Function at 0x45dc90
Capabilities:
Check if file exists
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528ee6
mov eax, dword fs:[0]
push eax
sub esp, 0x83c
mov eax, dword [0x576644]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x1c], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x18], 0x45c980
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call fcn.0045ef40
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
push 1
call fcn.0045c7e0
mov ecx, edi
call fcn.0045e4c0
mov ecx, edi
call fcn.0045c570
push 0x5416cc
call fcn.00455860
mov eax, dword [edi + 8]
lea ebx, [edi + 8]
add esp, 4
push dword [eax - 0xc]
push eax
call fcn.0044a5d0
mov ecx, eax
call fcn.0044a5b0
mov ecx, eax
call fcn.00456f40
mov eax, dword [ebx]
push dword [eax - 0xc]
push eax
call fcn.0044a5d0
mov ecx, eax
call fcn.0044a5b0
mov ecx, eax
call fcn.00457770
mov eax, dword [ebx]
push ecx
sub eax, 0x10
mov esi, esp
push eax
mov dword [ebp - 0x834], esi
call fcn.0040d1f0
add esp, 4
lea ecx, [edi + 0xac]
add eax, 0x10
mov dword [esi], eax
call fcn.004624a0
push dword [ebx]
call fcn.004643c0
push dword [ebx]
call fcn.0044ad20
add esp, 8
mov ecx, edi
push 4
call fcn.0045c7e0
push str.start_close_all_processes
call fcn.00455860
add esp, 4
push ebx
call fcn.0044a5d0
mov ecx, eax
call fcn.0044a5b0
push eax
call fcn.00462520
add esp, 8
mov ecx, edi
push 5
call fcn.0045c7e0
lea ecx, [ebp - 0x829]
call fcn.0045b880
mov dword [ebp - 0x840], eax
mov ecx, dword [ebx]
mov dword [ebp - 4], 1
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x45ddee
mov edx, dword [ecx]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x45de04
call fcn.0040d510
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x45e3c8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 0x844], 1
lea esi, [eax + 0x10]
mov eax, dword [ebp - 0x840]
mov dword [ebp - 0x830], esi
test eax, eax
jne 0x45de2a
xor ebx, ebx
jmp 0x45de3f
mov ebx, eax
lea ecx, [ebx + 2]
nop
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x45de30
sub ebx, ecx
sar ebx, 1
mov eax, dword [edi + 8]
mov dword [ebp - 0x848], eax
mov edi, dword [eax - 0xc]
mov dword [ebp - 0x834], edi
lea edx, [ebx + edi]
test edx, edx
js 0x45e3d2
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x45de7f
push edx
lea ecx, [ebp - 0x830]
call fcn.0040e200
mov esi, dword [ebp - 0x830]
add edi, edi
push edi
push dword [ebp - 0x848]
push edi
push esi
call fcn.0045ea20
mov ecx, dword [ebp - 0x840]
lea eax, [ebx + ebx]
push eax
push ecx
push eax
lea eax, [edi + esi]
push eax
call fcn.0045ea20
mov eax, dword [ebp - 0x834]
add esp, 0x20
add eax, ebx
cmp eax, dword [esi - 8]
jg 0x45e3d2
push 1
push 0x537e58
xor ecx, ecx
mov dword [esi - 0xc], eax
push str.Uninst
push esi
mov word [esi + eax*2], cx
call fcn.0044b600
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x45def5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push str.remove_desktop_shortcuts
call fcn.00455860
mov ebx, dword [ebp - 0x838]
add esp, 4
mov ecx, ebx
call fcn.0045d400
push 6
mov ecx, ebx
call fcn.0045c7e0
push str.remove_start_menu_shortcuts
call fcn.00455860
add esp, 4
mov ecx, ebx
call fcn.0045d7d0
push 0x800
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004ca680
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x828]
add esp, 0xc
push 1
push 0x1c
push eax
push 0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x828]
push str.halowpcef_cache
push eax
push eax
call edi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45df8c
lea eax, [ebp - 0x828]
push eax
call fcn.00450000
add esp, 4
push 0x800
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004ca680
add esp, 0xc
lea eax, [ebp - 0x828]
push 1
push 0x1a
push eax
push 0
call esi
push 0x538a04
lea eax, [ebp - 0x828]
push eax
push eax
call edi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45dfe0
lea eax, [ebp - 0x828]
push eax
call fcn.00450000
add esp, 4
push str.remove_cef_cache
call fcn.00455860
add esp, 4
cmp dword [ebx + 0x80], 0
je 0x45e054
push str.remove_appdata
call fcn.00455860
push 0x800
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004ca680
add esp, 0x10
lea eax, [ebp - 0x828]
push 1
push 0x1c
push eax
push 0
call esi
push 0x538a04
lea eax, [ebp - 0x828]
push eax
push eax
call edi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45e054
lea eax, [ebp - 0x828]
push eax
call fcn.00450000
add esp, 4
push 7
mov ecx, ebx
call fcn.0045c7e0
push str.remove_file_by_registry
call fcn.00455860
lea edi, [ebx + 0xc]
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe_file_list
push dword [ebx + 8]
call fcn.0044b790
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe_file_pe
push dword [ebx + 8]
call fcn.0044b790
push str.remove_registry
call fcn.00455860
add esp, 0x20
call fcn.0044a5d0
mov ecx, eax
call fcn.0044a5b0
mov esi, eax
push esi
mov ecx, dword [esi]
call dword [ecx + 0x14]
push 0x800
mov dword [ebp - 0x838], eax
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.004ca680
mov ecx, dword [esi]
lea eax, [ebp - 0x828]
add esp, 0xc
push 0x400
push eax
push esi
call dword [ecx + 0x18]
cmp word [ebp - 0x828], 0
je 0x45e118
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x838]
call esi
push str.SoftwareHaloWallPaper
push SysReAllocString
call esi
push str.SoftwareHaloWP
push SysReAllocString
call esi
push str.HaloWallpaper
push SysReAllocString
call esi
push 8
mov ecx, ebx
call fcn.0045c7e0
push str.remove_autorun
call fcn.00455860
add esp, 4
mov ecx, ebx
call fcn.0045d220
push 9
mov ecx, ebx
call fcn.0045c7e0
mov ecx, ebx
call fcn.0045bd30
mov ecx, ebx
call fcn.0045e4c0
push ecx
lea ecx, [ebp - 0x829]
mov esi, esp
call fcn.0045b7a0
push eax
mov ecx, esi
call fcn.00411080
lea ecx, [ebp - 0x830]
call fcn.00462890
lea ecx, [ebp - 0x830]
mov dword [ebp - 4], 2
call fcn.00463050
lea ecx, [ebp - 0x830]
call fcn.00463070
test eax, eax
jne 0x45e1a2
lea ecx, [ebp - 0x829]
call fcn.0045b960
push eax
call fcn.00455860
add esp, 4
lea ecx, [ebp - 0x830]
mov dword [ebp - 4], 0xffffffff
call fcn.00462910
push dword [ebx + 8]
push str.start_delete_all_files_in__s
call fcn.00455860
add esp, 8
mov ecx, ebx
push dword [ebx + 8]
call fcn.0045ce10
push dword [ebx + 8]
push str.end_delete_all_files_in__s
call fcn.00455860
add esp, 8
call fcn.0044b950
lea ecx, [ebp - 0x829]
call fcn.0045bc00
push eax
call fcn.00455860
add esp, 4
mov ecx, ebx
push 0x61
call fcn.0045c7e0
push ecx
lea ecx, [ebp - 0x829]
mov esi, esp
call fcn.0045bb20
push eax
mov ecx, esi
call fcn.00411080
lea ecx, [ebp - 0x830]
call fcn.00462890
lea ecx, [ebp - 0x830]
mov dword [ebp - 4], 3
call fcn.00463050
lea ecx, [ebp - 0x830]
call fcn.00463070
lea ecx, [ebp - 0x830]
mov dword [ebp - 4], 0xffffffff
call fcn.00462910
push str..tmp
push dword [ebx + 8]
call fcn.0044fca0
add esp, 8
mov ecx, ebx
push 0x62
call fcn.0045c7e0
push str.start_create_runonce_bat
call fcn.00455860
push dword [ebx + 8]
push edi
call fcn.0044dcb0
add esp, 0xc
mov ecx, ebx
push 0x64
call fcn.0045c7e0
mov dword [ebp - 0x1c], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x18], 0x45c950
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 4
push eax
call fcn.0045ef40
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
push 0x541bd8
call fcn.00418250
mov eax, dword [ebx + 0xa4]
push ecx
sub eax, 0x10
mov dword [ebp - 0x838], esp
mov esi, esp
mov dword [ebp - 4], 5
push eax
mov dword [ebp - 0x834], esi
call fcn.0040d1f0
add eax, 0x10
mov dword [esi], eax
mov eax, dword [ebx + 0xa8]
mov esi, esp
sub eax, 0x10
mov byte [ebp - 4], 6
push eax
mov dword [ebp - 0x834], esi
call fcn.0040d1f0
add eax, 0x10
add esp, 4
mov dword [esi], eax
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 5
push eax
call fcn.00463550
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
mov esi, eax
cmp edx, 0x10
jb 0x45e35a
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x45e350
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x45e3dc
push edx
push ecx
call fcn.004a7285
add esp, 8
push esi
push 0x541bdc
call fcn.00455860
lea esi, [ebx + 0x84]
mov dword [ebp - method._BaseModule::CAutoLocker.virtual_0], vtable._BaseModule::CAutoLocker.0
add esp, 8
mov dword [ebp - 0x838], esi
test esi, esi
je 0x45e387
mov eax, dword [esi]
push esi
call dword [eax]
mov ecx, dword [ebx + 0x18]
mov dword [ebp - 4], 7
test ecx, ecx
je 0x45e39b
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov dword [ebp - 4], 8
test esi, esi
je 0x45e3ac
mov eax, dword [esi]
push esi
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7695
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00409d40
push 0x80070057
call fcn.00409d40
call fcn.004d5d48
int3