Function at 0x405740
Capabilities:
Copy file
Delete file
Enumerate gui resources
Get common file path
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xf7c
mov eax, dword [0x433480]
xor eax, esp
mov dword [esp + 0xf78], eax
push edi
lea eax, [esp + 0xc]
xor edi, edi
push eax
push 0x20119
push edi
push str.softwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4057a6
push eax
push 0x20a
push str._ld_error_number:___ld_n
call fcn.00404f30
add esp, 0xc
lea eax, [edi + 1]
pop edi
mov ecx, dword [esp + 0xf78]
xor ecx, esp
call fcn.0040609c
add esp, 0xf7c
ret
push ebx
push ebp
push esi
xor esi, esi
mov dword [esp + 0x14], 0x208
lea eax, [esp + 0x38]
mov dword [esp + 0x28], esi
push eax
push esi
push esi
push esi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x770]
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x405d57
mov ebx, dword [esp + 0xf90]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 3
lea eax, [esp + 0x760]
push eax
push 0x427d24
call fcn.004127d0
add esp, 0xc
test eax, eax
jne 0x405d18
lea eax, [esp + 0x20]
push eax
push 0x20119
push 0
lea eax, [esp + 0x768]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405d8c
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x206
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.displayname
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x405d84
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x405892
lea eax, [esp + 0x24]
mov dword [esp + 0x24], 4
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.AllowSilent
push dword [esp + 0x34]
call edi
push str._n_n
mov dword [esp + 0x28], 1
call fcn.00404f30
push str.Vim_Install_found_what_looks_like_an_existing_Vim_version._n
call fcn.00404f30
push str.The_name_of_the_entry_is:_n
call fcn.00404f30
lea eax, [esp + 0x4c]
push eax
push str._n__________s__n_n
call fcn.00404f30
push str.Installing_the_new_version_will_disable_part_of_the_existing_version._n
call fcn.00404f30
push str._The_batch_files_used_in_a_console_and_the__Edit_with_Vim__entry_in_n
call fcn.00404f30
push str.the_popup_menu_will_use_the_new_version__n
call fcn.00404f30
lea eax, [esp + 0x60]
test ebx, ebx
push eax
mov ecx, str._nRunning_uninstall_program_for___s__n
mov eax, str._nDo_you_want_to_uninstall___s__now__n_y_es__n_o_
cmovne eax, ecx
push eax
call fcn.00404f30
push 1
call fcn.00409228
push eax
call fcn.004097f8
add esp, 0x30
mov dword [esp + 0x14], 0x206
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.uninstallstring
push dword [esp + 0x34]
call edi
test eax, eax
jne 0x405d7c
lea ecx, [esp + 0x40]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405942
sub ecx, edx
lea eax, [ecx + 1]
push eax
call fcn.0041130b
mov edx, eax
add esp, 4
test edx, edx
je 0x405da6
lea ecx, [esp + 0x40]
mov dword [0x433f8c], edx
mov eax, ecx
sub edx, eax
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x405970
push dword [0x433f8c]
call fcn.00404f60
push dword [0x433f8c]
call fcn.00404f60
mov cl, 0x6e
add esp, 8
mov byte [esp + 0x13], cl
nop dword [eax]
cmp cl, 0x6e
je 0x4059b6
movsx eax, cl
push eax
push str._c_is_an_invalid_reply.__Please_enter_either_y_or_n_n
call fcn.00404f30
add esp, 8
test ebx, ebx
je 0x4059c2
mov cl, 0x79
mov byte [esp + 0x13], cl
jmp 0x4059e5
push 0
call fcn.00409228
push eax
call fcn.0040a036
lea eax, [esp + 0x1b]
push eax
push 0x427f4c
call fcn.004050b0
mov cl, byte [esp + 0x23]
add esp, 0x10
movsx eax, cl
add eax, 0xffffffb2
cmp eax, 0x2b
ja case.0x4059f7.79
movzx eax, byte [eax + 0x405dc8]
jmp dword [eax*4 + 0x405dbc]
cmp cl, 0x6e
je 0x405d0e
cmp cl, 0x79
jne 0x4059a0
jmp 0x405d0e
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x50]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push 1
call fcn.004020d0
add esp, 4
cmp dword [esp + 0x1c], 0
je 0x405bca
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x40]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x553], al
test al, al
jne 0x405a50
lea ecx, [esp + 0x554]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x405a70
sub ecx, edx
lea eax, [ecx - 1]
test eax, eax
jle 0x405a9f
lea edx, [esp + 0x554]
mov cl, byte [edx + eax]
cmp cl, 0x2f
je 0x405a9b
cmp cl, 0x5c
je 0x405a9b
dec eax
test eax, eax
jg 0x405a80
jmp 0x405a9f
mov byte [edx + eax], 0
lea eax, [esp + 0x450]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x405bc2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
xor esi, esi
movzx eax, di
push eax
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x250]
push str._s_vimun_04X.exe
push eax
call fcn.004054e0
add esp, 0x10
lea eax, [esp + 0x248]
push 1
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x405b59
nop
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x405bc2
cmp esi, 0xffff
je 0x405bc2
inc esi
lea eax, [esi + edi]
movzx eax, ax
push eax
lea eax, [esp + 0x454]
push eax
lea eax, [esp + 0x250]
push str._s_vimun_04X.exe
push eax
call fcn.004054e0
add esp, 0x10
lea eax, [esp + 0x248]
push 1
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x405b00
lea eax, [esp + 0x248]
push 0x20
push eax
call fcn.00406ab0
mov ecx, eax
lea eax, [esp + 0x55c]
push eax
lea eax, [esp + 0x254]
test ecx, ecx
push eax
mov ecx, str.__s___S____s
mov eax, str._s__S____s
cmovne eax, ecx
push eax
lea eax, [esp + 0xb80]
push eax
call fcn.004054e0
lea eax, [esp + 0xb84]
push eax
call fcn.00405000
add esp, 0x1c
lea eax, [esp + 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x1c], 0
jne 0x405cbd
jmp 0x405bca
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x40]
push 0x20
push eax
call fcn.00406ab0
add esp, 8
test eax, eax
je 0x405bf9
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x968]
push str.__s_
push eax
call fcn.004054e0
add esp, 0xc
jmp 0x405c12
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esp + ecx + 0x40]
lea ecx, [ecx + 1]
mov byte [esp + ecx + 0x963], al
test al, al
jne 0x405c00
lea eax, [esp + 0x964]
push eax
call fcn.00405000
add esp, 4
push 0x3e8
call ebp
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
push 0
push 0x405e00
mov dword [0x4347c4], 0
call esi
cmp dword [0x4347c4], 0
jne 0x405c6c
push str.Press_Enter_when_the_uninstaller_is_finished_n
call fcn.00404f30
push 0
call fcn.00409228
push eax
call fcn.0040a036
add esp, 0xc
call fcn.00409a89
jmp 0x405cbd
push str.Waiting_for_the_uninstaller_to_finish__press_CTRL_C_to_abort_.
call fcn.00404f30
add esp, 4
nop dword [eax]
push 0x427fc8
call fcn.00404f30
push 1
call fcn.00409228
push eax
call fcn.004097f8
add esp, 0xc
push 0x3e8
call ebp
push 0
push 0x405e00
mov dword [0x4347c4], 0
call esi
cmp dword [0x4347c4], 0
jg 0x405c80
push str._nDone__n
call fcn.00404f30
add esp, 4
lea eax, [esp + 0x30]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x28]
cmp eax, dword [esp + 0x34]
jae 0x405cfc
dec esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov byte [esp + 0x13], 0x79
jmp 0x405d0e
mov byte [esp + 0x13], 0x6e
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x38]
mov dword [esp + 0x14], 0x208
push eax
push 0
push 0
push 0
lea eax, [esp + 0x24]
inc esi
push eax
lea eax, [esp + 0x770]
mov dword [esp + 0x3c], esi
push eax
push esi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4057f5
mov edi, dword [esp + 0x24]
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0xf88]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
call fcn.0040609c
add esp, 0xf7c
ret
push eax
push 0x240
jmp 0x405d92
push eax
push 0x220
jmp 0x405d92
push eax
push 0x219
push str._ld_error_number:___ld_n
call fcn.00404f30
add esp, 0xc
mov eax, 1
jmp 0x405d63
push str.ERROR:_out_of_memory_n
call fcn.00404f30
add esp, 4
push 1
call fcn.00411651
nop
or dword [ebp + 0x40], ebx
add byte [ecx], dl
pop edx
inc eax
add dh, bh
pop ecx
inc eax
add byte [eax], al
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add dword [edx], eax
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [eax]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
add esp, ecx
int3