Function at 0x408c2b
Capabilities:
Create process on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c8
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00409cab
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
lea eax, [ebp - 0x5b8]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x408e81
mov edi, dword [sym.imp.KERNEL32.dll_CompareStringA]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov esi, 0x420b90
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0x12c
push eax
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x1a8]
push eax
push dword [ebp - 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x408de6
cmp eax, ebx
jne 0x408e5e
push 4
push str.ST6UNST_
lea eax, [ebp - 0x1a8]
push 4
push eax
push ebx
push 0x800
call edi
cmp eax, 2
jne 0x408dcd
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x7c0]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0xf003f
lea eax, [ebp - 0x7c0]
push ebx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408dc4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x9c8]
push eax
push ebx
push ebx
push str.AppToUninstall
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408dbb
lea eax, [ebp - 0x9c8]
push 0xffffffffffffffff
push eax
push 0xffffffffffffffff
push esi
push 1
push 0x800
call edi
cmp eax, 2
jne 0x408dbb
cmp dword [ebp - 0x14], ebx
jne 0x408dd5
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
lea eax, [ebp - 0x3b0]
push eax
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x208
mov byte [ebp - 0x3b0], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x408e5e
cmp byte [ebp - 0x3b0], bl
je 0x408e5e
lea eax, [ebp - 0x3b0]
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
jne 0x408e5e
inc dword [ebp - 8]
jmp 0x408c84
push esi
push 0x41c058
push dword [0x424cac]
jmp 0x408e6a
cmp dword [ebp - 4], ebx
je 0x408e5e
push 0x41c7f8
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x44
lea eax, [ebp - 0x7c]
pop esi
push esi
push ebx
push eax
call fcn.00411f50
add esp, 0xc
mov dword [ebp - 0x7c], esi
lea eax, [ebp - 0x38]
push 1
pop esi
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
mov word [ebp - 0x4c], si
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, ebx
jne 0x408e3c
push dword [0x424188]
push esi
push 0x30
push esi
jmp 0x408e79
push dword [0x42365c]
push 0x41c25c
push esi
push ebx
push 2
call fcn.00405290
add esp, 0x14
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408e81
push esi
push 0x41c058
push dword [0x4243d8]
call int.00403c7b
add esp, 0xc
push eax
push 1
push 0x30
push 1
call fcn.00405290
add esp, 0x10
pop edi
pop esi
pop ebx
leave
ret