Function at 0x404e56
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push ebx
push esi
mov ebx, 0xff
push edi
push ebx
lea eax, [ebp - 0x298]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallTotalcmd
push eax
call fcn.0040c63d
push ebx
lea eax, [ebp - 0x118]
push str.HKEY_LOCAL_MACHINE:_r_n
push eax
call fcn.0040c63d
lea eax, [ebp - 0x298]
push ebx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040c6bc
add esp, 0x24
lea eax, [ebp - 0x118]
push eax
push 0x82
push dword [0x420b04]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push dword [0x420b04]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x420b3c]
xor esi, esi
cmp eax, esi
je 0x404ef6
push ebx
lea eax, [ebp - 0x298]
push 0x41c87c
push eax
call fcn.0040c6bc
mov eax, dword [0x420b3c]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, 0x100
push esi
push ecx
or al, 2
push esi
push eax
push esi
push esi
lea eax, [ebp - 0x298]
push esi
push eax
push 0x80000002
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
jne 0x404f56
push dword [0x420b04]
lea eax, [ebp - 0x298]
push dword [0x420b3c]
push eax
call fcn.0040b73f
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x404f53
mov dword [ebp - 4], 1
mov dword [ebp - 8], eax
push 2
lea eax, [ebp - 0x158]
push 0x3f
mov edi, 0x420b98
push eax
push edi
mov esi, 0x41c25c
push str.updatecheck
push esi
call fcn.0040105a
push 2
lea eax, [ebp - 0x198]
push 0x3f
push eax
push edi
push str.updatecheck64
push esi
call fcn.0040105a
add esp, 0x30
cmp dword [ebp - 0xc], 0
je 0x4052fd
cmp dword [0x420b3c], 0
mov eax, dword [str.Total_Commander_6432_bit__Remove_or_Repair_]
jne 0x404fae
mov eax, dword [str.Total_Commander__Remove_or_Repair_]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.00413a30
pop ecx
test eax, eax
mov eax, dword [str.Total_Commander_64_bit__Remove_or_Repair_]
pop ecx
je 0x404fd2
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
push str.DisplayName
push dword [ebp - 4]
call fcn.00404de0
lea eax, [ebp - 0x117]
push 0x423b40
push eax
mov byte [ebp - 0x118], 0x22
call fcn.00413500
lea eax, [ebp - 0x117]
push eax
push dword [ebp - 8]
push str.InstallLocation
push dword [ebp - 4]
call fcn.00404de0
lea eax, [ebp - 0x118]
push eax
call fcn.00413210
lea eax, [ebp + eax - 0x118]
add esp, 0x2c
cmp dword [0x420b3c], 0
mov dword [ebp - 0x14], eax
mov eax, str.tcunin64.exe
jne 0x40503e
mov eax, str.tcuninst.exe
push ebx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00413d10
lea eax, [ebp - 0x117]
push 0x20
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
push eax
call fcn.00413320
add esp, 0x14
test eax, eax
je 0x405088
lea eax, [ebp - 0x118]
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x118]
push 0x41c83c
push eax
call fcn.0040c6bc
add esp, 0xc
push dword [ebp - 0xc]
push dword [ebp - 8]
push str.UninstallString
push dword [ebp - 4]
call fcn.00404de0
push 2
lea eax, [ebp - 0x398]
push ebx
push eax
push edi
push str.updatecheck
push esi
call fcn.0040105a
add esp, 0x28
cmp byte [ebp - 0x398], 0
je 0x4050e2
mov eax, dword [ebp - 0x14]
push ebx
and byte [eax], 0
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00413d10
add esp, 0xc
lea eax, [ebp - 0x117]
jmp 0x4050e5
mov eax, dword [ebp - 0xc]
push eax
push dword [ebp - 8]
push str.DisplayIcon
push dword [ebp - 4]
call fcn.00404de0
push 2
lea eax, [ebp - 0x118]
push ebx
push eax
push edi
push str.publisher
push esi
call fcn.0040105a
add esp, 0x28
cmp byte [ebp - 0x118], 0
je 0x405132
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 8]
push str.publisher
push dword [ebp - 4]
call fcn.00404de0
add esp, 0x10
push 2
lea eax, [ebp - 0x118]
push ebx
push eax
push edi
push 0x41c810
push esi
call fcn.0040105a
add esp, 0x18
cmp byte [ebp - 0x118], 0
je 0x40516e
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 8]
push str.URLInfoAbout
push dword [ebp - 4]
call fcn.00404de0
add esp, 0x10
push 2
lea eax, [ebp - 0x118]
push ebx
push eax
push edi
push str.progver
push esi
call fcn.0040105a
add esp, 0x18
cmp byte [ebp - 0x118], 0
je 0x4051aa
lea eax, [ebp - 0x118]
push eax
push dword [ebp - 8]
push str.DisplayVersion
push dword [ebp - 4]
call fcn.00404de0
add esp, 0x10
push 2
push 0xffffffffffffffff
push str.progvermajor
push esi
call fcn.004011d0
mov edi, eax
add esp, 0x10
cmp edi, 0xffffffff
je 0x405231
push edi
push dword [ebp - 8]
push str.VersionMajor
push dword [ebp - 4]
call fcn.00404e1f
push 2
push 0xffffffffffffffff
push str.progverminor
push esi
call fcn.004011d0
mov esi, eax
add esp, 0x20
cmp esi, 0xffffffff
je 0x405231
push esi
push dword [ebp - 8]
push str.VersionMinor
push dword [ebp - 4]
call fcn.00404e1f
mov eax, esi
push 0x64
cdq
pop ecx
idiv ecx
push 0x64
shl edi, 8
mov ecx, eax
mov eax, esi
cdq
pop esi
add ecx, edi
idiv esi
shl ecx, 8
add ecx, edx
shl ecx, 8
push ecx
push dword [ebp - 8]
push str.Version
push dword [ebp - 4]
call fcn.00404e1f
add esp, 0x20
mov eax, dword [0x423974]
xor esi, esi
cmp eax, esi
jle 0x405258
cdq
mov ecx, 0x400
idiv ecx
push eax
push dword [ebp - 8]
push str.EstimatedSize
push dword [ebp - 4]
call fcn.00404e1f
add esp, 0x10
cmp dword [ebp - 8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x405271
push dword [0x420b04]
call fcn.0040b7f9
pop ecx
jmp 0x405276
push dword [ebp - 4]
call edi
cmp dword [0x420b3c], esi
je 0x4052fd
lea eax, [ebp - 4]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x298]
mov esi, 0x80000002
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4052fd
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push ebx
push str.DisplayName
push dword [ebp - 4]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4052e5
push dword [0x41c084]
lea eax, [ebp - 0x118]
push eax
call fcn.00413a30
pop ecx
test eax, eax
pop ecx
jne 0x4052e5
mov dword [ebp - 0xc], 1
push dword [ebp - 4]
call edi
cmp dword [ebp - 0xc], ebx
je 0x4052fd
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
leave
ret