Function at 0x412fc0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451ca6
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x468738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], ebx
mov word [ebp - 0xa34], ax
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413021
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0xa34]
call fcn.004065a0
push 0xa
mov eax, str.Uninstall
mov ecx, esi
call fcn.00403690
cmp dword [ebp - 0xa20], 8
mov eax, dword [ebp - 0xa34]
jae 0x41305d
mov eax, esi
lea ecx, [ebp - 0xa60]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0xa5c]
push edx
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa60]
push 0
push 0
lea ecx, [ebp - 0xa68]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
mov dword [ebp - 0xa68], 0x104
mov dword [ebp - 0xa5c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x4131d5
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0x218]
shr ecx, 1
xor edx, edx
push str.Folder
push eax
mov word [ebp + ecx*2 - 0xa18], dx
call fcn.004398c8
add esp, 8
test eax, eax
je 0x413134
lea ecx, [ebp - 0xa18]
push 0x458684
push ecx
call fcn.004398c8
add esp, 8
test eax, eax
je 0x413119
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133d0
jmp 0x413134
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_Folder:__s
push 0x4699dc
xor eax, eax
call fcn.0042c820
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.004398c8
add esp, 8
test eax, eax
je 0x413193
lea ecx, [ebp - 0xa18]
push 0x458684
push ecx
call fcn.004398c8
add esp, 8
test eax, eax
je 0x413178
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133d0
jmp 0x413193
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_File:__s
push 0x4699dc
xor eax, eax
call fcn.0042c820
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.004398c8
add esp, 8
test eax, eax
jne 0x4131d5
lea ecx, [ebp - 0x218]
push str.Folder
push ecx
call fcn.004398c8
add esp, 8
test eax, eax
jne 0x4131d5
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004133d0
inc ebx
test esi, esi
je 0x413077
mov edx, dword [ebp - 0xa60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, edi
call fcn.00421990
push str.dump
call fcn.00402130
test eax, eax
je 0x41321a
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, edi
call fcn.0041efa0
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0xa58], esi
cmp esi, eax
je 0x413357
jmp 0x413236
mov esi, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa50]
add esi, 8
push ecx
mov edx, 0x4585d8
mov ecx, esi
call fcn.00410e40
mov ebx, dword [eax + 0x10]
mov ecx, ebx
cmp ecx, ebx
jae 0x413255
mov edx, ebx
cmp ebx, 6
jb 0x413261
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x41326b
mov ecx, dword [eax]
jmp 0x41326d
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x41328d
mov di, word [ecx]
cmp di, word [eax]
jne 0x413297
add ecx, 2
add eax, 2
dec edx
jne 0x413276
mov edi, dword [ebp - 0xa54]
cmp ebx, 6
jae 0x4132a7
or eax, 0xffffffff
jmp 0x4132af
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x413287
mov edi, dword [ebp - 0xa54]
jmp 0x4132af
xor eax, eax
cmp ebx, 6
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa3c], 8
mov byte [edi + 0x41], al
jb 0x4132d3
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.00438b4b
add esp, 4
mov eax, dword [esi]
dec eax
cmp eax, 0xb
ja case.0x4132db.3
jmp dword [eax*4 + 0x4133a0]
push edi
mov ecx, esi
call fcn.0041c3a0
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041c7d0
jmp case.0x4132db.3
mov ecx, esi
call fcn.0041ca20
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041cfe0
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041d2e0
jmp case.0x4132db.3
mov ecx, esi
mov ebx, edi
call fcn.0041d820
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041d9a0
jmp case.0x4132db.3
call fcn.0041a750
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041dcd0
jmp case.0x4132db.3
push edi
mov ecx, esi
call fcn.0041dd90
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
cmp eax, dword [edi]
jne 0x413230
mov eax, dword [ebp - 0xa64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0xa20], 8
jb 0x413381
mov ecx, dword [ebp - 0xa34]
push ecx
call fcn.00438b4b
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004377c1
mov esp, ebp
pop ebp
ret