Function at 0x434b30
Capabilities:
Check if file exists
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596779
mov eax, dword fs:[0]
push eax
sub esp, 0xc48
mov eax, dword [0x61ce74]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.utilityinstall.ini
push dword [0x6299d4]
lea eax, [ebp - 0xc48]
push eax
call fcn.004430a0
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00540d70
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x218]
add esp, 0x18
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push str.suitepackage
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0x218]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434bec
test dx, dx
je 0x434be8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434bec
add eax, 4
add ecx, 4
test dx, dx
jne 0x434bc6
xor eax, eax
jmp 0x434bf1
sbb eax, eax
or eax, 1
or edi, 0xffffffff
test eax, eax
jne 0x435159
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x420]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push str.foxmail
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0x420]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434c66
test dx, dx
je 0x434c62
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434c66
add eax, 4
add ecx, 4
test dx, dx
jne 0x434c40
xor eax, eax
jmp 0x434c6b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434d29
push str.Foxmail
push dword [0x61b434]
lea eax, [ebp - 0xc50]
push eax
call fcn.004430a0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 1
push 0x80000002
push eax
call fcn.0045bfb0
add esp, 0x1c
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434cca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x434d0e
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5b4734
push eax
call fcn.00474e60
push eax
push str.1023_tKAllAux::UninstallSuite_tUninstall_Foxmail_return__d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434d29
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x628]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push str.foxitreader
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0x628]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434d96
test dx, dx
je 0x434d92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434d96
add eax, 4
add ecx, 4
test dx, dx
jne 0x434d70
xor eax, eax
jmp 0x434d9b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x434e40
push str.utilityPhantomSetup.exe
push dword [0x6299d4]
lea eax, [ebp - 0xc44]
push eax
call fcn.004430a0
add esp, 0xc
push dword [ebp - 0xc44]
mov byte [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x434e1f
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.UnInstall
push dword [ebp - 0xc44]
call fcn.00474e60
add esp, 0x1c
mov esi, eax
push dword [ebp - 0xc44]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
push str.1036_tKAllAux::UninstallSuite_tUninstall_FoxitReader_return__d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0x14
mov edx, dword [ebp - 0xc44]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434e40
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0x830]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push str.sogou
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0x830]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x434eaa
test dx, dx
je 0x434ea6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x434eaa
add eax, 4
add ecx, 4
test dx, dx
jne 0x434e84
xor eax, eax
jmp 0x434eaf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x435027
push str.Sogou_Input
push dword [0x61b434]
lea eax, [ebp - 0xc50]
push eax
call fcn.004430a0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 5
push 0x80000002
push eax
call fcn.0045bfb0
add esp, 0x1c
mov edx, dword [ebp - 0xc50]
mov eax, edi
mov byte [ebp - 4], 7
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x434f0e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xc44]
mov ebx, dword [edx - 0xc]
mov dword [ebp - 0xc4c], ebx
test ebx, ebx
je 0x43500c
js 0x435309
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x434f4e
push ebx
lea ecx, [ebp - 0xc44]
call fcn.00426250
mov edx, dword [ebp - 0xc44]
lea eax, [edx + ebx*2]
mov ecx, edx
mov dword [ebp - 0xc54], eax
cmp edx, eax
jae 0x434fa3
lea ecx, [ecx]
cmp word [edx], 0x22
lea ebx, [edx + 2]
je 0x434f8e
lea edi, [ecx + 2]
xor esi, esi
cmp ecx, edi
je 0x434f8e
cmp esi, 1
jae 0x434f88
mov ax, word [edx]
inc esi
mov word [ecx], ax
add edx, 2
add ecx, 2
cmp ecx, edi
jne 0x434f72
mov eax, dword [ebp - 0xc54]
mov edx, ebx
cmp ebx, eax
jb 0x434f60
mov ebx, dword [ebp - 0xc4c]
or edi, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
sub edx, ecx
xor eax, eax
sar edx, 1
sub ebx, edx
mov word [ecx], ax
js 0x435309
mov eax, dword [ebp - 0xc44]
cmp ebx, dword [eax - 8]
jg 0x435309
xor ecx, ecx
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0xc44]
push ecx
push 1
push ecx
push ecx
push 0xffffffffffffffff
mov word [eax + ebx*2], cx
push 0x5b4734
push dword [ebp - 0xc44]
call fcn.00474e60
push eax
push str.1049_tKAllAux::UninstallSuite_tUninstall_Sogou_return__d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov edx, dword [ebp - 0xc44]
add esp, 0x30
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435027
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0xa38]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push str.istylepdf
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0xa38]
jmp 0x435070
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x435096
test dx, dx
je 0x435092
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x435096
add eax, 4
add ecx, 4
test dx, dx
jne 0x435070
xor eax, eax
jmp 0x43509b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x435159
push str.iStylePDF
push dword [0x61b434]
lea eax, [ebp - 0xc4c]
push eax
call fcn.004430a0
push str.UninstallString
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 8
push 0x80000002
push eax
call fcn.0045bfb0
add esp, 0x1c
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4350fa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x43513e
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push 0x5b4734
push eax
call fcn.00474e60
push eax
push str.1061_tKAllAux::UninstallSuite_tUninstall_iStylePDF_return__d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0xc44]
add esp, 0x30
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435159
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.00540d70
add esp, 0xc
lea eax, [ebp - 0xc40]
push dword [ebp - 0xc48]
push 0x104
push eax
push 0x5b151c
push 0x5b492c
push str.installinfo
call esi
mov ecx, 0x5b3ec4
lea eax, [ebp - 0xc40]
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4351c6
test dx, dx
je 0x4351c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4351c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4351a0
xor eax, eax
jmp 0x4351cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4352c6
push str.PowerWord2012cut
push dword [0x61b3d8]
lea eax, [ebp - 0xc4c]
push eax
call fcn.004430a0
push str.PathName
push dword [eax]
lea eax, [ebp - 0xc44]
mov byte [ebp - 4], 0xb
push 0x80000002
push eax
call fcn.0045bfb0
add esp, 0x1c
mov edx, dword [ebp - 0xc4c]
mov eax, edi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43522a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc44]
cmp dword [eax - 0xc], 0
je 0x4352ab
push str.Uninst.exe
push eax
lea eax, [ebp - 0xc54]
push eax
call fcn.004430a0
push 0
push 1
push 0
push 0
push 0xffffffffffffffff
push str.48E32C2A_4A45_43CB_9BE3_C26F201CD20D__s
push dword [eax]
mov byte [ebp - 4], 0xe
call fcn.00474e60
mov edx, dword [ebp - 0xc54]
mov esi, eax
add esp, 0x28
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x435288
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push esi
push str.1075_tKAllAux::UninstallSuite_tUninstall_Ksd_return__d
push str.T:_tmp_3174_1630465749774Coding_support_newsetup_srccommonapponlyonekaux.cpp
push str._INFO_
push 0x629b08
call fcn.004638c0
mov eax, dword [ebp - 0xc44]
add esp, 0x14
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4352c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x4352e8
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d079
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00425f50
int3