Function at 0x4548ac
Capabilities:
Check if file exists
Delete file
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x430], edx
mov dword [ebp - 0x42c], edx
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], edx
mov dword [ebp - 0x420], edx
mov dword [ebp - 0x41c], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x454ce5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x454cfc
call fcn.00403ee4
lea edx, [ebp - 4]
mov ecx, 5
mov eax, dword [0x458cd8]
call fcn.004043f4
lea edx, [ebp - 4]
mov ecx, 0x2b
mov eax, 0x454d28
call fcn.004043f4
push dword [ebp - 4]
push 0x454d34
push 0x454d5c
push 0x454d88
push dword [0x458cd8]
push 0x454d28
lea eax, [ebp - 0x41c]
mov edx, 6
call fcn.004041cc
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebx + 0x310]
call fcn.00432b30
push pe_nt_image_headers32
lea eax, [ebp - 0x20e]
push eax
push 0x64
mov eax, dword [0x458664]
push eax
call sub.user32.dll_LoadStringA_1
lea eax, [ebp - 0x20e]
call fcn.00453ad0
mov esi, eax
push 0x104
push 0x458bd8
call sub.kernel32.dll_GetSystemDirectoryA
cmp byte [eax + 0x458bd7], 0x5c
je 0x4549ac
push 0x454d98
push 0x458bd8
call sub.kernel32.dll_lstrcatA
push 0x458bd8
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcpyA
push pe_nt_image_headers32
lea eax, [ebp - 0x418]
push eax
push 0x12c
mov eax, dword [0x458664]
push eax
call sub.user32.dll_LoadStringA_1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x109]
push eax
call sub.shlwapi.dll_PathFileExistsA
test eax, eax
je 0x454a62
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x454a62
lea edx, [ebp - 0x420]
mov esi, dword [ebx + 0x310]
mov eax, esi
call fcn.00432b00
lea eax, [ebp - 0x420]
mov edx, 0x454da4
call fcn.00404114
mov edx, dword [ebp - 0x420]
mov eax, esi
call fcn.00432b30
mov eax, dword [ebx + 0x324]
mov edx, dword [eax + 0x40]
mov eax, dword [ebx + 0x320]
call fcn.00432270
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00432a20
jmp 0x454c8d
push dword [ebp - 4]
push 0x454d34
push 0x454e00
push 0x454d88
push dword [0x458cd8]
push 0x454d28
lea eax, [ebp - 0x424]
mov edx, 6
call fcn.004041cc
mov edx, dword [ebp - 0x424]
mov eax, dword [ebx + 0x310]
call fcn.00432b30
push 0x458bd8
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcpyA
push pe_nt_image_headers32
lea eax, [ebp - 0x418]
push eax
push 0x190
mov eax, dword [0x458664]
push eax
call sub.user32.dll_LoadStringA_1
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x109]
push eax
call sub.shlwapi.dll_PathFileExistsA
test eax, eax
je 0x454b56
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x454b56
lea edx, [ebp - 0x428]
mov esi, dword [ebx + 0x310]
mov eax, esi
call fcn.00432b00
lea eax, [ebp - 0x428]
mov edx, 0x454e2c
call fcn.00404114
mov edx, dword [ebp - 0x428]
mov eax, esi
call fcn.00432b30
mov eax, dword [ebx + 0x324]
mov edx, dword [eax + 0x40]
mov eax, dword [ebx + 0x320]
call fcn.00432270
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00432a20
jmp 0x454c8d
push dword [ebp - 4]
push 0x454d34
push 0x454e00
push 0x454e88
push dword [0x458cd8]
push 0x454d28
lea eax, [ebp - 0x42c]
mov edx, 6
call fcn.004041cc
mov edx, dword [ebp - 0x42c]
mov eax, dword [ebx + 0x310]
call fcn.00432b30
test esi, esi
je 0x454bf0
push 0x454e98
lea eax, [ebp - 0x313]
push eax
call sub.kernel32.dll_lstrcpyA
mov eax, esi
call fcn.00453990
push eax
lea eax, [ebp - 0x313]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x313]
push eax
push 0x80000002
call sub.advapi32.dll_RegDeleteKeyA
push 0x454ecc
lea eax, [ebp - 0x313]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x313]
push eax
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 4]
mov edx, 0x454f04
call fcn.00403ee4
lea edx, [ebp - 4]
mov ecx, 6
mov eax, dword [0x458cd8]
call fcn.004043f4
lea edx, [ebp - 4]
mov ecx, 0x2c
mov eax, 0x454d28
call fcn.004043f4
lea edx, [ebp - 0x430]
mov esi, dword [ebx + 0x310]
mov eax, esi
call fcn.00432b00
lea eax, [ebp - 0x430]
mov edx, dword [ebp - 4]
call fcn.00404114
mov edx, dword [ebp - 0x430]
mov eax, esi
call fcn.00432b30
mov eax, dword [ebx + 0x324]
mov edx, dword [eax + 0x40]
mov eax, dword [ebx + 0x30c]
call fcn.00432270
mov edx, 0x454f34
mov eax, dword [ebx + 0x30c]
call fcn.00432b30
xor edx, edx
mov eax, dword [ebx + 0x320]
call fcn.00432a20
xor edx, edx
mov eax, dword [ebx + 0x324]
call fcn.00432a20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454cec
lea eax, [ebp - 0x430]
call fcn.00403e4c
lea eax, [ebp - 0x42c]
call fcn.00403e4c
lea eax, [ebp - 0x428]
call fcn.00403e4c
lea eax, [ebp - 0x424]
call fcn.00403e4c
lea eax, [ebp - 0x420]
call fcn.00403e4c
lea eax, [ebp - 0x41c]
call fcn.00403e4c
lea eax, [ebp - 4]
call fcn.00403e4c
ret