Function at 0x413180
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452916
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x468744]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], ebx
mov word [ebp - 0xa34], ax
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4131e1
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0xa34]
call fcn.00406580
push 0xa
mov eax, str.Uninstall
mov ecx, esi
call fcn.00403640
cmp dword [ebp - 0xa20], 8
mov eax, dword [ebp - 0xa34]
jae 0x41321d
mov eax, esi
lea ecx, [ebp - 0xa60]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0xa5c]
push edx
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa60]
push 0
push 0
lea ecx, [ebp - 0xa68]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
mov dword [ebp - 0xa68], 0x104
mov dword [ebp - 0xa5c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x413395
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0x218]
shr ecx, 1
xor edx, edx
push str.Folder
push eax
mov word [ebp + ecx*2 - 0xa18], dx
call fcn.0043a898
add esp, 8
test eax, eax
je 0x4132f4
lea ecx, [ebp - 0xa18]
push 0x458764
push ecx
call fcn.0043a898
add esp, 8
test eax, eax
je 0x4132d9
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413590
jmp 0x4132f4
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_Folder:__s
push 0x4699d4
xor eax, eax
call fcn.0042d020
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a898
add esp, 8
test eax, eax
je 0x413353
lea ecx, [ebp - 0xa18]
push 0x458764
push ecx
call fcn.0043a898
add esp, 8
test eax, eax
je 0x413338
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413590
jmp 0x413353
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_File:__s
push 0x4699d4
xor eax, eax
call fcn.0042d020
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a898
add esp, 8
test eax, eax
jne 0x413395
lea ecx, [ebp - 0x218]
push str.Folder
push ecx
call fcn.0043a898
add esp, 8
test eax, eax
jne 0x413395
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.00413590
inc ebx
test esi, esi
je 0x413237
mov edx, dword [ebp - 0xa60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, edi
call fcn.00421c10
push str.dump
call fcn.00402130
test eax, eax
je 0x4133da
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, edi
call fcn.0041f140
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0xa58], esi
cmp esi, eax
je 0x413517
jmp 0x4133f6
mov esi, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa50]
add esi, 8
push ecx
mov edx, 0x4586b8
mov ecx, esi
call fcn.00410fc0
mov ebx, dword [eax + 0x10]
mov ecx, ebx
cmp ecx, ebx
jae 0x413415
mov edx, ebx
cmp ebx, 6
jb 0x413421
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x41342b
mov ecx, dword [eax]
jmp 0x41342d
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x41344d
mov di, word [ecx]
cmp di, word [eax]
jne 0x413457
add ecx, 2
add eax, 2
dec edx
jne 0x413436
mov edi, dword [ebp - 0xa54]
cmp ebx, 6
jae 0x413467
or eax, 0xffffffff
jmp 0x41346f
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x413447
mov edi, dword [ebp - 0xa54]
jmp 0x41346f
xor eax, eax
cmp ebx, 6
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa3c], 8
mov byte [edi + 0x41], al
jb 0x413493
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.00439b10
add esp, 4
mov eax, dword [esi]
dec eax
cmp eax, 0xb
ja case.0x41349b.3
jmp dword [eax*4 + 0x413560]
push edi
mov ecx, esi
call fcn.0041c550
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041c980
jmp case.0x41349b.3
mov ecx, esi
call fcn.0041cbd0
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041d190
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041d490
jmp case.0x41349b.3
mov ecx, esi
mov ebx, edi
call fcn.0041d9d0
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041db50
jmp case.0x41349b.3
call fcn.0041a910
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041de80
jmp case.0x41349b.3
push edi
mov ecx, esi
call fcn.0041df40
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
cmp eax, dword [edi]
jne 0x4133f0
mov eax, dword [ebp - 0xa64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0xa20], 8
jb 0x413541
mov ecx, dword [ebp - 0xa34]
push ecx
call fcn.00439b10
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438786
mov esp, ebp
pop ebp
ret