Function at 0x4192b5
Capabilities:
Delete registry key
Terminate process

Disassembly:
sub esp, 0xf88
lea ecx, [esp + 0xf4]
push ebx
push ebp
push esi
call fcn.004318a9
lea ecx, [esp + 0x292]
call fcn.00418988
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x14
xor ebx, ebx
pop ebp
test eax, eax
js 0x41932d
push ebp
lea ecx, [esp + 0x64]
push ecx
push eax
lea eax, [esp + 0x29e]
push eax
push ebx
push ebx
call esi
test eax, eax
jle 0x41932d
cmp word [esp + eax*2 + 0x5e], bx
je 0x41930e
cmp eax, ebp
jge 0x41932d
xor ecx, ecx
mov word [esp + eax*2 + 0x60], cx
lea eax, [esp + 0x60]
push eax
mov edx, str.C:UsersAdministratorAppDataRoaming
lea ecx, [esp + 0x70c]
call fcn.00419668
test eax, eax
setne al
test al, al
jne 0x419337
xor eax, eax
mov word [esp + 0x708], ax
lea eax, [esp + 0x708]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x2b2]
call fcn.00418988
test eax, eax
js 0x41939d
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
lea eax, [esp + 0x2be]
push eax
push ebx
push ebx
call esi
test eax, eax
jle 0x41939d
cmp word [esp + eax*2 + 0xe], bx
je 0x41937e
cmp eax, ebp
jge 0x41939d
xor ecx, ecx
mov word [esp + eax*2 + 0x10], cx
lea eax, [esp + 0x10]
push eax
mov edx, str.C:UsersAdministratorAppDataLocalLow
lea ecx, [esp + 0x3fc]
call fcn.00419668
test eax, eax
setne al
test al, al
jne 0x4193a7
xor eax, eax
mov word [esp + 0x3f8], ax
lea eax, [esp + 0x3f8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
or dword [0x440730], 2
push dword [0x440df0]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [0x440df4]
cmp eax, 0xffffffff
je 0x4193db
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.00434766
lea ecx, [esp + 0x708]
call fcn.0041ad18
lea ecx, [esp + 0x3f8]
call fcn.0041ad18
lea ecx, [esp + 0x2d2]
call fcn.00418988
test eax, eax
js 0x419463
push ebp
lea ecx, [esp + 0x3c]
push ecx
push eax
lea eax, [esp + 0x2de]
push eax
push ebx
push ebx
call esi
test eax, eax
jle 0x419463
cmp word [esp + eax*2 + 0x36], bx
je 0x419431
cmp eax, ebp
jge 0x419463
xor ecx, ecx
mov word [esp + eax*2 + 0x38], cx
lea edx, [esp + 0x88]
mov ecx, 0xcf
call fcn.0041c8a9
lea eax, [esp + 0x38]
push eax
lea edx, [esp + 0x8c]
lea ecx, [esp + 0x914]
call fcn.00419668
test eax, eax
setne al
test al, al
jne 0x41946d
xor eax, eax
mov word [esp + 0x910], ax
lea eax, [esp + 0x910]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, dword [sym.imp.USER32.dll_CharToOemW]
lea eax, [esp + 0x600]
push eax
lea eax, [esp + 0x70c]
push eax
call esi
lea eax, [esp + 0x2f0]
push eax
lea eax, [esp + 0x3fc]
push eax
call esi
lea edx, [esp + 0xb0]
mov ecx, 0xb4
call fcn.0041c861
lea eax, [esp + 0x2f0]
push eax
lea eax, [esp + 0x604]
push eax
lea eax, [esp + 0x2f8]
push eax
lea eax, [esp + 0x60c]
push eax
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xb2c]
push 0x474
push eax
call fcn.00434197
add esp, 0x1c
test eax, eax
jle 0x419508
lea ecx, [esp + 0xb18]
call fcn.00428a14
cmp dword [0x440df4], 0xffffffff
jne 0x419518
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0x1ee
lea eax, [esp + 0x100]
mov byte [eax], bl
inc eax
dec ecx
jne 0x419524
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xf88
ret