Function at 0x424a46
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x7c
lea ebp, [esp - 4]
mov eax, dword [0x59d300]
xor eax, ebp
mov dword [ebp + 0x7c], eax
push 0x94
mov eax, 0x5274b5
call fcn.00506664
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0040dbda
cmp byte [eax], bl
jne 0x424ad0
lea eax, [ebp - 0xa0]
push eax
call fcn.0040d9e1
lea eax, [ebp - 0x98]
push str.CUnInstallerHelper::HandleUninstallRegistry
push eax
mov byte [ebp - 4], 1
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp + 0x60]
push eax
lea ecx, [ebp - 0xa0]
call fcn.0040bf31
lea edi, [ebp + 0x60]
mov byte [ebp - 4], 2
call fcn.0040ba4e
push ebx
push 1
mov esi, edi
call fcn.0040dac5
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], bl
call fcn.0040c22b
jmp 0x424be4
lea eax, [ebp - 0x98]
push eax
mov byte [ebp - 4], 3
call fcn.0040b935
mov byte [ebp - 4], 4
call fcn.0040dbda
lea ecx, [ebp + 0x60]
call fcn.0040b84b
mov byte [ebp - 4], 5
cmp dword [eax + 0x18], 8
jb 0x424b00
mov esi, dword [eax + 4]
jmp 0x424b03
lea esi, [eax + 4]
lea eax, [ebp - 0x98]
push 0x54331c
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push esi
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push 0x543314
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push str.CUnInstallerHelper::HandleUninstallRegistry
push eax
call fcn.0040c0a0
pop ecx
pop ecx
push ebx
push 1
lea esi, [ebp + 0x60]
mov byte [ebp - 4], 4
call fcn.0040dac5
lea eax, [ebp - 0x18]
push eax
call sub.log4cplusU.dll_public:_static_class_log4cplus::Logger___cdecl_log4cplus::Logger::getRoot_void_
pop ecx
mov esi, 0x2710
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call sub.log4cplusU.dll_public:_bool___thiscall_log4cplus::Logger::isEnabledFor_int_const
test al, al
je 0x424b97
lea eax, [ebp + 0x60]
push eax
lea ecx, [ebp - 0x98]
call fcn.0040b831
push 0x1d
push str..UnInstallerHelper.cpp
push eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call sub.log4cplusU.dll_public:_void___thiscall_log4cplus::Logger::forcedLog_int__class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___char_const___int_const
push ebx
push 1
lea esi, [ebp + 0x60]
call fcn.0040dac5
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call sub.log4cplusU.dll_public_virtual:_void___thiscall_log4cplus::Logger::destructor_void_
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 3
call fcn.0040b8a0
mov dword [ebp - 4], ebx
jmp 0x424be4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov ebx, 0x2001f
push edi
mov eax, ebx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xa
call fcn.0040e4e4
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.vProt
push dword [ebp - 0x18]
call esi
lea eax, [ebp + 0x88]
push eax
lea eax, [ebp + 0x44]
push str.Software_
push eax
call fcn.00429440
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [ebp + 0x5c], 8
mov eax, dword [ebp + 0x48]
jae 0x424c40
lea eax, [ebp + 0x48]
push eax
push SysReAllocString
mov eax, ebx
lea ecx, [ebp - 0x18]
call fcn.0040e4e4
mov ebx, dword [ebp - 0x18]
push str.DSPGuardMaxNum
push ebx
call esi
push str.DSPGuardMaxPopupNum
push ebx
call esi
push str.HPGuardMaxNum
push ebx
call esi
push str.HPGuardMaxPopupNum
push ebx
call esi
push str.HPGuardWhiteList
push ebx
call esi
push str.AVG_Security_Toolbar
lea esi, [ebp + 0x60]
call fcn.0040b812
push edi
mov eax, esi
push eax
lea eax, [ebp]
push eax
mov byte [ebp - 4], 0xc
call fcn.0040e8c0
xor edi, edi
push edi
push 1
mov byte [ebp - 4], 0xe
call fcn.0040dac5
lea eax, [ebp]
push eax
call fcn.00411561
lea ecx, [ebp]
call fcn.0040b7c8
push edi
push 1
lea esi, [ebp + 0x44]
call fcn.0040dac5
lea esi, [ebp - 0x18]
call fcn.0040e486
push edi
push 1
lea esi, [ebp + 0x88]
call fcn.0040dac5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7c]
xor ecx, ebp
call fcn.004ffa47
add ebp, 0x80
leave
ret