Function at 0x434b30
Capabilities:
Check if file exists
Delete registry key
Get common file path
Link many functions at runtime
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51023e
mov eax, dword fs:[0]
push eax
mov eax, 0x1b4c
call fcn.0046dd30
mov eax, dword [0x55e3d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x318]
push 0x208
push 0
push eax
mov dword [ebp - 0x1b54], edi
call fcn.00497960
add esp, 0xc
lea eax, [ebp - 0x318]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.netul.dll
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00433ee0
mov esi, eax
cmp dword [esi], 0
jne 0x434c2d
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x434c2d
push str.HttpInit
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpUninit
push dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.zlib_uncompress
push dword [esi]
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.zlib_compress
push dword [esi]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.zlib_compressBound
push dword [esi]
mov dword [esi + 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x434c2d
call eax
mov dword [esi + 0xc], eax
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1330], 0x434120
mov dword [ebp - 0x132c], edi
lea eax, [ebp - 0x1334]
mov dword [ebp - 4], 0
push eax
call fcn.00435cd0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
push 1
call fcn.00434000
push 0x526b90
call fcn.0042dcb0
mov eax, dword [edi + 8]
lea esi, [edi + 8]
add esp, 4
mov dword [ebp - 0x1b58], esi
push dword [eax - 0xc]
push eax
call fcn.0042c600
mov ecx, eax
call fcn.0042c5e0
mov ecx, eax
call fcn.0042f300
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.0042c600
mov ecx, eax
call fcn.0042c5e0
mov ecx, eax
call fcn.0042fb10
push dword [esi]
call fcn.00439d40
add esp, 4
mov ecx, edi
push 4
call fcn.00434000
push str.start_close_all_processes
call fcn.0042dcb0
add esp, 4
push esi
call fcn.0042c600
mov ecx, eax
call fcn.0042c5e0
push eax
call fcn.0043da40
add esp, 8
mov ecx, edi
push 5
call fcn.00434000
push 0x210
lea eax, [ebp - 0x1548]
push 0
push eax
call fcn.00497960
add esp, 0xc
lea eax, [ebp - 0x1548]
push str..utilscleancore.dll
push dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1548]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x434d44
push str.DeleteEntry
push eax
call esi
test eax, eax
je 0x434d44
call eax
cmp dword [0x55d028], 0
je 0x434e0c
push 0x522004
mov dword [ebp - 0x1b4c], 0
mov dword [ebp - 0x1b44], 0
mov dword [ebp - 0x1b48], 0
mov dword [ebp - 0x1b50], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1b40], eax
test eax, eax
je 0x434e02
push str.RtlGetNtVersionNumbers
push eax
call esi
test eax, eax
je 0x434dc8
lea ecx, [ebp - 0x1b48]
push ecx
lea ecx, [ebp - 0x1b44]
push ecx
lea ecx, [ebp - 0x1b4c]
push ecx
call eax
movzx eax, word [ebp - 0x1b48]
mov dword [ebp - 0x1b48], eax
mov dword [ebp - 0x1b50], 1
push dword [ebp - 0x1b40]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x1b50], 0
je 0x434e02
mov eax, dword [ebp - 0x1b4c]
cmp eax, 6
jne 0x434df3
cmp dword [ebp - 0x1b44], 4
je 0x434df8
jmp 0x434e02
cmp eax, 0xa
jb 0x434e02
mov dword [0x5618a8], 1
mov dword [0x55d028], 0
cmp dword [0x5618a8], 0
jne 0x434e1a
call fcn.0043c5b0
push str.SysCleanerSvc
call fcn.004400d0
push str.SysCleanerSvc
call fcn.0043fd20
push 0x210
lea eax, [ebp - 0x1548]
push 0
push eax
call fcn.00497960
add esp, 0x14
lea eax, [ebp - 0x1548]
push str.srvhost.exe
push dword [edi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1548]
push str.SysCleaner
push eax
call fcn.00478f90
push str.remove_desktop_shortcuts
call fcn.0042dcb0
add esp, 8
mov esi, esp
mov dword [ebp - 0x1b40], esi
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x4355e3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
push 0x526c8c
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.00410410
test al, al
jne 0x434ebf
push 0xa
push 0x526c8c
mov ecx, esi
call fcn.00411620
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004346b0
push ecx
mov esi, esp
mov dword [ebp - 0x1b40], esi
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x4355ed
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
push 0x526ca4
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00410410
test al, al
jne 0x434f16
push 0xb
push 0x526ca4
mov ecx, esi
call fcn.00411620
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004346b0
push 6
mov ecx, edi
call fcn.00434000
push str.remove_start_menu_shortcuts
call fcn.0042dcb0
mov esi, esp
mov dword [ebp - 0x1b40], esi
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x4355f7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
push 0x522484
mov ecx, esi
mov dword [ebp - 4], 3
call fcn.00410410
test al, al
jne 0x434f7f
push 6
push 0x522484
mov ecx, esi
call fcn.00411620
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004349c0
push ecx
mov esi, esp
mov dword [ebp - 0x1b40], esi
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x435601
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
push 0x526cf4
mov ecx, esi
mov dword [ebp - 4], 4
call fcn.00410410
test al, al
jne 0x434fd6
push 7
push 0x526cf4
mov ecx, esi
call fcn.00411620
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.004349c0
push str.remove_appdata
call fcn.0042dcb0
push 0x800
lea eax, [ebp - 0x1b38]
push 0
push eax
call fcn.00497960
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1b38]
add esp, 0x10
push 1
push 0x1a
push eax
push 0
call esi
push str.SysCleaner
lea eax, [ebp - 0x1b38]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1b38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43504c
lea eax, [ebp - 0x1b38]
push eax
call fcn.004392d0
add esp, 4
push 1
push 0x1c
lea eax, [ebp - 0x1b38]
push eax
push 0
call esi
push str.SysCleaner
lea eax, [ebp - 0x1b38]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1b38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43508e
lea eax, [ebp - 0x1b38]
push eax
call fcn.004392d0
add esp, 4
push 7
mov ecx, edi
call fcn.00434000
push dword [edi + 8]
call fcn.0043f1a0
push str.remove_file_by_registry
call fcn.0042dcb0
lea eax, [edi + 0xc]
push eax
push str.SOFTWARESysCleaner_file_list
push dword [edi + 8]
call fcn.0043a760
lea eax, [edi + 0xc]
push eax
push str.SOFTWARESysCleaner_file_pe
push dword [edi + 8]
call fcn.0043a760
push str.remove_registry
call fcn.0042dcb0
push 0x208
lea eax, [ebp - 0x1540]
mov dword [ebp - 0x1b4c], 1
push 0
push eax
mov dword [ebp - 0x1b40], 0x104
call fcn.00497960
add esp, 0x30
lea eax, [ebp - 0x1b40]
push eax
lea eax, [ebp - 0x1540]
push eax
lea eax, [ebp - 0x1b4c]
push eax
push str.InstallDate
push str.SOFTWARESysCleaner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.SOFTWARESysCleaner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x1540]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435142
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x1540]
push eax
push 1
push str.InstallDate
push str.SOFTWARESysCleaner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x1338]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x1338], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x43560b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1b44], eax
movzx eax, word [ebp - 0x132c]
push eax
movzx eax, word [ebp - 0x132e]
push eax
movzx eax, word [ebp - 0x1330]
push eax
movzx eax, word [ebp - 0x1332]
push eax
movzx eax, word [ebp - 0x1336]
push eax
movzx eax, word [ebp - 0x1338]
push eax
lea eax, [ebp - 0x1b44]
mov dword [ebp - 4], 5
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.004120e0
mov esi, dword [ebp - 0x1b44]
add esp, 0x20
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.LastUninstallDate
push str.SOFTWARESysCleaner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SOFTWARESysCleaner
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x435247
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push 8
mov ecx, edi
call fcn.00434000
push str.remove_autorun
call fcn.0042dcb0
add esp, 4
lea ecx, [ebp - 0x1b39]
call fcn.0043e660
push dword [edi + 8]
lea ecx, [ebp - 0x1b39]
mov dword [ebp - 4], 6
call fcn.0043e850
push str.Delete_AutoRun
call fcn.0042dcb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b39]
call fcn.0043e670
push 9
mov ecx, edi
call fcn.00434000
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSysCleaner
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.0042dcb0
lea ecx, [ebp - 0x1b39]
mov esi, esp
call fcn.004335c0
push eax
mov ecx, esi
call fcn.00410100
lea ecx, [ebp - 0x1b48]
call fcn.004404b0
lea ecx, [ebp - 0x1b48]
mov dword [ebp - 4], 7
call fcn.00440d50
lea ecx, [ebp - 0x1b48]
call fcn.00440d70
lea ecx, [ebp - 0x1b48]
mov dword [ebp - 4], 0xffffffff
call fcn.00440530
push dword [edi + 8]
push str.start_delete_all_files_in__s
call fcn.0042dcb0
add esp, 8
mov ecx, edi
push dword [edi + 8]
call fcn.004341e0
push dword [edi + 8]
push str.end_delete_all_files_in__s
call fcn.0042dcb0
push str..tmp
push dword [edi + 8]
call fcn.00438f70
add esp, 0x10
mov ecx, edi
push 0x62
call fcn.00434000
push str.start_create_runonce_bat
call fcn.0042dcb0
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
call fcn.0043bdd0
add esp, 0xc
push dword [edi + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43558b
call fcn.0042c1d0
mov ecx, eax
test ecx, ecx
je 0x435615
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x1b44], esi
push 0x800
lea eax, [ebp - 0x1318]
mov dword [ebp - 4], 8
push 0
push eax
call fcn.00497960
push 0x800
lea eax, [ebp - 0xb18]
push 0
push eax
call fcn.00497960
add esp, 0x18
lea eax, [ebp - 0x1318]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xfe
lea eax, [ebp - 0x10e]
push 0
push eax
call fcn.00497960
add esp, 0xc
xor edi, edi
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x110], ax
lea eax, [ebp - 0x1328]
push eax
movups xmmword [ebp - 0x1328], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x1538]
push 0
push eax
call fcn.00497960
movzx eax, byte [ebp - 0x1319]
push eax
movzx eax, byte [ebp - 0x131a]
push eax
movzx eax, byte [ebp - 0x131b]
push eax
movzx eax, byte [ebp - 0x131c]
push eax
movzx eax, byte [ebp - 0x131d]
push eax
movzx eax, byte [ebp - 0x131e]
push eax
movzx eax, byte [ebp - 0x131f]
push eax
movzx eax, byte [ebp - 0x1320]
push eax
movzx eax, word [ebp - 0x1322]
push eax
movzx eax, word [ebp - 0x1324]
push eax
push dword [ebp - 0x1328]
lea eax, [ebp - 0x1538]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.00433280
lea ecx, [ebp - 0x1538]
add esp, 0x40
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435497
sub ecx, edx
lea eax, [ebp - 0x1538]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x110]
push 0x80
push eax
call fcn.004c0413
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x1318]
push eax
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str..tmp
lea eax, [ebp - 0xb18]
push 0x400
push eax
call fcn.004c54c6
add esp, 0xc
lea eax, [ebp - 0xb18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x435513
inc edi
cmp edi, 0xa
jl 0x4353f1
jmp 0x435548
lea ecx, [ebp - 0xb18]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435520
sub ecx, edx
lea eax, [ebp - 0xb18]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1b44]
call fcn.00411620
mov esi, dword [ebp - 0x1b44]
mov eax, dword [ebp - 0x1b58]
push 6
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.remove_directory
call fcn.0042dcb0
add esp, 4
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x435585
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1b54]
push 0x64
mov ecx, edi
call fcn.00434000
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1320], 0x4340f0
mov dword [ebp - 0x131c], edi
lea eax, [ebp - 0x1324]
mov dword [ebp - 4], 9
push eax
call fcn.00435cd0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046dd1a
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040aa30
push 0x80004005
call fcn.0040aa30
push 0x80004005
call fcn.0040aa30
push 0x80004005
call fcn.0040aa30
push 0x80004005
call fcn.0040aa30
push 0x80004005
call fcn.0040aa30
int3