Function at 0x402030
Capabilities:
Check os version
Delete registry value
Get common file path
Read .ini file

Disassembly:
sub esp, 0x9ec
mov eax, dword [0x41103c]
xor eax, esp
mov dword [esp + 0x9e8], eax
push ebp
push esi
mov esi, dword [esp + 0xa00]
xor ebp, ebp
push 0x90
lea eax, [esp + 0x30]
push ebp
push eax
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x34], ebp
call fcn.00403250
add esp, 0xc
push 0x104
lea ecx, [esp + 0x4e0]
push ecx
push ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x18], 0x104
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x4dc]
push 0x5c
push edx
call fcn.00402cc0
mov byte [eax], 0
lea eax, [esp + 0x4e4]
push eax
push 0x40e3c4
lea ecx, [esp + 0xdc]
push 0x104
push ecx
call fcn.0040322b
lea eax, [esp + 0xe4]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4020d0
sub eax, edx
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + eax + 0xd8]
push eax
push esi
call fcn.00401600
add esp, 0x14
cmp dword [esp + 8], ebp
jne 0x4028ea
cmp dword [esp + 0x14], ebp
je 0x4028ea
cmp dword [esp + 0xc], ebp
je 0x4028ea
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x2c]
cmp eax, 5
jne 0x402214
cmp dword [esp + 0x30], 1
jae 0x40221a
push ebx
push edi
xor eax, eax
push 0x103
lea ecx, [esp + 0x1dd]
push ebp
push ecx
mov byte [esp + 0xd0], 0
mov dword [esp + 0xd1], eax
mov dword [esp + 0xd5], eax
mov dword [esp + 0xd9], eax
mov word [esp + 0xdd], ax
mov byte [esp + 0xdf], al
mov byte [esp + 0x1e4], al
call fcn.00403250
mov esi, dword [sym.imp.SETUPAPI.dll_SetupGetInfFileListA]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push ebp
push ebp
push 2
push ebp
call esi
mov eax, dword [esp + 0x18]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [esp + 0x18]
push ebp
push ecx
mov ebx, eax
push ebx
push 2
push ebp
call esi
push 0x103
lea edx, [esp + 0x7f5]
push ebp
push edx
mov byte [esp + 0x7fc], 0
call fcn.00403250
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add esp, 0xc
lea eax, [esp + 0xd4]
push eax
push 0x104
lea ecx, [esp + 0x7f8]
push ecx
push 0x40e2a2
push str.VerifyMark
push str.OEMInf
call edi
xor esi, esi
cmp dword [esp + 0x18], ebp
jle 0x4023db
jmp 0x402262
jbe 0x402142
push str.setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x18], eax
cmp eax, ebp
je 0x402142
push str.SetupUninstallOEMInfA
mov edx, eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 0x1c], eax
cmp eax, ebp
jne 0x402142
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4028ea
xor ebp, ebp
push 0x103
lea edx, [esp + 0x3e5]
push ebp
push edx
mov byte [esp + 0x3ec], 0
call fcn.00403250
lea ebp, [esi + ebx]
push ebp
lea eax, [esp + 0x3f0]
push 0x104
push eax
call fcn.00403898
lea ecx, [esp + 0x3f8]
push 0x40e384
push ecx
call fcn.00402cf0
add esp, 0x20
test eax, eax
je 0x4023bf
push 0x104
lea edx, [esp + 0x2e0]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x3e0]
push eax
lea ecx, [esp + 0x2e0]
push ecx
push str._sinf_s
mov edx, ecx
push 0x104
push edx
call fcn.0040322b
push 0x103
lea eax, [esp + 0x601]
push 0
push eax
mov byte [esp + 0x608], 0
call fcn.00403250
add esp, 0x20
lea ecx, [esp + 0x2dc]
push ecx
push 0x104
lea edx, [esp + 0x5f0]
push edx
push 0x40e2a2
push str.VerifyMark
push str.OEMInf
call edi
lea eax, [esp + 0x5e8]
push eax
lea ecx, [esp + 0x7f4]
push ecx
call fcn.00401170
add esp, 8
test al, al
je 0x4023bf
mov eax, dword [esp + 0x34]
cmp eax, 5
jne 0x402637
cmp dword [esp + 0x38], 1
jae 0x40263d
lea eax, [esp + 0x2dc]
push eax
lea ecx, [esp + 0x6f0]
push 0x104
push ecx
call fcn.00403898
lea eax, [esp + 0x6f8]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402385
sub eax, edx
push 0x40e374
lea edx, [esp + eax + 0x6ed]
push 4
push edx
call fcn.00403898
lea eax, [esp + 0x2e8]
push eax
call fcn.004032fa
lea ecx, [esp + 0x6fc]
push ecx
call fcn.004032fa
add esp, 0x14
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023c4
sub eax, edx
lea esi, [esi + eax + 1]
cmp esi, dword [esp + 0x18]
jl 0x402260
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea edx, [esp + 0xd4]
push edx
push 2
push str.DevNum
push str.PIDVID
call ebx
mov ebp, eax
mov esi, 1
cmp ebp, esi
jl 0x402470
lea esp, [esp]
push esi
push str.Dev_d
lea eax, [esp + 0xcc]
push 0x10
push eax
call fcn.0040322b
add esp, 0x10
lea ecx, [esp + 0xd4]
push ecx
push 0x104
lea edx, [esp + 0x1e0]
push edx
push 0x40e2a2
lea eax, [esp + 0xd4]
push eax
push str.PIDVID
call edi
cmp byte [esp + 0x1d8], 0
je 0x40246b
lea ecx, [esp + 0x1d8]
push ecx
call fcn.004011d0
add esp, 4
inc esi
cmp esi, ebp
jle 0x402410
lea edx, [esp + 0xd4]
push edx
push 0
push 0x40e358
push str.DelInf
call ebx
mov ebp, eax
mov esi, 1
cmp ebp, esi
jl 0x402575
jmp 0x4024a0
push esi
push str.Inf_d
lea eax, [esp + 0xcc]
push 0x10
push eax
call fcn.0040322b
lea ecx, [esp + 0x4f4]
push ecx
push 0x40e3c4
lea edx, [esp + 0x1f0]
push 0x104
push edx
call fcn.0040322b
lea eax, [esp + 0x504]
add esp, 0x20
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4024e1
sub eax, ecx
lea ecx, [esp + 0xd4]
push ecx
push 0x104
lea edx, [esp + eax + 0x1e1]
push edx
push 0x40e2a2
lea eax, [esp + 0xd4]
push eax
push str.DelInf
call edi
push esi
push str.Sev_d
lea ecx, [esp + 0xcc]
push 0x10
push ecx
call fcn.0040322b
add esp, 0x10
lea edx, [esp + 0xd4]
push edx
push 0x104
lea eax, [esp + 0x8fc]
push eax
push 0x40e2a2
lea ecx, [esp + 0xd4]
push ecx
push str.DelInf
call edi
lea edx, [esp + 0x8f4]
push edx
lea eax, [esp + 0x1dc]
push eax
call fcn.00401560
inc esi
add esp, 8
cmp esi, ebp
jle 0x4024a0
lea ecx, [esp + 0xd4]
push ecx
push 0
push 0x40e33c
push 0x40e338
call ebx
mov ebx, 1
cmp eax, ebx
mov dword [esp + 0x28], eax
jl 0x40270d
lea esp, [esp]
push ebx
push str.Num_d
lea edx, [esp + 0xcc]
push 0x10
push edx
call fcn.0040322b
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
push 0x104
lea ecx, [esp + 0x1e0]
push ecx
push 0x40e2a2
lea edx, [esp + 0xd4]
push edx
push 0x40e338
call edi
call fcn.00401160
mov esi, eax
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x200
push esi
lea eax, [esp + 0x1dc]
push eax
push 0x80000002
call fcn.004013d0
add esp, 0xc
lea ecx, [esp + 0x1d8]
push ecx
lea ecx, [esp + 0x14]
call fcn.00401f80
mov edx, dword [esp + 0x10]
push 0x5c
push edx
call fcn.004033c1
add esp, 8
test eax, eax
jne 0x402652
or ebp, 0xffffffff
jmp 0x402658
jbe 0x40235e
push 0
push 1
lea edx, [esp + 0x3e8]
push edx
call dword [esp + 0x30]
jmp 0x4023bf
sub eax, dword [esp + 0x10]
mov ebp, eax
lea eax, [ebp + 1]
push eax
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x18]
call fcn.00401e90
push ebp
push 0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x1c]
call fcn.00401d50
lea eax, [esp + 0x2c]
push eax
or esi, 0xf003f
push esi
mov esi, dword [esp + 0x1c]
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4026c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4026e2
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402702
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc ebx
cmp ebx, dword [esp + 0x28]
jle 0x4025a0
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0xd4]
push ecx
push 0
push 0x40e33c
push str.CUKEY
call ebx
mov ebp, eax
mov esi, 1
cmp ebp, esi
jl 0x4027af
jmp 0x402740
push esi
push str.Num_d
lea edx, [esp + 0xcc]
push 0x10
push edx
call fcn.0040322b
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
push 0x104
lea ecx, [esp + 0x1e0]
push ecx
push 0x40e2a2
lea edx, [esp + 0xd4]
push edx
push str.CUKEY
call edi
call fcn.00401160
neg eax
sbb eax, eax
and eax, 0xffffff00
add eax, 0x200
push eax
lea eax, [esp + 0x1dc]
push eax
push 0x80000001
call fcn.004013d0
inc esi
add esp, 0xc
cmp esi, ebp
jle 0x402740
lea ecx, [esp + 0xd4]
push ecx
push 0
push str.File
push str.DelFile
call ebx
mov ebp, eax
mov esi, 1
cmp ebp, esi
jl 0x40286c
jmp 0x4027e0
push esi
push str.File_d
lea edx, [esp + 0xcc]
push 0x10
push edx
call fcn.0040322b
add esp, 0x10
lea eax, [esp + 0xd4]
push eax
push 0x104
lea ecx, [esp + 0x1e0]
push ecx
push 0x40e2a2
lea edx, [esp + 0xd4]
push edx
push str.DelFile
call edi
push esi
push str.FilePath_d
lea eax, [esp + 0xcc]
push 0x10
push eax
call fcn.0040322b
add esp, 0x10
lea ecx, [esp + 0xd4]
push ecx
push 0
lea edx, [esp + 0xcc]
push edx
push str.DelFile
call ebx
push eax
lea eax, [esp + 0x1dc]
push eax
call fcn.004018e0
inc esi
add esp, 8
cmp esi, ebp
jle 0x4027e0
mov eax, dword [esp + 0x20]
pop edi
pop ebx
test eax, eax
je 0x40287d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x411fa4], 0
je 0x402892
push 0
push 0
push 0
call dword [sym.imp.SETUPAPI.dll_SetupPromptReboot]
lea ecx, [esp + 8]
push ecx
push 0
mov dword [esp + 0x10], 0
call dword [sym.imp.SETUPAPI.dll_CM_Connect_MachineA]
test eax, eax
je 0x4028b2
mov eax, 2
jmp 0x4028ec
mov edx, dword [esp + 8]
push edx
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Locate_DevNode_ExA]
test eax, eax
jne 0x4028db
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x20]
push ecx
push eax
push edx
call dword [sym.imp.SETUPAPI.dll_CM_Reenumerate_DevNode_Ex]
mov eax, dword [esp + 8]
test eax, eax
je 0x4028ea
push eax
call dword [sym.imp.SETUPAPI.dll_CM_Disconnect_Machine]
xor eax, eax
mov ecx, dword [esp + 0x9f0]
pop esi
pop ebp
xor ecx, esp
call fcn.0040321c
add esp, 0x9ec
ret 0x10