Function at 0x410030
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51dd20
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x55d184]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xf
xor eax, eax
mov dword [ebp - 0x18], 0
push 0x525e00
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00407300
push 6
push str.RunOne
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0040b840
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x30]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x410126
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
push 0
push 0x526554
push dword [ebp - 0x30]
call edi
test eax, eax
je 0x410107
push 0
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x52655c
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x410126
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x30]
call esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.00408700
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x41016c
push 0x525e00
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x41019d
push 0x525fe0
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call esi
call fcn.0040fc10
test eax, eax
je 0x4101af
mov edx, dword [eax]
mov ecx, eax
push 0
call dword [edx + 0xc]
lea eax, [ebp - 0x30]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x41023d
lea eax, [ebp - 0x2c]
push eax
push 0xf003f
push 0
push 0x526554
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x410238
push 0xf
push 0x525e00
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00407300
push 3
push 0x526560
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 1
call fcn.0040b840
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x28]
call fcn.00408700
push dword [ebp - 0x30]
call esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0
push eax
push 0xf013f
push 0
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], 0
call edi
test eax, eax
jne 0x41029e
push eax
lea eax, [ebp - 0x2c]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x525e00
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x410299
push str.AppInfo
push dword [ebp - 0x2c]
call ebx
push dword [ebp - 0x2c]
call esi
push dword [ebp - 0x30]
call esi
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.gdiplus.dll_Ordinal_1
mov dword [ebp - 0x34], 0
call edi
test eax, eax
jne 0x410327
push eax
lea eax, [ebp - 0x34]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x525e00
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x410322
push str.AppSetting
push dword [ebp - 0x34]
call ebx
push str.Setting
push dword [ebp - 0x34]
call ebx
push str.FileMD5
push dword [ebp - 0x34]
call ebx
push str.DownLoadFile
push dword [ebp - 0x34]
call ebx
push str.OpenStatic
push dword [ebp - 0x34]
call ebx
push dword [ebp - 0x34]
call esi
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049be04
mov esp, ebp
pop ebp
ret