Function at 0x404160
Capabilities:
Access peb ldr_data
Get common file path
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x42caf3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x830
push ebx
push esi
push edi
xor ebx, ebx
push 0x43a14c
lea ecx, [esp + 0x20]
mov dword [esp + 0x10], ebx
call fcn.004212e1
push 0x43a728
lea ecx, [esp + 0x24]
mov dword [esp + 0x848], ebx
call fcn.004212e1
push str.http:__www.myprotect.co.kr
lea ecx, [esp + 0x1c]
mov byte [esp + 0x848], 1
call fcn.004212e1
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x3d]
mov byte [esp + 0x3c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x3c]
push 0x800
push eax
mov byte [esp + 0x84c], 2
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push str.uninst_myprotect.exe
lea ecx, [esp + 0x30]
call fcn.004212e1
mov esi, eax
push 0x43a198
lea ecx, [esp + 0x3c]
mov byte [esp + 0x848], 3
call fcn.004212e1
mov edi, eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x844], 4
push ecx
lea ecx, [esp + 0x2c]
call fcn.004212e1
push edi
lea edx, [esp + 0x34]
push eax
push edx
mov byte [esp + 0x850], 5
call fcn.004214a2
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x84c], 6
push eax
call fcn.004214a2
lea ecx, [esp + 0x30]
mov byte [esp + 0x844], 0xb
call fcn.00421273
lea ecx, [esp + 0x28]
mov byte [esp + 0x844], 0xa
call fcn.00421273
lea ecx, [esp + 0x38]
mov byte [esp + 0x844], 9
call fcn.00421273
lea ecx, [esp + 0x2c]
mov byte [esp + 0x844], 8
call fcn.00421273
mov dword [esp + 0x24], 1
mov dword [esp + 0x34], ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0x14]
call fcn.004212e1
push 0x43a14c
lea ecx, [esp + 0x14]
mov byte [esp + 0x848], 0xc
call fcn.004215db
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x34]
lea edx, [esp + 0xc]
push ecx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4043c1
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push ebx
push str.DisplayName
push ecx
call esi
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push ebx
push str.DisplayVersion
push edx
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [esp + 0x14]
push 1
push ebx
push str.HelpLink
push eax
call esi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 8]
inc ecx
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push ebx
push str.URLInfoAbout
push ecx
call esi
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push ebx
push str.UninstallString
push edx
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
mov eax, dword [esp + 0x14]
push 1
push ebx
push str.DisplayIcon
push eax
call esi
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x24]
push 4
push ecx
push 4
push ebx
push str.NoModify
push edx
call esi
lea eax, [esp + 0x24]
push 4
push eax
push 4
push ebx
mov ecx, dword [esp + 0x1c]
push str.NoRepair
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov byte [esp + 0x844], 8
call fcn.00421273
lea ecx, [esp + 0x14]
mov byte [esp + 0x844], 2
call fcn.00421273
lea ecx, [esp + 0x18]
mov byte [esp + 0x844], 1
call fcn.00421273
lea ecx, [esp + 0x20]
mov byte [esp + 0x844], bl
call fcn.00421273
lea ecx, [esp + 0x1c]
mov dword [esp + 0x844], 0xffffffff
call fcn.00421273
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x83c
ret