Function at 0x413100
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452a86
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], ebx
mov word [ebp - 0xa34], ax
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413161
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0xa34]
call fcn.004065b0
push 0xa
mov eax, str.Uninstall
mov ecx, esi
call fcn.00403690
cmp dword [ebp - 0xa20], 8
mov eax, dword [ebp - 0xa34]
jae 0x41319d
mov eax, esi
lea ecx, [ebp - 0xa60]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0xa5c]
push edx
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa60]
push 0
push 0
lea ecx, [ebp - 0xa68]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
mov dword [ebp - 0xa68], 0x104
mov dword [ebp - 0xa5c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x413315
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0x218]
shr ecx, 1
xor edx, edx
push str.Folder
push eax
mov word [ebp + ecx*2 - 0xa18], dx
call fcn.0043a458
add esp, 8
test eax, eax
je 0x413274
lea ecx, [ebp - 0xa18]
push 0x459684
push ecx
call fcn.0043a458
add esp, 8
test eax, eax
je 0x413259
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413510
jmp 0x413274
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_Folder:__s
push 0x46a9d4
xor eax, eax
call fcn.0042d150
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a458
add esp, 8
test eax, eax
je 0x4132d3
lea ecx, [ebp - 0xa18]
push 0x459684
push ecx
call fcn.0043a458
add esp, 8
test eax, eax
je 0x4132b8
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413510
jmp 0x4132d3
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_File:__s
push 0x46a9d4
xor eax, eax
call fcn.0042d150
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a458
add esp, 8
test eax, eax
jne 0x413315
lea ecx, [ebp - 0x218]
push str.Folder
push ecx
call fcn.0043a458
add esp, 8
test eax, eax
jne 0x413315
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413510
inc ebx
test esi, esi
je 0x4131b7
mov edx, dword [ebp - 0xa60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, edi
call fcn.004218d0
push str.dump
call fcn.00402130
test eax, eax
je 0x41335a
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, edi
call fcn.0041f100
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0xa58], esi
cmp esi, eax
je 0x413497
jmp 0x413376
mov esi, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa50]
add esi, 8
push ecx
mov edx, 0x4595d8
mov ecx, esi
call fcn.00410f80
mov ebx, dword [eax + 0x10]
mov ecx, ebx
cmp ecx, ebx
jae 0x413395
mov edx, ebx
cmp ebx, 6
jb 0x4133a1
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x4133ab
mov ecx, dword [eax]
jmp 0x4133ad
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x4133cd
mov di, word [ecx]
cmp di, word [eax]
jne 0x4133d7
add ecx, 2
add eax, 2
dec edx
jne 0x4133b6
mov edi, dword [ebp - 0xa54]
cmp ebx, 6
jae 0x4133e7
or eax, 0xffffffff
jmp 0x4133ef
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x4133c7
mov edi, dword [ebp - 0xa54]
jmp 0x4133ef
xor eax, eax
cmp ebx, 6
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa3c], 8
mov byte [edi + 0x41], al
jb 0x413413
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.004396db
add esp, 4
mov eax, dword [esi]
dec eax
cmp eax, 0xb
ja case.0x41341b.3
jmp dword [eax*4 + 0x4134e0]
push edi
mov ecx, esi
call fcn.0041c500
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041c930
jmp case.0x41341b.3
mov ecx, esi
call fcn.0041cb80
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041d140
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041d440
jmp case.0x41341b.3
mov ecx, esi
mov ebx, edi
call fcn.0041d980
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041db00
jmp case.0x41341b.3
call fcn.0041a8a0
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041de30
jmp case.0x41341b.3
push edi
mov ecx, esi
call fcn.0041def0
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
cmp eax, dword [edi]
jne 0x413370
mov eax, dword [ebp - 0xa64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0xa20], 8
jb 0x4134c1
mov ecx, dword [ebp - 0xa34]
push ecx
call fcn.004396db
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret