Function at 0x4de310
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56dcbd
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x5c5ebc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x88], ecx
call fcn.004ca7b0
test eax, eax
jne 0x4de34b
xor eax, eax
jmp 0x4de862
call fcn.004cdc80
cmp eax, 0xffffffff
je 0x4de35c
xor eax, eax
jmp 0x4de862
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0xff
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, dword [ebp - 0x88]
call fcn.004f87c3
push 0
call fcn.005027e7
test eax, eax
jne 0x4de39f
push 0xffffffffffffffff
push 0
push 0x67
call fcn.0049ad50
add esp, 0xc
xor eax, eax
jmp 0x4de862
push 0
call fcn.005010bf
add esp, 4
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0043cb20
test eax, eax
jne 0x4de3c1
xor eax, eax
jmp 0x4de862
push 0x58efc0
mov ecx, dword [ebp - 0x88]
mov edx, dword [ecx + 0x48]
push edx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de3f4
push 0
push 0x40
push str._uninstall:_uninstall_program_r_n_start:_start_service_r_n_stop:_stop_service_r_n_restart:_restart_service_r_n_update:_update_xml_data
call fcn.0049ac90
add esp, 0xc
xor eax, eax
jmp 0x4de862
push str._uninstall
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de50d
call fcn.0043ccb0
push 0
mov edx, dword [ebp - 0x88]
mov eax, dword [edx + 0x50]
push eax
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x70], eax
push 0
push 0
push 0x7e7
mov ecx, dword [ebp - 0x70]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x5fab20
call fcn.004dd9d0
push 0
mov ecx, 0x5fa8c0
call fcn.004db6b0
mov dword [ebp - 0x6c], 0
mov ecx, 0x5fa8c0
call fcn.004de920
test eax, eax
jne 0x4de489
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
cmp dword [ebp - 0x6c], 5
jl 0x4de487
jmp 0x4de489
jmp 0x4de45d
push 0
push 0
push 0x806b
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
mov ecx, 0x5fa8c0
call fcn.004dbba0
mov ecx, 0x5fab20
call fcn.004ddf30
lea eax, [ebp - 0x68]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4de4eb
call fcn.0043d000
push eax
mov ecx, dword [ebp - 0x68]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x68]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x5fa8c0
call fcn.0043ce70
test eax, eax
je 0x4de506
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4de4eb
xor eax, eax
jmp 0x4de862
push 0x58f13c
call fcn.00528324
add esp, 4
push eax
push str._restart
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.0052f26c
add esp, 0xc
test eax, eax
jne 0x4de5d3
mov ecx, 0x5fab20
call fcn.004dd9d0
push 0
mov ecx, 0x5fa8c0
call fcn.004db6b0
mov dword [ebp - 0x74], 0
mov ecx, 0x5fa8c0
call fcn.004de920
test eax, eax
jne 0x4de583
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
cmp dword [ebp - 0x74], 5
jl 0x4de581
jmp 0x4de583
jmp 0x4de557
push 0
push 0
push 0x806b
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 0
push 0
push 0x806a
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5fa8c0
call fcn.004dbba0
mov ecx, 0x5fab20
call fcn.004ddf30
xor eax, eax
jmp 0x4de862
push str._start
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de676
mov ecx, 0x5fab20
call fcn.004dd9d0
push 0
mov ecx, 0x5fa8c0
call fcn.004db6b0
mov dword [ebp - 0x78], 0
mov ecx, 0x5fa8c0
call fcn.004de920
test eax, eax
jne 0x4de63b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], 5
jl 0x4de639
jmp 0x4de63b
jmp 0x4de60f
push 0
push 0
push 0x806a
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5fa8c0
call fcn.004dbba0
mov ecx, 0x5fab20
call fcn.004ddf30
xor eax, eax
jmp 0x4de862
push str._stop
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de719
mov ecx, 0x5fab20
call fcn.004dd9d0
push 0
mov ecx, 0x5fa8c0
call fcn.004db6b0
mov dword [ebp - 0x7c], 0
mov ecx, 0x5fa8c0
call fcn.004de920
test eax, eax
jne 0x4de6de
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
cmp dword [ebp - 0x7c], 5
jl 0x4de6dc
jmp 0x4de6de
jmp 0x4de6b2
push 0
push 0
push 0x806b
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5fa8c0
call fcn.004dbba0
mov ecx, 0x5fab20
call fcn.004ddf30
xor eax, eax
jmp 0x4de862
push str._update
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de7bc
mov ecx, 0x5fab20
call fcn.004dd9d0
push 0
mov ecx, 0x5fa8c0
call fcn.004db6b0
mov dword [ebp - 0x80], 0
mov ecx, 0x5fa8c0
call fcn.004de920
test eax, eax
jne 0x4de781
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x80]
add edx, 1
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 5
jl 0x4de77f
jmp 0x4de781
jmp 0x4de755
push 0
push 0
push 0x807b
push 0
mov ecx, 0x5fa8c0
call fcn.004dbc80
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x5fa8c0
call fcn.004dbba0
mov ecx, 0x5fab20
call fcn.004ddf30
xor eax, eax
jmp 0x4de862
mov ecx, 0x5fa8c0
call fcn.0043ce70
push str._service
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x48]
push ecx
call fcn.00527f0e
add esp, 8
test eax, eax
jne 0x4de7ef
call fcn.0043cca0
call fcn.0049f200
xor eax, eax
jmp 0x4de862
lea edx, [ebp - 0x3c]
push edx
push str.32770
call fcn.0043aa20
push eax
call dword [sym.imp.USER32.dll_GetClassInfoW]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax + 0x50]
mov dword [ebp - 0x18], ecx
lea edx, [ebp - 0x3c]
push edx
call fcn.004e6184
lea ecx, [ebp - 0x64]
call fcn.004f8ea1
mov dword [ebp - 4], 0
lea eax, [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x88]
call fcn.004f83ab
mov ecx, dword [ebp - 0x60]
push ecx
call fcn.00485b50
add esp, 4
mov dword [ebp - 0x84], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.004f8ee5
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret