword [ebp - 0xc24]
sar eax, 1
mov esi, eax
push esi
lea edx, [ebp - 0xc30]
push edx
lea ecx, [ebp - 0xc24]
call fcn.00410460
push eax
lea ecx, [ebp - 0xc38]
mov byte [ebp - 4], 4
call fcn.004063a0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4164bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0xc38]
push edi
lea ecx, [ebp - 0x218]
push 0x104
push ecx
call fcn.0053e407
mov edx, dword [ebp - 0xc24]
mov eax, dword [edx - 0xc]
add esp, 0xc
sub eax, esi
push eax
lea eax, [ebp - 0xc30]
push eax
lea ecx, [ebp - 0xc24]
call fcn.004103e0
push eax
lea ecx, [ebp - 0xc3c]
mov byte [ebp - 4], 5
call fcn.004063a0
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0xc30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416529
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [ebp - 0xc3c]
push ebx
lea ecx, [ebp - 0xc20]
push 0x400
push ecx
call fcn.0053e407
add esp, 0xc
push 0x44
lea edx, [ebp - 0xca0]
push 0
push edx
call fcn.00541d20
add esp, 0xc
xor eax, eax
lea ecx, [ebp - 0xc54]
push ecx
lea edx, [ebp - 0xca0]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [ebp - 0xc54], eax
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], eax
mov dword [ebp - 0xc48], eax
mov word [ebp - 0xc70], ax
lea eax, [ebp - 0xc20]
push eax
lea ecx, [ebp - 0x218]
push ecx
mov dword [ebp - 0xca0], 0x44
mov dword [ebp - 0xc74], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x416631
push str._t_t_tCreateProcess
lea edx, [ebp - 0xc2c]
push edx
call fcn.00414780
push 0x5988ec
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.00401410
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416605
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416625
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
lea eax, [edi - 0x10]
jmp 0x4166ce
mov ecx, dword [ebp - 0xc50]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc54]
push ecx
call edi
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x416662
lea edx, [ebp - 0xc30]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push esi
call edi
push 0x5988ec
lea eax, [ebp - 0xc2c]
push 2
push eax
call fcn.00401410
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xc24]
add eax, 0xfffffff0
add esp, 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4166a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4166c1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xc38]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4166e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0xc2c]
mov dword [ebp - 4], 0xffffffff
call fcn.00401370
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053ca73
mov esp, ebp
pop ebp
ret