Function at 0x402c50
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test eax, eax
je 0x402c7a
push 0x415948
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edi, dword [edi + 4]
test edi, edi
je 0x402ca9
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x408
push edi
call esi
inc eax
mov ecx, 0x64
cmp eax, ecx
push 0
cmovg eax, ecx
push eax
push 0x402
push edi
call esi
lea eax, [ebp - 0x418]
push eax
push 0x20219
push 0
push str.SOFTWAREwenguanjia
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x402ce5
push dword [ebp - 0x418]
call esi
mov dword [ebp - 0x420], str.wenguanjia
jmp 0x402cef
mov dword [ebp - 0x420], str.oainfo
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x402d3d
push dword [ebp - 0x420]
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00408ec0
add esp, 0xc
lea eax, [ebp - 0x20c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402dc2
push str.DisplayIcon
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402e04
push str.DisplayName
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402e46
push str.DisplayVersion
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402e88
push str.InstallLocation
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402eca
push str.Publisher
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402f0c
push str.UninstallString
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.00408ec0
add esp, 0xc
lea eax, [ebp - 0x414]
push str.SOFTWARE_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402fa3
push str.InstallName
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x402fe5
push str.InstallPath
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x403027
push str.StartMenuPath
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x403069
push str.Normal_Online
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x4030ab
push str.Service_Value
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
pop ebx
test eax, eax
jne 0x4030ee
push str.TName
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call esi
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004057df
mov esp, ebp
pop ebp
ret