Function at 0x4a7cb0
Capabilities:
Delete registry key
Delete registry value
Get installed programs
Link many functions at runtime
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x59e373
mov eax, dword fs:[0]
push eax
sub esp, 0x668
mov eax, dword [0x62819c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x62c], ecx
lea eax, [ebp - 0x640]
mov dword [ebp - 4], ecx
push eax
push 0x2001f
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
mov dword [ebp - 0x640], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a7d75
mov eax, dword [ebp - 0x640]
lea ecx, [ebp - 0x634]
push edi
mov dword [ebp - 0x634], eax
mov dword [ebp - 0x630], ebx
call fcn.004395c0
push 0x5b06a4
lea ecx, [ebp - 0x634]
call fcn.004395c0
mov ebx, dword [ebp - 0x634]
test ebx, ebx
je 0x4a7d6b
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
cmp dword [ebp + 8], 0
je 0x4a860e
call fcn.00428a90
mov ecx, eax
test ecx, ecx
je 0x4a87dc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x63c], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x4a7dd3
test esi, 0xffff0000
jne 0x4a7dbd
movzx eax, si
lea ecx, [ebp - 0x63c]
push eax
call fcn.004295b0
jmp 0x4a7de2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a7dc2
sub ecx, edx
sar ecx, 1
jmp 0x4a7dd5
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x63c]
call fcn.00429870
push 1
push 0x5ad728
lea ecx, [ebp - 0x63c]
mov byte [ebp - 4], 2
call fcn.00429240
test edi, edi
jne 0x4a7e00
xor ecx, ecx
jmp 0x4a7e14
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a7e05
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x63c]
call fcn.00429240
mov esi, dword [ebp - 0x62c]
mov edi, dword [ebp - 0x63c]
mov dword [ebp - 0x638], 0
test esi, esi
je 0x4a7e8f
cmp dword [esi], 0
je 0x4a7e82
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a7e56
mov eax, 1
jmp 0x4a7eaa
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a7e88
push 0
push dword [esi]
lea ecx, [ebp - 0x638]
push ecx
push 0x2001f
push 0
push edi
push 0x80000001
call eax
jmp 0x4a7eaa
cmp dword [esi + 4], 0
jne 0x4a7e8f
mov eax, 1
jmp 0x4a7eaa
lea eax, [ebp - 0x638]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x2001f
push 0
push edi
push 0x80000001
call eax
test eax, eax
jne 0x4a85ae
test ebx, ebx
je 0x4a7ebd
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x638]
mov ebx, esi
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x4a85ae
push eax
push eax
push eax
push eax
mov dword [ebp - 0x660], eax
mov dword [ebp - 0x640], eax
lea eax, [ebp - 0x640]
push eax
push 0
push 0
lea eax, [ebp - 0x660]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
xor ebx, ebx
mov byte [ebp - 4], 3
mov dword [ebp - 0x628], ebx
cmp dword [ebp - 0x660], ebx
jbe 0x4a80b2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.0054b380
add esp, 0xc
mov dword [ebp - 0x644], 0x104
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4a809f
lea eax, [ebp - 0x218]
push str.usercenter
push eax
call fcn.00555852
add esp, 8
test eax, eax
je 0x4a809f
lea eax, [ebp - 0x218]
push 0x5c0cfc
push eax
call fcn.00555852
add esp, 8
test eax, eax
je 0x4a809f
call fcn.00428a90
test eax, eax
je 0x4a87dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x4a8004
movzx eax, ax
lea ecx, [ebp - 0x624]
push eax
call fcn.004295b0
jmp 0x4a8032
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a8010
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x624]
call fcn.00429870
mov ebx, dword [ebp - 0x658]
mov esi, dword [ebp - 0x624]
mov byte [ebp - 4], 5
cmp ebx, dword [ebp - 0x654]
je 0x4a8064
lea eax, [esi - 0x10]
push eax
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x658], 4
jmp 0x4a8077
lea eax, [ebp - 0x624]
push eax
push ebx
lea ecx, [ebp - 0x65c]
call fcn.00428c50
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a8093
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x638]
mov ebx, dword [ebp - 0x628]
inc ebx
mov dword [ebp - 0x628], ebx
cmp ebx, dword [ebp - 0x660]
jb 0x4a7f42
xor ebx, ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
xor esi, esi
mov byte [ebp - 4], 6
mov dword [ebp - 0x628], esi
cmp dword [ebp - 0x640], esi
jbe 0x4a8215
mov edi, edi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.0054b380
add esp, 0xc
mov dword [ebp - 0x644], 0x104
lea eax, [ebp - 0x644]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push dword [ebp - 0x638]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a81fc
call fcn.00428a90
test eax, eax
je 0x4a87dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x4a816a
movzx eax, ax
lea ecx, [ebp - 0x624]
push eax
call fcn.004295b0
jmp 0x4a8195
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a8173
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x624]
call fcn.00429870
mov ebx, dword [ebp - 0x64c]
mov esi, dword [ebp - 0x624]
mov byte [ebp - 4], 8
cmp ebx, dword [ebp - 0x648]
je 0x4a81c7
lea eax, [esi - 0x10]
push eax
call fcn.004293f0
add eax, 0x10
add esp, 4
mov dword [ebx], eax
add dword [ebp - 0x64c], 4
jmp 0x4a81da
lea eax, [ebp - 0x624]
push eax
push ebx
lea ecx, [ebp - 0x650]
call fcn.00428c50
mov byte [ebp - 4], 6
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4a81f6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x628]
inc esi
mov dword [ebp - 0x628], esi
cmp esi, dword [ebp - 0x640]
jb 0x4a80e0
mov ebx, dword [ebp - 0x650]
mov esi, dword [ebp - 0x65c]
cmp esi, dword [ebp - 0x658]
je 0x4a83c4
mov edi, dword [ebp - 0x638]
lea ecx, [ecx]
mov eax, dword [esi]
lea ecx, [ebp - 0x644]
push ecx
push 0x2001f
push 0
push eax
push edi
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x66c], 0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x644], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a839f
mov ebx, dword [ebp - 0x644]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x628]
mov dword [ebp - 0x66c], ebx
push eax
lea eax, [ebp - 0x620]
mov dword [ebp - 0x628], 0x100
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4a8312
jmp 0x4a82c0
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x66c]
call fcn.004395c0
test eax, eax
jne 0x4a836a
mov ebx, dword [ebp - 0x66c]
lea eax, [ebp - 0x674]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x628]
mov dword [ebp - 0x628], 0x100
push eax
lea eax, [ebp - 0x620]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4a82c0
test ebx, ebx
je 0x4a831f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov eax, dword [ebp - 0x62c]
test eax, eax
je 0x4a8545
cmp dword [eax], 0
je 0x4a8377
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a838a
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a838a
mov ecx, dword [ebp - 0x62c]
push 0
push dword [ecx]
push 0
push 0
push dword [ebp - 0x624]
push edi
call eax
jmp 0x4a838a
mov eax, dword [ebp - 0x66c]
test eax, eax
je 0x4a839f
push eax
jmp 0x4a838f
cmp dword [eax + 4], 0
je 0x4a838a
push dword [ebp - 0x624]
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test ebx, ebx
je 0x4a839f
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x66c], 0
add esi, 4
mov dword [ebp - 0x668], 0
cmp esi, dword [ebp - 0x658]
jne 0x4a8230
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
cmp ebx, dword [ebp - 0x64c]
je 0x4a83f4
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [ebp - 0x638]
push dword [ebx]
push edi
call esi
add ebx, 4
cmp ebx, dword [ebp - 0x64c]
jne 0x4a83d8
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x638]
test eax, eax
je 0x4a8413
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov ebx, dword [ebp - 0x650]
mov dword [ebp - 0x630], 0
mov byte [ebp - 4], 3
test ebx, ebx
je 0x4a84ba
mov esi, dword [ebp - 0x64c]
cmp ebx, esi
je 0x4a8462
or edi, 0xffffffff
mov edx, dword [ebx]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a844f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 4
cmp ebx, esi
jne 0x4a8436
mov ebx, dword [ebp - 0x650]
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x648]
sub eax, ebx
sar eax, 2
lea ecx, [eax*4]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4a8492
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a87e6
push ecx
push ebx
call fcn.00546044
add esp, 8
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov esi, dword [ebp - 0x65c]
mov byte [ebp - 4], 2
test esi, esi
je 0x4a85ae
mov ebx, dword [ebp - 0x658]
cmp esi, ebx
je 0x4a8506
or edi, 0xffffffff
lea esp, [esp]
mov edx, dword [esi]
mov eax, edi
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4a84f9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, ebx
jne 0x4a84e0
mov edi, dword [ebp - 0x63c]
mov eax, dword [ebp - 0x654]
mov esi, dword [ebp - 0x65c]
sub eax, esi
sar eax, 2
lea ecx, [eax*4]
mov eax, esi
cmp ecx, 0x1000
jb 0x4a85a4
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4a87e6
jmp 0x4a85a4
cmp byte [0x631724], 0
jne 0x4a8585
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4a8577
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x631720], eax
mov byte [0x631724], 1
jmp 0x4a858a
mov eax, dword [0x631720]
mov byte [0x631724], 1
jmp 0x4a858a
mov eax, dword [0x631720]
test eax, eax
je 0x4a837d
push 0
push 0
push dword [ebp - 0x624]
push edi
call eax
jmp 0x4a838a
push ecx
push esi
call fcn.00546044
add esp, 8
mov byte [ebp - 4], 0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4a85ca
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x634]
mov esi, dword [ebp - 0x62c]
mov dword [ebp - 0x624], 0
test esi, esi
je 0x4a873d
cmp dword [esi], 0
je 0x4a8730
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8700
mov eax, 1
jmp 0x4a875b
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x624], 0
test eax, eax
je 0x4a8683
cmp dword [eax], 0
je 0x4a8676
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4a8644
mov eax, 1
jmp 0x4a869d
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a867c
mov ecx, dword [ebp - 0x62c]
push 0
push dword [ecx]
lea ecx, [ebp - 0x624]
push ecx
push 0x2001f
push 0
push esi
push 0x80000001
call eax
jmp 0x4a869d
cmp dword [eax + 4], 0
jne 0x4a8683
mov eax, 1
jmp 0x4a869d
lea eax, [ebp - 0x624]
push eax
push 0x2001f
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a85ca
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4a86b2
push ebx
call esi
mov ebx, dword [ebp - 0x624]
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x4a85d0
push edi
lea ecx, [ebp - 0x634]
call fcn.004395c0
mov ebx, dword [ebp - 0x634]
test ebx, ebx
je 0x4a86f1
push ebx
call esi
xor ebx, ebx
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
jmp 0x4a85d0
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a8736
push 0
push dword [esi]
lea ecx, [ebp - 0x624]
push ecx
push 0x2001f
push 0
push str.SOFTWAREClasses
push 0x80000001
call eax
jmp 0x4a875b
cmp dword [esi + 4], 0
jne 0x4a873d
mov eax, 1
jmp 0x4a875b
lea eax, [ebp - 0x624]
push eax
push 0x2001f
push 0
push str.SOFTWAREClasses
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a87b5
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x4a876c
push ebx
call esi
mov ebx, dword [ebp - 0x624]
mov dword [ebp - 0x634], ebx
mov dword [ebp - 0x630], 0
test eax, eax
jne 0x4a87b5
push str.ksoqing
lea ecx, [ebp - 0x634]
call fcn.004395c0
push str.ksourl
lea ecx, [ebp - 0x634]
call fcn.004395c0
mov eax, dword [ebp - 0x634]
test eax, eax
je 0x4a87c0
push eax
call esi
jmp 0x4a87c0
test ebx, ebx
je 0x4a87c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545ec7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004293d0
call fcn.00555394
int3