Function at 0x412850
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x452d58
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x468744]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
push edi
mov eax, dword [0x468744]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
push 0x4563fc
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], ebx
mov byte [esp + 0x17], 0
call fcn.00402130
test eax, eax
setne al
mov byte [edi + 0x40], al
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4128b2
sub eax, edx
sar eax, 1
push eax
lea esi, [edi + 0x1c]
mov eax, ebx
call fcn.00406580
cmp byte [edi + 0x40], 0
jne 0x4128e4
cmp byte [edi + 0x42], 0
je 0x4128e4
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Filtering_components_per_group
push str.__s_
push 0x4699d4
xor eax, eax
call fcn.0042d020
inc dword [0x4699f4]
mov eax, dword [edi]
mov ecx, dword [eax]
add esp, 0xc
mov dword [esp + 0x14], ecx
cmp ecx, eax
je 0x412a7d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
add ecx, 8
mov edx, 0x458618
call fcn.00410fc0
mov dword [esp + 0x88], 0
mov edx, dword [esp + 0x50]
test edx, edx
je 0x412a48
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x40]
mov edi, ecx
cmp eax, 8
jae 0x4129d5
lea edi, [esp + 0x40]
mov ebx, edi
lea ebx, [ebx + edx*2]
mov esi, ecx
cmp eax, 8
jae 0x412967
lea esi, [esp + 0x40]
cmp esi, ebx
je 0x41298f
sub edi, esi
lea ecx, [ecx]
movzx eax, word [esi]
push eax
call fcn.0043cfe5
mov word [edi + esi], ax
add esi, 2
add esp, 4
cmp esi, ebx
jne 0x412970
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x40]
cmp eax, 8
jae 0x412998
lea ecx, [esp + 0x40]
mov edx, dword [esp + 0x18]
add edx, 0x44
push edx
call fcn.00411400
test al, al
jne 0x412a48
cmp dword [esp + 0x54], 8
mov esi, dword [esp + 0x40]
jae 0x4129bc
lea esi, [esp + 0x40]
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 8]
dec ecx
mov eax, 0x45842c
cmp ecx, 0xb
ja case.default.0x4129ce
jmp dword [ecx*4 + 0x412db0]
mov ebx, ecx
jmp 0x412959
mov eax, str.File
jmp case.default.0x4129ce
mov eax, str.Folder
jmp case.default.0x4129ce
mov eax, str.Shortcut
jmp case.default.0x4129ce
mov eax, str.Registry
jmp case.default.0x4129ce
mov eax, str.Service
jmp case.default.0x4129ce
mov eax, str.Process
jmp case.default.0x4129ce
mov eax, str.RegisterCOM
jmp case.default.0x4129ce
mov eax, 0x458440
jmp case.default.0x4129ce
mov eax, 0x458454
jmp case.default.0x4129ce
mov eax, str.Pause
jmp case.default.0x4129ce
mov eax, str.EnvVar
jmp case.default.0x4129ce
mov eax, str.Custom
mov ecx, dword [edx + 0x28]
push esi
push ecx
push eax
push str._s_at_line__d._Group___s
push 0x4699d4
xor eax, eax
call fcn.0042d020
add esp, 0x14
mov edx, dword [esp + 0x14]
mov esi, dword [edx]
mov dword [esp + 0x88], 0xffffffff
cmp dword [esp + 0x54], 8
mov dword [esp + 0x14], esi
jb 0x412a71
mov eax, dword [esp + 0x40]
push eax
call fcn.00439b10
add esp, 4
mov ecx, dword [esp + 0x18]
cmp esi, dword [ecx]
jne 0x412913
mov esi, dword [esp + 0x18]
dec dword [0x4699f4]
mov ecx, esi
call fcn.00412500
push str.Sorting_action_list_for_installation
push 0x4699d4
xor eax, eax
call fcn.0042d020
mov edx, dword [esp + 0x28]
add esp, 8
push edx
mov ecx, esi
call fcn.00421c10
push str.dump
call fcn.00402130
test eax, eax
je 0x412aee
mov ecx, str.dump
call fcn.00402200
push eax
push str.Dumping_action_list_to__s
push 0x4699d4
xor eax, eax
call fcn.0042d020
add esp, 0xc
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, esi
call fcn.0041f140
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
cmp ecx, eax
je 0x412d81
mov edi, edi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
add ecx, 8
push eax
mov edx, 0x458618
call fcn.00410fc0
mov dword [esp + 0x88], 1
mov edx, dword [esp + 0x34]
test edx, edx
je 0x412bb3
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x24]
cmp ecx, 8
jb 0x412b40
mov dword [esp + 0x1c], edi
jmp 0x412b48
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, edi
cmp ecx, 8
jae 0x412b53
lea eax, [esp + 0x24]
lea ebx, [eax + edx*2]
mov esi, edi
cmp ecx, 8
jae 0x412b61
lea esi, [esp + 0x24]
cmp esi, ebx
je 0x412b8f
mov edi, dword [esp + 0x1c]
sub edi, esi
jmp 0x412b70
movzx ecx, word [esi]
push ecx
call fcn.0043cfe5
mov word [esi + edi], ax
add esi, 2
add esp, 4
cmp esi, ebx
jne 0x412b70
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x24]
cmp ecx, 8
mov ecx, edi
jae 0x412b9a
lea ecx, [esp + 0x24]
mov edx, dword [esp + 0x18]
add edx, 0x44
push edx
call fcn.00411400
test al, al
jne 0x412bb3
mov eax, dword [esp + 0x14]
mov byte [eax + 0x20], 1
mov ecx, dword [esp + 0x14]
cmp byte [ecx + 0x20], 0
mov edi, dword [esp + 0x18]
jne 0x412d00
lea edx, [esp + 0x5c]
push edx
mov edx, 0x4586b8
add ecx, 8
mov dword [edi + 0x3c], 0
call fcn.00410fc0
mov esi, dword [eax + 0x10]
mov ecx, esi
cmp ecx, esi
jae 0x412be7
mov edx, esi
cmp esi, 6
jb 0x412bf3
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x412bfd
mov ecx, dword [eax]
jmp 0x412bff
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x412c23
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x412c1b
add ecx, 2
add eax, 2
dec edx
jne 0x412c08
jmp 0x412c23
sbb eax, eax
and eax, 0xfffffffe
inc eax
jne 0x412c35
cmp esi, 6
jae 0x412c2d
or eax, 0xffffffff
jmp 0x412c35
xor eax, eax
cmp esi, 6
setne al
test eax, eax
sete al
mov byte [esp + 0x88], 1
cmp dword [esp + 0x70], 8
mov byte [edi + 0x41], al
jb 0x412c59
mov edx, dword [esp + 0x5c]
push edx
call fcn.00439b10
add esp, 4
mov ecx, dword [esp + 0x14]
xor eax, eax
add ecx, 8
mov word [esp + 0x5c], ax
mov eax, dword [ecx]
dec eax
mov ebx, 7
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], 0
cmp eax, 0xb
ja case.default.0x412c80
jmp dword [eax*4 + 0x412de0]
push edi
call fcn.00413950
jmp 0x412ce9
push edi
call fcn.004143c0
jmp 0x412ce9
mov edx, ecx
mov ecx, edi
call fcn.00414e50
jmp 0x412ce9
push edi
call fcn.00415780
jmp 0x412ce9
push edi
call fcn.004167c0
jmp 0x412ce9
push edi
call fcn.00417390
jmp 0x412ce9
push edi
call fcn.00418310
jmp 0x412ce9
push edi
call fcn.00418880
jmp 0x412ce9
push edi
call fcn.00419630
jmp 0x412ce9
mov esi, ecx
call fcn.0041a910
jmp 0x412ce9
push edi
call fcn.00419e10
jmp 0x412ce9
push edi
call fcn.0041a270
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
jne 0x412cfa
cmp byte [edi + 0x41], 0
je 0x412d4b
mov byte [edi + 0x41], 0
jmp 0x412d05
mov ebx, 7
mov ecx, dword [esp + 0x14]
mov esi, dword [ecx]
mov dword [esp + 0x88], 0xffffffff
cmp dword [esp + 0x38], 8
mov dword [esp + 0x14], esi
jb 0x412d2e
mov edx, dword [esp + 0x24]
push edx
call fcn.00439b10
add esp, 4
xor eax, eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0
mov word [esp + 0x24], ax
cmp esi, dword [edi]
jne 0x412b00
jmp 0x412d7d
mov dword [esp + 0x88], 0xffffffff
cmp dword [esp + 0x38], 8
jb 0x412d6a
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00439b10
add esp, 4
xor edx, edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0
mov word [esp + 0x24], dx
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.00412e10
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00438786
mov esp, ebp
pop ebp
ret