Function at 0x49cee0
Capabilities:
Delete registry key
Delete registry value
Get installed programs
Link many functions at runtime
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e2d3
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ecx
lea eax, [ebp - 0x640]
mov dword [ebp - 4], ecx
push eax
push 0x2001f
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
mov dword [ebp - 0x640], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49cfa5
mov eax, dword [ebp - 0x640]
lea ecx, [ebp - 0x634]
push edi
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x630], ebx
call fcn.004349b0
push 0x5b4370
lea ecx, [ebp - 0x634]
call fcn.004349b0
mov ebx, dword [ebp - 0x634]
test ebx, ebx
je 0x49cf9b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
cmp dword [ebp + 8], 0
je 0x49d83e
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x49da0c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x63c], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x49d003
test esi, 0xffff0000
jne 0x49cfed
movzx eax, si
lea ecx, [ebp - 0x63c]
push eax
call fcn.00426130
jmp 0x49d012
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49cff2
sub ecx, edx
sar ecx, 1
jmp 0x49d005
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x63c]
call fcn.004263f0
push 1
push 0x5b14ac
lea ecx, [ebp - 0x63c]
mov byte [ebp - 4], 2
call fcn.00425dc0
test edi, edi
jne 0x49d030
xor ecx, ecx
jmp 0x49d044
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d035
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x63c]
call fcn.00425dc0
mov esi, dword [ebp - 0x62c]
mov edi, dword [ebp - 0x63c]
mov dword [ebp - 0x638], 0
test esi, esi
je 0x49d0bf
cmp dword [esi], 0
je 0x49d0b2
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49d086
mov eax, 1
jmp 0x49d0da
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d0b8
push 0
push dword [esi]
lea ecx, [ebp - 0x638]
push ecx
push 0x2001f
push 0
push edi
push 0x80000001
call eax
jmp 0x49d0da
cmp dword [esi + 4], 0
jne 0x49d0bf
mov eax, 1
jmp 0x49d0da
lea eax, [ebp - 0x638]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push edi
push 0x80000001
call eax
test eax, eax
jne 0x49d7de
test ebx, ebx
je 0x49d0ed
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x638]
mov ebx, esi
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x49d7de
push eax
push eax
push eax
push eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x640], eax
lea eax, [ebp - 0x640]
push eax
push 0
push 0
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
xor ebx, ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x628], ebx
cmp dword [ebp - 0x660], ebx
jbe 0x49d2e2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00540d70
add esp, 0xc
mov dword [ebp - 0x644], 0x104
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x49d2cf
lea eax, [ebp - 0x218]
push str.usercenter
push eax
call fcn.0054b581
add esp, 8
test eax, eax
je 0x49d2cf
lea eax, [ebp - 0x218]
push 0x5c957c
push eax
call fcn.0054b581
add esp, 8
test eax, eax
je 0x49d2cf
call fcn.00421b80
test eax, eax
je 0x49da0c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x49d234
movzx eax, ax
lea ecx, [ebp - 0x624]
push eax
call fcn.00426130
jmp 0x49d262
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d240
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x624]
call fcn.004263f0
mov ebx, dword [ebp - 0x658]
mov esi, dword [ebp - 0x624]
mov byte [ebp - 4], 5
cmp ebx, dword [ebp - 0x654]
je 0x49d294
lea eax, [esi - 0x10]
push eax
call fcn.00425f70
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x658], 4
jmp 0x49d2a7
lea eax, [ebp - 0x624]
push eax
push ebx
lea ecx, [ebp - 0x65c]
call fcn.004257d0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x49d2c3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x638]
mov ebx, dword [ebp - 0x628]
inc ebx
mov dword [ebp - 0x628], ebx
cmp ebx, dword [ebp - 0x660]
jb 0x49d172
xor ebx, ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
xor esi, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x628], esi
cmp dword [ebp - 0x640], esi
jbe 0x49d445
mov edi, edi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00540d70
add esp, 0xc
mov dword [ebp - 0x644], 0x104
lea eax, [ebp - 0x644]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x638]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x49d42c
call fcn.00421b80
test eax, eax
je 0x49da0c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x49d39a
movzx eax, ax
lea ecx, [ebp - 0x624]
push eax
call fcn.00426130
jmp 0x49d3c5
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x49d3a3
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x624]
call fcn.004263f0
mov ebx, dword [ebp - 0x64c]
mov esi, dword [ebp - 0x624]
mov byte [ebp - 4], 8
cmp ebx, dword [ebp - 0x648]
je 0x49d3f7
lea eax, [esi - 0x10]
push eax
call fcn.00425f70
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x64c], 4
jmp 0x49d40a
lea eax, [ebp - 0x624]
push eax
push ebx
lea ecx, [ebp - 0x650]
call fcn.004257d0
mov byte [ebp - 4], 6
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x49d426
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x628]
inc esi
mov dword [ebp - 0x628], esi
cmp esi, dword [ebp - 0x640]
jb 0x49d310
mov ebx, dword [ebp - 0x650]
mov esi, dword [ebp - 0x65c]
cmp esi, dword [ebp - 0x658]
je 0x49d5f4
mov edi, dword [ebp - 0x638]
lea ecx, [ecx]
mov eax, dword [esi]
lea ecx, [ebp - 0x644]
push ecx
push 0x2001f
push 0
push eax
push edi
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x644], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d5cf
mov ebx, dword [ebp - 0x644]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x628]
mov dword [ebp - 0x66c], ebx
push eax
lea eax, [ebp - 0x620]
mov dword [ebp - 0x628], 0x100
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x49d542
jmp 0x49d4f0
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x66c]
call fcn.004349b0
test eax, eax
jne 0x49d59a
mov ebx, dword [ebp - 0x66c]
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x628]
mov dword [ebp - 0x628], 0x100
push eax
lea eax, [ebp - 0x620]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x49d4f0
test ebx, ebx
je 0x49d54f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov eax, dword [ebp - 0x62c]
test eax, eax
je 0x49d775
cmp dword [eax], 0
je 0x49d5a7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49d5ba
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d5ba
mov ecx, dword [ebp - 0x62c]
push 0
push dword [ecx]
push 0
push 0
push dword [ebp - 0x624]
push edi
call eax
jmp 0x49d5ba
mov eax, dword [ebp - 0x66c]
test eax, eax
je 0x49d5cf
push eax
jmp 0x49d5bf
cmp dword [eax + 4], 0
je 0x49d5ba
push dword [ebp - 0x624]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test ebx, ebx
je 0x49d5cf
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x66c], 0
add esi, 4
mov dword [ebp - 0x668], 0
cmp esi, dword [ebp - 0x658]
jne 0x49d460
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
cmp ebx, dword [ebp - 0x64c]
je 0x49d624
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [ebp - 0x638]
push dword [ebx]
push edi
call esi
add ebx, 4
cmp ebx, dword [ebp - 0x64c]
jne 0x49d608
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x638]
test eax, eax
je 0x49d643
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov ebx, dword [ebp - 0x650]
mov dword [ebp - 0x630], 0
mov byte [ebp - 4], 3
test ebx, ebx
je 0x49d6ea
mov esi, dword [ebp - 0x64c]
cmp ebx, esi
je 0x49d692
or edi, 0xffffffff
mov edx, dword [ebx]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49d67f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 4
cmp ebx, esi
jne 0x49d666
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x648]
sub eax, ebx
sar eax, 2
lea ecx, [eax*4]
mov eax, ebx
cmp ecx, 0x1000
jb 0x49d6c2
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49da16
push ecx
push ebx
call fcn.0053d0af
add esp, 8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov esi, dword [ebp - 0x65c]
mov byte [ebp - 4], 2
test esi, esi
je 0x49d7de
mov ebx, dword [ebp - 0x658]
cmp esi, ebx
je 0x49d736
or edi, 0xffffffff
lea esp, [esp]
mov edx, dword [esi]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49d729
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, ebx
jne 0x49d710
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x654]
mov esi, dword [ebp - 0x65c]
sub eax, esi
sar eax, 2
lea ecx, [eax*4]
mov eax, esi
cmp ecx, 0x1000
jb 0x49d7d4
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x49da16
jmp 0x49d7d4
cmp byte [0x62998c], 0
jne 0x49d7b5
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49d7a7
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x629988], eax
mov byte [0x62998c], 1
jmp 0x49d7ba
mov eax, dword [0x629988]
mov byte [0x62998c], 1
jmp 0x49d7ba
mov eax, dword [0x629988]
test eax, eax
je 0x49d5ad
push 0
push 0
push dword [ebp - 0x624]
push edi
call eax
jmp 0x49d5ba
push ecx
push esi
call fcn.0053d0af
add esp, 8
mov byte [ebp - 4], 0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x49d7fa
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x634]
mov esi, dword [ebp - 0x62c]
mov dword [ebp - 0x624], 0
test esi, esi
je 0x49d96d
cmp dword [esi], 0
je 0x49d960
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49d930
mov eax, 1
jmp 0x49d98b
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x624], 0
test eax, eax
je 0x49d8b3
cmp dword [eax], 0
je 0x49d8a6
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x49d874
mov eax, 1
jmp 0x49d8cd
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d8ac
mov ecx, dword [ebp - 0x62c]
push 0
push dword [ecx]
lea ecx, [ebp - 0x624]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x49d8cd
cmp dword [eax + 4], 0
jne 0x49d8b3
mov eax, 1
jmp 0x49d8cd
lea eax, [ebp - 0x624]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d7fa
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x49d8e2
push ebx
call esi
mov ebx, dword [ebp - 0x624]
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x49d800
push edi
lea ecx, [ebp - 0x634]
call fcn.004349b0
mov ebx, dword [ebp - 0x634]
test ebx, ebx
je 0x49d921
push ebx
call esi
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
jmp 0x49d800
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x49d966
push 0
push dword [esi]
lea ecx, [ebp - 0x624]
push ecx
push 0x2001f
push 0
push str.SOFTWAREClasses
push 0x80000001
call eax
jmp 0x49d98b
cmp dword [esi + 4], 0
jne 0x49d96d
mov eax, 1
jmp 0x49d98b
lea eax, [ebp - 0x624]
push eax
push 0x2001f
push 0
push str.SOFTWAREClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x49d9e5
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x49d99c
push ebx
call esi
mov ebx, dword [ebp - 0x624]
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x49d9e5
push str.ksoqing
lea ecx, [ebp - 0x634]
call fcn.004349b0
push str.ksourl
lea ecx, [ebp - 0x634]
call fcn.004349b0
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x49d9f0
push eax
call esi
jmp 0x49d9f0
test ebx, ebx
je 0x49d9f0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
call fcn.0054b0c3
int3