Function at 0x4082d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e56d0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push edi
mov eax, dword [0x52038c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x44], 7
push eax
push 0x50d6e8
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], 0
mov word [ebp - 0x58], ax
call fcn.00404670
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push 0xf
xor eax, eax
mov dword [ebp - 0x2c], 7
push str.MultiWeChat.exe
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
call fcn.00404670
lea edx, [ebp - 0x58]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.0040f470
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x408368
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00404840
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
cmp eax, 8
jb 0x408398
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.00404840
mov ecx, edi
call fcn.004075c0
call fcn.00407ec0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsMultiWeChat.exe
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
sub esp, 0x18
lea edx, [edi + 0x4e0]
mov ecx, esp
mov dword [ebp - 0x10], esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4083ea
mov eax, dword [ecx]
jmp 0x4083ec
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.00403890
sub esp, 0x18
mov dword [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x14], esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x408420
mov eax, dword [ecx]
jmp 0x408422
mov eax, ecx
push 4
push str.done
mov byte [eax], 0
call fcn.004039c0
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x18], esp
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x408455
mov eax, dword [ecx]
jmp 0x408457
mov eax, ecx
push 6
push str.uninst
mov byte [eax], 0
call fcn.004039c0
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x1c], esp
lea edx, [edi + 0x498]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x408490
mov eax, dword [ecx]
jmp 0x408492
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.00403890
sub esp, 0x18
mov byte [ebp - 4], 5
mov ecx, esp
mov dword [ebp - 0x20], esp
lea edx, [edi + 0x4c8]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x4084c9
mov eax, dword [ecx]
jmp 0x4084cb
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.00403890
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
mov dword [ebp - 0x24], esp
lea edx, [edi + 0x4b0]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x408502
mov eax, dword [ecx]
jmp 0x408504
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.00403890
sub esp, 0x18
mov byte [ebp - 4], 7
mov ecx, esp
lea edx, [edi + 0x480]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 0x10
jb 0x408538
mov eax, dword [ecx]
jmp 0x40853a
mov eax, ecx
push 0xffffffffffffffff
push 0
push edx
mov byte [eax], 0
call fcn.00403890
mov dword [ebp - 4], 0xffffffff
call fcn.00408580
mov ecx, dword [edi + 0x474]
push 2
mov eax, dword [ecx]
call dword [eax + 0x200]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov esp, ebp
pop ebp
ret