Function at 0x407180
Capabilities:
Delete directory
Delete file
Delete registry key
Delete registry value
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42b0c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x204], edi
mov dword [ebp - 0x1f8], 0
mov dword [ebp - 0x210], 1
cmp dword [edi + 0x950], 3
jne 0x407320
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x416840
push 0x80000001
call esi
test eax, eax
jne 0x407320
push 0x104
push 0x40
mov dword [ebp - 0x200], 0x104
call fcn.00405c20
add esp, 8
mov ebx, eax
lea eax, [ebp - 0x200]
push eax
push ebx
push 0
push 0
push 0x416834
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407231
sub ecx, edx
push 0x4168c0
push 0x416b04
lea eax, [ecx + ebx]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push ebx
call fcn.004021f0
add esp, 0x10
test eax, eax
je 0x407317
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x407317
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40728a
push 0x40030
push str.Unable_to_Delete_File
push str.Unable_to_delete_previous_copy_of_the_program_prior_to_re_install._r_n_r_nVerify_that_the_program_is_not_running_on_this_PC__or_another_PC_r_nif_the_software_is_installed_on_a_LAN_._r_n_r_nIf_youve_confirmed_that_no_other_instances_of_the_program_are_r_nrunning__contact_eFile_Express_Support_for_assistance.
jmp 0x4072ed
mov ecx, 0x24
lea edi, [ebp - 0xf0]
mov esi, str.Unable_to_delete_previous_copy_of_the_program_prior_to_re_install._r_n_r_nThe_existing_copy_of_the_software_will_not_be_replaced.
rep movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x48]
push str.__MS__lu_
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [ebp - 0x48]
add esp, 0xc
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4072b6
lea edi, [ebp - 0xf0]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4072c6
mov ecx, edx
lea eax, [ebp - 0xf0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x40030
mov ecx, edx
and ecx, 3
push str.Unable_to_Delete_File
rep movsb byte es:[edi], byte [esi]
push eax
push dword [0x42c650]
call fcn.00405d50
add esp, 0x10
push ebx
call fcn.00405c70
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408060
mov esp, ebp
pop ebp
ret
push ebx
call fcn.00405c70
add esp, 4
cmp dword [edi + 0x950], 2
jne 0x407364
push 0x416388
lea eax, [ebp - 0x1f4]
push str.Do_you_want_to_permanently_remove__s_from_this_PC_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x40134
push str.Confirm_Un_Install
lea eax, [ebp - 0x1f4]
push eax
push dword [0x42c650]
call fcn.00405d50
add esp, 0x1c
cmp eax, 6
jne 0x407304
push 0x104
push 0x40
call fcn.00405c20
push 0x104
push 0x40
mov ebx, eax
call fcn.00405c20
push 0x104
push 0x40
mov dword [ebp - 0x1fc], eax
call fcn.00405c20
push 0x104
push 0x40
mov dword [ebp - 0x20c], eax
call fcn.00405c20
add esp, 0x20
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x416840
push 0x80000001
call esi
test eax, eax
jne 0x4074fa
mov ecx, 0x15
mov dword [ebp - 0x208], 0x104
mov esi, str.EfileX23.exe_EfileX.dll_zlibwapi.dll_EfileX.chm_license.txt_zlibwapi.dll_uninstl.exe
lea edi, [ebp - 0x5c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x208]
push eax
push ebx
push 0
push 0
push 0x416834
push dword [ebp - 0x1f8]
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4168c0
push ebx
push 0x416530
push dword [ebp - 0x1fc]
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [ebp - 0x204]
add esp, 0x10
cmp dword [edx + 0x950], 3
jne 0x407450
mov ecx, ebx
sub edx, ebx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0x627], al
test al, al
jne 0x407440
lea edi, [ebx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x407453
mov ax, word [0x416af8]
mov ecx, ebx
mov word [edi], ax
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407470
sub ecx, edx
lea eax, [ebp - 0x5c]
push 0x416afc
push eax
lea esi, [ecx + ebx]
call fcn.0040b7ca
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x4074d6
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [eax]
mov edx, esi
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4074a4
push ebx
call fcn.004021f0
add esp, 4
test eax, eax
je 0x4074c1
push ebx
call edi
push 0x416afc
push 0
call fcn.0040b7ca
mov ecx, eax
add esp, 8
test ecx, ecx
jne 0x4074a0
push ebx
mov byte [esi - 1], 0
call fcn.004021f0
add esp, 4
test eax, eax
je 0x4074f4
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [ebp - 0x210], eax
mov edi, dword [ebp - 0x204]
mov esi, dword [ebp - 0x1fc]
push 0
push ebx
push esi
push 3
call fcn.004047e0
push 0x10
push esi
call fcn.00402cf0
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40755b
mov eax, dword [edi + 0x950]
cmp eax, 3
jne 0x407542
mov edx, edi
mov ecx, esi
sub edx, esi
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0x72b], al
test al, al
jne 0x407530
jmp 0x40755b
cmp eax, 2
jne 0x40755b
push esi
call fcn.004021f0
add esp, 4
test eax, eax
je 0x40755b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
call fcn.00405c70
push 2
push dword [ebp - 0x1fc]
call fcn.00402cf0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40761a
lea ecx, [esi - 1]
nop
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x407580
mov eax, dword [0x4170a8]
mov dword [ecx], eax
mov eax, dword [0x4170ac]
mov dword [ecx + 4], eax
mov eax, dword [0x4170b0]
mov dword [ecx + 8], eax
mov eax, dword [0x4170b4]
mov dword [ecx + 0xc], eax
mov eax, dword [0x4170b8]
mov dword [ecx + 0x10], eax
mov eax, dword [0x4170bc]
mov dword [ecx + 0x14], eax
mov eax, dword [edi + 0x950]
cmp eax, 3
jne 0x4075e2
mov edx, edi
mov ecx, esi
sub edx, esi
nop word [eax + eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx + 0x82f], al
test al, al
jne 0x4075d0
jmp 0x40761a
cmp eax, 2
jne 0x40761a
push esi
call fcn.004021f0
add esp, 4
test eax, eax
je 0x4075fb
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push esi
call fcn.00408f30
push esi
mov byte [eax], 0
call fcn.004021f0
add esp, 0xc
test eax, eax
je 0x40761a
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call fcn.00405c70
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
add esp, 4
cmp dword [edi + 0x950], 2
jne 0x4076f0
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x416840
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407690
lea eax, [ebp - 0x208]
mov dword [ebp - 0x208], 0x104
push eax
push dword [ebp - 0x20c]
push 0
push 0
push 0x41686c
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x416840
push dword [ebp - 0x1f8]
call esi
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20c]
cmp byte [eax], 0
je 0x4076f0
push 0
push 1
push 0x104
push 0x41686c
push eax
push 0x416840
push 0x80000001
call fcn.00406b30
add esp, 0x1c
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstalleFile_Express_2023
push dword [ebp - 0x1f8]
call esi
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x4170c0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x4170d4
push dword [ebp - 0x1f8]
call esi
push 0x4170e0
push dword [ebp - 0x1f8]
call fcn.00401f60
add esp, 8
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x4170f4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x4170d4
push dword [ebp - 0x1f8]
call esi
push 0x4170e0
push dword [ebp - 0x1f8]
call fcn.00401f60
add esp, 8
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x4168c0
push str.Applications_s
push dword [ebp - 0x200]
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x417118
push dword [ebp - 0x1f8]
call esi
push dword [ebp - 0x1f8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
cmp dword [0x42c64c], 5
jb 0x40786e
movups xmm0, xmmword [0x417134]
mov eax, dword [ebp - 0x200]
movups xmmword [eax], xmm0
movups xmm0, xmmword [0x417144]
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [0x417154]
movups xmmword [eax + 0x20], xmm0
lea eax, [ebp - 0x1f8]
push eax
push 0xf003f
push 0
push 0x417134
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp - 0x1fc]
push dword [ebp - 0x1f8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x1f8]
call esi
push ebx
call fcn.00405c70
push dword [ebp - 0x1fc]
call fcn.00405c70
push dword [ebp - 0x20c]
call fcn.00405c70
push dword [ebp - 0x200]
call fcn.00405c70
add esp, 0x10
cmp dword [edi + 0x950], 2
jne 0x407904
push 0x416388
lea eax, [ebp - 0x1f4]
push str.Un_install_of__s_was_successful.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebp - 0x210], 0
jne 0x4078e5
lea edi, [ebp - 0x1f4]
dec edi
nop dword [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4078d0
mov ecx, 0x1f
mov esi, str._r_n_r_nNote_that_files_that_were_copied_to_the_install_r_ndirectory_after_the_software_was_initially_r_ninstalled_were_not_deleted.
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x40030
push str.Un_Install_Completed
lea ecx, [ebp - 0x1f4]
push ecx
push dword [0x42c650]
call fcn.00405d50
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408060
mov esp, ebp
pop ebp
ret