Function at 0x405f80
Capabilities:
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xac4
mov eax, dword [0x5ad040]
xor eax, esp
mov dword [esp + 0xac0], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xc]
push esi
push edi
push eax
push 0x20019
push 0
push str.SOFTWAREHNCSharedInstall_InformationHOffice110
push reloc.OLEAUT32.dll_SysReAllocString
mov edi, ecx
mov dword [esp + 0x28], 0
call ebx
mov esi, eax
xor eax, eax
push 0x206
push eax
mov word [esp + 0x4b8], ax
lea eax, [esp + 0x4ba]
push eax
call fcn.00530d50
add esp, 0xc
xor eax, eax
test esi, esi
jne 0x40626d
push 0x206
mov word [esp + 0x2ac], ax
lea eax, [esp + 0x2ae]
push esi
push eax
call fcn.00530d50
add esp, 0xc
xor eax, eax
mov word [esp + 0x6b8], ax
push 0x206
push eax
lea eax, [esp + 0x6c2]
push eax
call fcn.00530d50
mov ecx, dword [edi + 0xd0c]
mov eax, 0x2aaaaaab
sub ecx, dword [edi + 0xd08]
add esp, 0xc
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x4061f1
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea ecx, [edi + 0xa8]
push esi
lea eax, [esp + 0x6bc]
push eax
lea eax, [esp + 0x2b0]
push eax
call fcn.00408b80
lea eax, [esp + 0x2a8]
push str.TARGET
push eax
call fcn.0052f6c5
lea ecx, [esp + 0x2b0]
add esp, 8
cmp ecx, eax
jne 0x40614d
xor eax, eax
mov dword [esp + 0x18], 1
push 0x206
push eax
mov word [esp + 0x60], ax
lea eax, [esp + 0x62]
push eax
call fcn.00530d50
add esp, 0xc
mov dword [esp + 0xc], 0x104
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREHNCSharedInstall_InformationHOffice110
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.Path
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x4b4]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
lea eax, [esp + 0x2b6]
push eax
lea eax, [esp + 0x4b4]
push 0x104
push eax
call fcn.0052f62b
add esp, 0xc
lea eax, [esp + 0x4b0]
push eax
lea eax, [esp + 0x2ac]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x2ac]
push eax
call ebx
cmp eax, 0xffffffff
je 0x4061bf
push 0x3c
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00530d50
lea eax, [esp + 0x2b4]
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x38], eax
add esp, 0xc
lea eax, [esp + 0x6b8]
mov dword [esp + 0x28], str.open
mov dword [esp + 0x30], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x38], 5
push eax
mov dword [esp + 0x24], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0xffffffffffffffff
push dword [esp + 0x58]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [edi + 0xd0c]
mov eax, 0x2aaaaaab
sub ecx, dword [edi + 0xd08]
inc esi
imul ecx
lea ecx, [edi + 0xa8]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jl 0x406060
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [edi + 0xd20], 0
jl 0x406242
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0xf003f
push 0
push str.SOFTWAREHNCSharedHncUpdate
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x406242
mov eax, dword [edi + 0xd20]
push 4
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push 4
push 0
push str.Auto
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [edi + 0x1d84]
push eax
lea eax, [esp + 0x8c4]
push 0x104
push eax
call fcn.0052f5cf
add esp, 0xc
lea eax, [esp + 0x8c0]
push eax
call fcn.00408c40
xor eax, eax
mov ecx, dword [esp + 0xacc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0052e288
mov esp, ebp
pop ebp
ret