Function at 0x414bd0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459216
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x46e3d8]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46e3d8]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
xor ebp, ebp
mov esi, edx
mov ebx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
mov eax, esi
mov dword [esp + 0xa70], ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414c32
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x48]
call fcn.00404170
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403ff0
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x414c69
lea eax, [esp + 0x44]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebp
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x414c90
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x70]
push edx
push ebp
push eax
mov dword [esp + 0x40], 0x104
mov dword [esp + 0x3c], 0x400
call edi
mov esi, eax
test esi, esi
jne 0x414ce8
mov ecx, dword [esp + 0x1c]
shr ecx, 1
mov word [esp + ecx*2 + 0x264], ax
push ebx
lea edx, [esp + 0x268]
lea ecx, [esp + 0x60]
call fcn.00414f30
add ebp, 1
test esi, esi
je 0x414c90
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
push ebx
call fcn.00424c40
mov edx, str.dump
call fcn.00401ee0
test eax, eax
je 0x414d26
mov ecx, str.dump
call fcn.00401f80
mov edx, eax
mov ecx, ebx
call fcn.00421700
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ebp, eax
lea ecx, [ecx]
test ebx, ebx
mov esi, dword [ebx + 4]
je 0x414d3b
cmp ebx, ebx
je 0x414d40
call fcn.0043e955
cmp ebp, esi
je 0x414ead
test ebx, ebx
jne 0x414d51
call fcn.0043e955
cmp ebp, dword [ebx + 4]
jne 0x414d5b
call fcn.0043e955
lea ecx, [esp + 0x24]
push ecx
lea esi, [ebp + 8]
push esi
mov ecx, 0x45e618
call fcn.00412d30
mov ecx, eax
mov byte [esp + 0xa70], 1
mov eax, dword [ecx + 0x14]
push str.ignore
mov edi, 6
call fcn.004052d0
test eax, eax
sete dl
mov byte [esp + 0xa70], 0
cmp dword [esp + 0x3c], 8
mov byte [ebx + 0x3d], dl
jb 0x414dae
mov eax, dword [esp + 0x28]
push eax
call fcn.0043e965
add esp, 4
cmp ebp, dword [ebx + 4]
jne 0x414db8
call fcn.0043e955
mov eax, dword [esi]
add eax, 0xffffffff
cmp eax, 0xb
ja case.0x414dc6.2
jmp dword [eax*4 + 0x414efc]
cmp ebp, dword [ebx + 4]
jne 0x414dd7
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.0041e470
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414dee
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.0041e870
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e05
call fcn.0043e955
mov ecx, esi
call fcn.0041ebc0
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e1b
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.0041f250
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e2f
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.0041f5b0
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e43
call fcn.0043e955
mov ecx, esi
mov edi, ebx
call fcn.0041fb40
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e58
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.0041fce0
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e6c
call fcn.0043e955
mov edi, ebx
call fcn.0041c720
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e7f
call fcn.0043e955
push ebx
mov eax, esi
call fcn.00420160
jmp case.0x414dc6.2
cmp ebp, dword [ebx + 4]
jne 0x414e93
call fcn.0043e955
push ebx
mov ecx, esi
call fcn.00420220
cmp ebp, dword [ebx + 4]
jne 0x414ea5
call fcn.0043e955
mov ebp, dword [ebp]
jmp 0x414d30
mov ecx, dword [esp + 0x14]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x58], 8
jb 0x414ed1
mov edx, dword [esp + 0x44]
push edx
call fcn.0043e965
add esp, 4
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.0043d02a
add esp, 0xa60
ret