Function at 0x408380
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.004189d0
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x7fe
xor edi, edi
lea ecx, [ebp - 0xfae]
xor eax, eax
push edi
push ecx
mov word [ebp - 0xfb0], ax
call fcn.00413700
add esp, 0xc
push 0x18e
lea eax, [ebp - 0x39e]
xor edx, edx
push edi
push eax
mov word [ebp - 0x3a0], dx
call fcn.00413700
mov eax, 4
mov dword [ebp - 0xfc4], eax
mov dword [ebp - 0xfc0], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xfbc], edi
mov dword [ebp - 0xfb8], edi
cmp dword [0xf99ed8], edi
je 0x408420
nop
movzx ecx, word [eax + str.SOFTWAREMicrosoftVisualStudio14.0VCRuntimesX64]
mov word [ebp + eax - 0x3a0], cx
add eax, 2
cmp cx, di
jne 0x408400
jmp 0x408437
movzx ecx, word [eax + str.SOFTWAREMicrosoftVisualStudio14.0VCRuntimesX86]
mov word [ebp + eax - 0x3a0], cx
add eax, 2
cmp cx, di
jne 0x408420
lea ecx, [ebp - 0xfb4]
push ecx
push 0x20019
push edi
lea edx, [ebp - 0x3a0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
test eax, eax
jne 0x408515
lea eax, [ebp - 0xfc0]
push eax
mov eax, dword [ebp - 0xfb4]
lea ecx, [ebp - 0xfbc]
push ecx
lea edx, [ebp - 0xfc4]
push edx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.Major
push eax
call edi
lea ecx, [ebp - 0xfc0]
push ecx
mov ecx, dword [ebp - 0xfb4]
test eax, eax
lea edx, [ebp - 0xfb8]
push edx
lea eax, [ebp - 0xfc4]
push eax
push 0
push str.Minor
push ecx
sete bl
call edi
mov edx, dword [ebp - 0xfb4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x408515
mov eax, dword [ebp - 0xfbc]
mov ecx, dword [ebp - 0xfb8]
push ecx
lea edx, [ebp - 0xfb0]
push eax
cmp eax, 0xe
jb 0x4084fe
push 0x41e8ec
push edx
call esi
lea eax, [ebp - 0xfb0]
push eax
call fcn.00402950
add esp, 0x14
jmp 0x4086d2
push 0x41e928
push edx
call esi
lea eax, [ebp - 0xfb0]
push eax
call fcn.00402950
add esp, 0x14
push 0x41e964
call fcn.00402950
add esp, 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x20e]
push edx
mov word [ebp - 0x210], cx
call fcn.00413700
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x5a6]
push ecx
mov word [ebp - 0x5a8], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x7ae]
push eax
mov word [ebp - 0x7b0], dx
call fcn.00413700
add esp, 0xc
lea ecx, [ebp - 0x5a8]
push str._quiet__norestart
push ecx
call esi
add esp, 8
cmp dword [0xf99ed8], 0
push str.C:UsersPublicSMR7WM7installTemp
je 0x4085a9
push str._sVC_redist.x64.exe
lea edx, [ebp - 0x210]
push edx
jmp 0x4085b5
push str._sVC_redist.x86.exe
lea eax, [ebp - 0x210]
push eax
call esi
add esp, 0xc
push 0x44
lea ecx, [ebp - 0x1020]
push 0
push ecx
call fcn.00413700
xor eax, eax
add esp, 0xc
lea edx, [ebp - 0x5a8]
push edx
mov dword [ebp - 0xfd4], eax
mov dword [ebp - 0xfd0], eax
mov dword [ebp - 0xfcc], eax
mov dword [ebp - 0xfc8], eax
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x7b0]
push str._s__s
push ecx
mov dword [ebp - 0x1020], 0x44
call esi
add esp, 0x10
lea edx, [ebp - 0xfd4]
push edx
lea eax, [ebp - 0x1020]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x7b0]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x408685
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x5a8]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xfb0]
push 0x41ea10
push ecx
call esi
lea edx, [ebp - 0xfb0]
add esp, 0x14
push edx
call fcn.00402950
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xfcc]
push eax
lea ecx, [ebp - 0x5a8]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0xfb0]
push 0x41ea58
push eax
call esi
lea ecx, [ebp - 0xfb0]
add esp, 0x14
push ecx
call fcn.00402950
mov edx, dword [ebp - 0xfd4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 4
push edx
call esi
mov eax, dword [ebp - 0xfd0]
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040f51e
mov esp, ebp
pop ebp
ret