Function at 0x401365
Capabilities:
Delete directory
Delete file
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1e48
call fcn.00401c60
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
push edi
je 0x40185f
cmp word [esi], bx
je 0x40185f
lea eax, [ebp - 0x628]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x628]
push 0x403384
push eax
call edi
lea eax, [ebp - 0x628]
push esi
push eax
call edi
lea eax, [ebp - 0x628]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00401be8
test eax, eax
je 0x4013e6
lea eax, [ebp - 0x628]
push 0x10
push eax
jmp 0x40143c
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41e]
mov word [ebp - 0x420], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.AppPath
mov dword [ebp - 8], 0x208
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x401435
cmp dword [ebp - 0xc], 1
jne 0x401435
xor eax, eax
cmp eax, ebx
je 0x40145d
push 0x10
push 0x403028
push 0x403578
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 4], ebx
je 0x401456
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4019b5
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa36]
mov word [ebp - 0xa38], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.AppUninst
xor edi, edi
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x4014f8
cmp dword [ebp - 0xc], 1
jne 0x4014f8
mov edi, dword [ebp - 8]
xor eax, eax
shr edi, 1
cmp eax, ebx
jne 0x4014f8
cmp edi, ebx
je 0x4014f8
mov ecx, 0x108
lea edi, [ebp - 0x126a]
mov word [ebp - 0x126c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x126c]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x126c]
push 0xa
push eax
call fcn.004019ba
add esp, 0x18
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc3e]
mov word [ebp - 0xc40], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.ThirdPart
push dword [ebp - 4]
call esi
cmp dword [ebp - 4], ebx
je 0x401542
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
lea ecx, [ebp - 4]
call fcn.00401be8
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x40157c
push dword [ebp + 8]
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x40157c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa38]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4015df
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
lea ecx, [ebp - 4]
mov word [esi], bx
call fcn.00401be8
test eax, eax
jne 0x4015df
add esi, 2
push esi
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x4015df
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x420]
push ebx
push eax
call fcn.004011c1
add esp, 0xc
test eax, eax
je 0x401603
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp + 8]
lea eax, [ebp - 0x420]
push 2
push eax
call fcn.004011c1
add esp, 0xc
test eax, eax
je 0x401628
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x218]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c4]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x1a
push eax
call fcn.004011c1
add esp, 0xc
test eax, eax
je 0x401680
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push 0x403384
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x218]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push dword [eax + 0x403244]
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x218]
push eax
call fcn.0040100f
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x20
pop ecx
jb 0x4016be
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 8]
push dword [eax + 0x403230]
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x218]
push eax
call fcn.004010d2
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x14
pop ecx
jb 0x4016e6
push dword [0x403020]
lea eax, [ebp - 0x1e48]
push 0x40345c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1e48]
push 0x34
push 0x403028
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x40176f
push str.Lyrics
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x218]
push eax
call fcn.004010d2
mov dword [esp], str.CDDB
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x218]
push eax
call fcn.004010d2
pop ecx
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp word [ebp - 0xc40], bx
je 0x401849
lea eax, [ebp - 0x628]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call esi
lea eax, [ebp - 0x628]
push 0x403384
push eax
call edi
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x628]
push eax
call edi
lea eax, [ebp - 0x628]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
call fcn.00401be8
test eax, eax
jne 0x401849
mov ecx, 0x81
lea edi, [ebp - 0x82e]
mov word [ebp - 0x830], bx
mov dword [ebp + 8], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
xor esi, esi
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.UninstallString
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401838
cmp dword [ebp - 0xc], 1
jne 0x401838
mov esi, dword [ebp + 8]
xor eax, eax
shr esi, 1
cmp eax, ebx
jne 0x401838
cmp esi, ebx
je 0x401838
lea eax, [ebp - 0x830]
push 0xa
push eax
call fcn.004019ba
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x401857
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x401857
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x4019b5
mov edi, dword [str.CSCSY]
lea eax, [ebp - 0xe48]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xe48]
push 0x403384
push eax
call esi
lea eax, [ebp - 0xe48]
push edi
push eax
call esi
lea eax, [ebp - 0xe48]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.00401be8
test eax, eax
je 0x4018dc
push 0x10
push 0x403028
push 0x403578
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x401456
push dword [ebp + 8]
jmp 0x401450
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82e]
mov word [ebp - 0x830], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.DisplayName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov edi, 0x403028
jne 0x401987
cmp dword [ebp - 8], 1
jne 0x401987
xor eax, eax
cmp eax, ebx
jne 0x401987
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4033fc
push edi
call esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x1648]
push 0x4033c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1648]
push 0x34
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x401987
cmp dword [ebp + 8], ebx
je 0x401857
push dword [ebp + 8]
jmp 0x401851
push dword [ebp - 0x10]
call fcn.004011ff
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4019a5
push 0x10
push edi
push 0x4033b0
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x4019b3
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret