Function at 0x405760
Capabilities:
Copy file
Delete file
Enumerate gui resources
Get common file path
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xf7c
mov eax, dword [0x433448]
xor eax, esp
mov dword [esp + 0xf78], eax
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
push 0x20119
push edi
push str.softwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4057c6
push eax
push 0x20a
push str._ld_error_number:___ld_n
call fcn.00404f50
add esp, 0xc
lea eax, [edi + 1]
pop edi
mov ecx, dword [esp + 0xf78]
xor ecx, esp
call fcn.004060bb
add esp, 0xf7c
ret
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x14], 0x208
lea eax, [esp + 0x38]
mov dword [esp + 0x28], esi
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x770]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x405d77
mov ebx, dword [esp + 0xf90]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 3
lea eax, [esp + 0x760]
push eax
push 0x427d24
call fcn.004127f0
add esp, 0xc
test eax, eax
jne 0x405d38
lea eax, [esp + 0x20]
push eax
push 0x20119
push 0
lea eax, [esp + 0x768]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405dac
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x206
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.displayname
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x405da4
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x4058b2
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 4
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.AllowSilent
push dword [esp + 0x34]
call edi
push str._n_n
mov dword [esp + 0x28], 1
call fcn.00404f50
push str.Vim_Install_found_what_looks_like_an_existing_Vim_version._n
call fcn.00404f50
push str.The_name_of_the_entry_is:_n
call fcn.00404f50
lea eax, [esp + 0x4c]
push eax
push str._n__________s__n_n
call fcn.00404f50
push str.Installing_the_new_version_will_disable_part_of_the_existing_version._n
call fcn.00404f50
push str._The_batch_files_used_in_a_console_and_the__Edit_with_Vim__entry_in_n
call fcn.00404f50
push str.the_popup_menu_will_use_the_new_version__n
call fcn.00404f50
lea eax, [esp + 0x60]
test ebx, ebx
push eax
mov ecx, str._nRunning_uninstall_program_for___s__n
mov eax, str._nDo_you_want_to_uninstall___s__now__n_y_es__n_o_
cmovne eax, ecx
push eax
call fcn.00404f50
push 1
call fcn.00409248
push eax
call fcn.00409818
add esp, 0x30
mov dword [esp + 0x14], 0x206
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.uninstallstring
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x405d9c
lea ecx, [esp + 0x40]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405962
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0041132b
mov edx, eax
add esp, 4
test edx, edx
je 0x405dc6
lea ecx, [esp + 0x40]
mov dword [0x433f2c], edx
mov eax, ecx
sub edx, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x405990
push dword [0x433f2c]
call fcn.00404f80
push dword [0x433f2c]
call fcn.00404f80
mov cl, 0x6e
add esp, 8
mov byte [esp + 0x13], cl
nop dword [eax]
cmp cl, 0x6e
je 0x4059d6
movsx eax, cl
push eax
push str._c_is_an_invalid_reply.__Please_enter_either_y_or_n_n
call fcn.00404f50
add esp, 8
test ebx, ebx
je 0x4059e2
mov cl, 0x79
mov byte [esp + 0x13], cl
jmp 0x405a05
push 0
call fcn.00409248
push eax
call fcn.0040a057
lea eax, [esp + 0x1b]
push eax
push 0x427f4c
call fcn.004050d0
mov cl, byte [esp + 0x23]
add esp, 0x10
movsx eax, cl
add eax, 0xffffffb2
cmp eax, 0x2b
ja case.0x405a17.79
movzx eax, byte [eax + 0x405de8]
jmp dword [eax*4 + 0x405ddc]
cmp cl, 0x6e
je 0x405d2e
cmp cl, 0x79
jne 0x4059c0
jmp 0x405d2e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push 1
call fcn.004020e0
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x405bea
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x40]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x553], al
test al, al
jne 0x405a70
lea ecx, [esp + 0x554]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405a90
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x405abf
lea edx, [esp + 0x554]
mov cl, byte [edx + eax]
cmp cl, 0x2f
je 0x405abb
cmp cl, 0x5c
je 0x405abb
dec eax
test eax, eax
jg 0x405aa0
jmp 0x405abf
mov byte [edx + eax], 0
lea eax, [esp + 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x405be2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor esi, esi
movzx eax, di
push eax
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x250]
push str._s_vimun_04X.exe
push eax
call fcn.00405500
add esp, 0x10
lea eax, [esp + 0x248]
push 1
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x405b79
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x405be2
cmp esi, 0xffff
je 0x405be2
inc esi
lea eax, [esi + edi]
movzx eax, ax
push eax
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x250]
push str._s_vimun_04X.exe
push eax
call fcn.00405500
add esp, 0x10
lea eax, [esp + 0x248]
push 1
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405b20
lea eax, [esp + 0x248]
push 0x20
push eax
call fcn.00406ad0
mov ecx, eax
lea eax, [esp + 0x55c]
push eax
lea eax, [esp + 0x254]
test ecx, ecx
push eax
mov ecx, str.__s___S____s
mov eax, str._s__S____s
cmovne eax, ecx
push eax
lea eax, [esp + 0xb80]
push eax
call fcn.00405500
lea eax, [esp + 0xb84]
push eax
call fcn.00405020
add esp, 0x1c
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x1c], 0
jne 0x405cdd
jmp 0x405bea
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.00406ad0
add esp, 8
test eax, eax
je 0x405c19
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x968]
push str.__s_
push eax
call fcn.00405500
add esp, 0xc
jmp 0x405c32
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x40]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x963], al
test al, al
jne 0x405c20
lea eax, [esp + 0x964]
push eax
call fcn.00405020
add esp, 4
push 0x3e8
call ebp
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 0x405e20
mov dword [0x434764], 0
call esi
cmp dword [0x434764], 0
jne 0x405c8c
push str.Press_Enter_when_the_uninstaller_is_finished_n
call fcn.00404f50
push 0
call fcn.00409248
push eax
call fcn.0040a057
add esp, 0xc
call fcn.00409aa9
jmp 0x405cdd
push str.Waiting_for_the_uninstaller_to_finish__press_CTRL_C_to_abort_.
call fcn.00404f50
add esp, 4
nop dword [eax]
push 0x427fc8
call fcn.00404f50
push 1
call fcn.00409248
push eax
call fcn.00409818
add esp, 0xc
push 0x3e8
call ebp
push 0
push 0x405e20
mov dword [0x434764], 0
call esi
cmp dword [0x434764], 0
jg 0x405ca0
push str._nDone__n
call fcn.00404f50
add esp, 4
lea eax, [esp + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
cmp eax, dword [esp + 0x34]
jae 0x405d1c
dec esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov byte [esp + 0x13], 0x79
jmp 0x405d2e
mov byte [esp + 0x13], 0x6e
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 0x208
push eax
push 0
push 0
push 0
lea eax, [esp + 0x24]
inc esi
push eax
lea eax, [esp + 0x770]
mov dword [esp + 0x3c], esi
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x405815
mov edi, dword [esp + 0x24]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0xf88]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.004060bb
add esp, 0xf7c
ret
push eax
push 0x240
jmp 0x405db2
push eax
push 0x220
jmp 0x405db2
push eax
push 0x219
push str._ld_error_number:___ld_n
call fcn.00404f50
add esp, 0xc
mov eax, 1
jmp 0x405d83
push str.ERROR:_out_of_memory_n
call fcn.00404f50
add esp, 4
push 1
call fcn.00411671
nop
sub dword [ebp + 0x40], ebx
add byte [ecx], dh
pop edx
inc eax
add byte [esi], bl
pop edx
inc eax
add byte [eax], al
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add dword [edx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [eax]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add esp, ecx
int3