Function at 0x402b70
Capabilities:
Create process on windows
Get installed programs
Query or enumerate registry value
Set current directory

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push edi
mov ebp, 1
xor ebx, ebx
push eax
push ebp
push ebx
push str.SoftwarePCI_Audio_ApplicationsUninstall
push 0x80000002
mov dword [esp + 0x2c], ebx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402be3
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push str.Path
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], 0x104
call edi
test eax, eax
je 0x402bd8
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
jne 0x402c3f
lea eax, [esp + 0x14]
push eax
push ebp
push ebx
push str.SoftwareC_MediaUninstall
push 0x80000002
call esi
test eax, eax
jne 0x402c3b
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push str.Path
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], 0x104
call edi
test eax, eax
je 0x402c30
mov dword [esp + 0x18], ebx
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
jbe 0x402e25
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], ecx
cmp byte [esp + ecx + 0x1f], 0x5c
je 0x402c68
mov byte [esp + ecx + 0x20], 0x5c
mov byte [esp + ecx + 0x21], 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov edi, str.Uninstall.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 5
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x24]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xc8
call ebp
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.Uninstall_Audio_Applications
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402cf2
cmp ebx, 0xa
jge 0x402cf2
push 0xc8
call ebp
push str.Uninstall_Audio_Applications
push 0x8002
call edi
mov esi, eax
inc ebx
test esi, esi
je 0x402cd3
test esi, esi
mov dword [esp + 0x10], 0
je 0x402f9f
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push esi
call ebx
test eax, eax
je 0x402d16
push esi
call ebx
test eax, eax
jne 0x402d0f
push 0xc8
call ebp
push 0x408e50
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402d7c
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402d7c
cmp dword [esp + 0x10], 0xa
jge 0x402d7c
push 0xc8
call ebp
push 0x408e50
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402d6f
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
mov ecx, dword [esp + 0x10]
inc ecx
test esi, esi
mov dword [esp + 0x10], ecx
je 0x402d41
xor ebx, ebx
test esi, esi
je 0x402f9f
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402d9c
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402d91
push 0xc8
call ebp
push 0x408e20
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402e02
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402e02
cmp ebx, 0xa
jge 0x402dfa
push 0xc8
call ebp
push 0x408e20
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402df3
push str.Remove_Programs_From_Your_Computer
push 0x8002
call edi
mov esi, eax
inc ebx
test esi, esi
je 0x402dc7
jmp 0x402e02
test esi, esi
je 0x402f9f
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push esi
call edi
test eax, eax
je 0x402f9f
push esi
call edi
test eax, eax
jne 0x402e13
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
lea ecx, [esp + 0x14]
push ecx
push ebp
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallPCI_Audio_Applications
push 0x80000002
call esi
cmp eax, ebx
je 0x402e57
lea edx, [esp + 0x14]
push edx
push ebp
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallPCI_Audio_WinNT_Applications
push 0x80000002
call esi
cmp eax, ebx
jne 0x402f9f
lea eax, [esp + 0x10]
lea ecx, [esp + 0x124]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
push ebx
push str.UninstallString
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x28], 0x104
call edi
test eax, eax
jne 0x402e96
lea ecx, [esp + 0x124]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x190
call ebp
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0x408e50
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f09
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f09
cmp ebx, 0xa
jge 0x402f09
push 0xc8
call ebp
push 0x408e50
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f04
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
inc ebx
test esi, esi
je 0x402ed8
xor ebx, ebx
test esi, esi
je 0x402f9f
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402f29
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x402f1e
push 0xc8
call ebp
push 0x408e20
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f8b
push str.Confirm_File_Deletion
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f8b
cmp ebx, 0x14
jge 0x402f87
push 0xc8
call ebp
push 0x408e20
push 0x8002
call edi
mov esi, eax
test esi, esi
jne 0x402f80
push str.Remove_Programs_From_Your_Computer
push 0x8002
call edi
mov esi, eax
inc ebx
test esi, esi
je 0x402f54
jmp 0x402f8b
test esi, esi
je 0x402f9f
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push esi
call edi
test eax, eax
je 0x402f9f
push esi
call edi
test eax, eax
jne 0x402f98
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret