Function at 0x433080
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Get common file path
Get startup folder
Link many functions at runtime
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a2ff
mov eax, dword fs:[0]
push eax
mov eax, 0x164c
call fcn.0044d7b0
mov eax, dword [0x550204]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x1644], esi
call fcn.004720f0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x555fb4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x519b10
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.00431de0
mov edi, eax
cmp dword [edi], 0
jne 0x43317d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x4332f1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CurlInit
push eax
call esi
push str.CurlUninit
push dword [edi]
mov dword [edi + 4], eax
call esi
push str.zlib_uncompress
push dword [edi]
mov dword [edi + 8], eax
call esi
push str.zlib_compress
push dword [edi]
mov dword [edi + 0x10], eax
call esi
push str.zlib_compressBound
push dword [edi]
mov dword [edi + 0x14], eax
call esi
mov dword [edi + 0x18], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x433177
call eax
mov dword [edi + 0xc], eax
mov esi, dword [ebp - 0x1644]
cmp dword [edi + 8], 0
je 0x4332f1
cmp dword [edi + 4], 0
je 0x4332f1
cmp dword [edi + 0xc], 0
je 0x4332f1
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004720f0
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push dword [0x555fb4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.0041f5a0
mov ecx, eax
test ecx, ecx
je 0x433ab9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1640], eax
mov dword [ebp - 4], 0
call fcn.0041f5a0
mov ecx, eax
test ecx, ecx
je 0x433ac3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1648], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1648]
call fcn.00407c80
test al, al
jne 0x433253
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433231
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1648]
call fcn.00409b60
lea eax, [ebp - 0x1640]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1648]
push eax
call fcn.00428140
mov edx, dword [ebp - 0x1648]
add esp, 8
mov byte [ebp - 4], 0
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43328f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
movzx eax, byte [esi + 0x98]
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x164c], esp
call fcn.004292b0
push eax
mov ecx, esi
call fcn.00406360
push ecx
lea eax, [ebp - 0x1640]
mov byte [ebp - 4], 3
mov ecx, esp
push eax
call fcn.00426c60
mov byte [ebp - 4], 0
call fcn.004d86f0
mov edx, dword [ebp - 0x1640]
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4332f1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1644]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x630], 0x432510
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x634]
mov dword [ebp - 4], 4
push eax
call fcn.0041f8d0
push str.remove_registry
mov dword [ebp - 4], 0xffffffff
call fcn.00426260
push 0x208
lea eax, [ebp - 0x840]
mov dword [ebp - 0x164c], 1
push 0
push eax
mov dword [ebp - 0x1648], 0x104
call fcn.004720f0
add esp, 0x14
lea eax, [ebp - 0x1648]
lea ecx, [ebp - 0x1639]
push eax
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x164c]
push eax
push str.InstallDate
call fcn.00430b00
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x1639]
call fcn.00431040
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x840]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4333b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x840]
push eax
push 1
push str.InstallDate
lea ecx, [ebp - 0x1639]
call fcn.00431420
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
lea eax, [ebp - 0x638]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x638], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.0041f5a0
mov ecx, eax
test ecx, ecx
je 0x433acd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1640], eax
movzx eax, word [ebp - 0x62c]
push eax
movzx eax, word [ebp - 0x62e]
push eax
movzx eax, word [ebp - 0x630]
push eax
movzx eax, word [ebp - 0x632]
push eax
movzx eax, word [ebp - 0x636]
push eax
movzx eax, word [ebp - 0x638]
push eax
lea eax, [ebp - 0x1640]
mov dword [ebp - 4], 5
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.00408160
mov esi, dword [ebp - 0x1640]
lea ecx, [ebp - 0x1639]
add esp, 0x20
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.LastUninstallDate
call fcn.00430e80
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4334b1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1644]
mov ecx, esi
push 1
call fcn.004323f0
push str.start_call_program
call fcn.00426260
add esp, 4
mov ecx, esi
push 4
call fcn.004323f0
push str.start_close_all_processes
call fcn.00426260
add esp, 4
lea edi, [esi + 8]
mov dword [ebp - 0x1648], edi
push edi
call fcn.0041fe60
mov ecx, eax
call fcn.0041fd90
push eax
call fcn.00438fb0
add esp, 8
mov ecx, esi
push 5
call fcn.004323f0
push 0x210
lea eax, [ebp - 0x848]
push 0
push eax
call fcn.004720f0
add esp, 0xc
call fcn.0041f5a0
mov ecx, eax
test ecx, ecx
je 0x433ad7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
mov dword [ebp - 0x164c], eax
lea ecx, [eax + 0x10]
mov dword [ebp - 0x1640], ecx
mov dword [ebp - 4], 6
call fcn.00432290
test al, al
lea eax, [ebp - 0x848]
je 0x433563
push str.UtilsSWriterSDrv_x64.sys
jmp 0x433568
push str.UtilsSWriterSDrv.sys
push dword [edi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathCombineW]
push eax
call edi
lea eax, [ebp - 0x848]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4335a5
push str.SWriterSDrvs
call fcn.00437f40
push str.SWriterSDrvs
call fcn.0043b920
push str.SWriterSDrvs
call fcn.0043b570
add esp, 8
push str.MagicPenSvc
call fcn.0043b920
push str.MagicPenSvc
call fcn.0043b570
mov edx, dword [ebp - 0x164c]
add esp, 8
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4335de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.remove_desktop_shortcuts
call fcn.00426260
push 0x800
lea eax, [ebp - 0xe38]
push 0
push eax
call fcn.004720f0
add esp, 0x10
lea eax, [ebp - 0xe38]
push 1
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xe38]
mov ecx, esi
push eax
call fcn.00431660
push 0x800
lea eax, [ebp - 0x1638]
push 0
push eax
call fcn.004720f0
add esp, 0xc
lea eax, [ebp - 0x1638]
push 1
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1638]
mov ecx, esi
push eax
call fcn.00431660
push 6
mov ecx, esi
call fcn.004323f0
push str.remove_start_menu_shortcuts
call fcn.00426260
push 0x800
lea eax, [ebp - 0x1638]
push 0
push eax
call fcn.004720f0
add esp, 0x10
lea eax, [ebp - 0x1638]
push 1
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0xe38]
push 0
push eax
call fcn.004720f0
add esp, 0xc
lea ecx, [ebp - 0x1639]
call fcn.00430da0
push eax
lea ecx, [ebp - 0x1640]
call fcn.00406360
cmp byte [esi + 0x98], 0
mov dword [ebp - 4], 7
je 0x433710
lea ecx, [ebp - 0x1639]
call fcn.00430940
mov edx, eax
test edx, edx
jne 0x4336e4
xor ecx, ecx
jmp 0x433703
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x164c], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4336f0
sub ecx, dword [ebp - 0x164c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1640]
call fcn.00409b60
push dword [ebp - 0x1640]
lea eax, [ebp - 0x1638]
push eax
lea eax, [ebp - 0xe38]
push eax
call edi
lea eax, [ebp - 0xe38]
push eax
call fcn.00434860
mov edx, dword [ebp - 0x1640]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43375a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 7
mov ecx, esi
call fcn.004323f0
push str.remove_appdata
call fcn.00426260
push 0x800
lea eax, [ebp - 0x1638]
push 0
push eax
call fcn.004720f0
add esp, 0x10
lea eax, [ebp - 0x1638]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x20a
lea eax, [ebp - 0x844]
push 0
push eax
call fcn.004720f0
add esp, 0xc
lea eax, [ebp - 0x1638]
push 0x519ac0
push eax
lea eax, [ebp - 0x844]
push eax
call edi
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4337e1
lea eax, [ebp - 0x844]
push eax
call fcn.00434860
add esp, 4
push 8
mov ecx, esi
call fcn.004323f0
push str.remove_autorun
call fcn.00426260
add esp, 4
lea ecx, [ebp - 0x1639]
call fcn.0043a280
push dword [esi + 8]
lea ecx, [ebp - 0x1639]
mov dword [ebp - 4], 8
call fcn.0043aba0
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call edi
push eax
push esi
push str.Delete_IsAutoRun:_d__err:_u
call fcn.00426260
mov eax, dword [ebp - 0x1648]
lea ecx, [ebp - 0x1639]
add esp, 0xc
push dword [eax]
call fcn.0043aab0
mov esi, eax
call edi
push eax
push esi
push str.Delete_AutoRun:_d__err:_u
call fcn.00426260
add esp, 0xc
lea eax, [ebp - 0x164c]
push eax
push 0x20106
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x433890
lea ecx, [ebp - 0x163a]
call fcn.00431500
push eax
push dword [ebp - 0x164c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1639]
mov dword [ebp - 4], 0xffffffff
call fcn.0043a290
mov edi, dword [ebp - 0x1644]
mov ecx, edi
push 9
call fcn.004323f0
lea ecx, [ebp - 0x163a]
call fcn.00431120
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.00426260
push dword [edi + 8]
push str.start_delete_all_files_in__s
call fcn.00426260
add esp, 0xc
mov ecx, edi
push dword [edi + 8]
call fcn.004325d0
push dword [edi + 8]
push str.end_delete_all_files_in__s
call fcn.00426260
push str..tmp
push dword [edi + 8]
call fcn.00434500
add esp, 0x10
mov ecx, edi
push 0x62
call fcn.004323f0
push str.start_create_runonce_bat
call fcn.00426260
push dword [edi + 8]
lea eax, [edi + 0xc]
push eax
call fcn.00422f10
add esp, 0xc
mov ecx, edi
push 0x63
call fcn.004323f0
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004720f0
mov esi, dword [edi + 8]
lea ecx, [ebp - 0x163a]
add esp, 0xc
call fcn.00430860
push eax
push esi
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1644]
mov dword [ebp - 0x164c], eax
call fcn.0041f5a0
mov ecx, eax
test ecx, ecx
je 0x433ae1
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1644], eax
lea eax, [ebp - 0x628]
mov dword [ebp - 4], 9
push eax
lea ecx, [ebp - 0x1644]
call fcn.00407c80
test al, al
jne 0x4339e2
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4339c0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1644]
call fcn.00409b60
lea ecx, [ebp - 0x163a]
mov dword [ebp - 4], 0xa
call fcn.00430cc0
push eax
lea ecx, [ebp - 0x1640]
call fcn.00406360
push dword [ebp - 0x1640]
lea ecx, [ebp - 0x163a]
mov byte [ebp - 4], 0xb
push dword [ebp - 0x1644]
call fcn.00432030
mov edx, dword [ebp - 0x1640]
or esi, 0xffffffff
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x433a3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1644]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x433a61
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x64
mov ecx, edi
call fcn.004323f0
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1654], 0x4324e0
mov dword [ebp - 0x1650], edi
lea eax, [ebp - 0x1658]
mov dword [ebp - 4], 0xc
push eax
call fcn.0041f8d0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044d79a
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00402ae0
push 0x80004005
call fcn.00402ae0
push 0x80004005
call fcn.00402ae0
push 0x80004005
call fcn.00402ae0
push 0x80004005
call fcn.00402ae0
int3