Function at 0x402910
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x4170b4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
push 0x17
push 0
call fcn.00402250
add esp, 0xc
test eax, eax
je 0x402c19
mov byte [ebp - 0x321], 0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x320]
push edx
call fcn.00403d40
add esp, 8
push 0x410ffc
push 2
lea eax, [ebp - 0x32c]
push eax
push 0x415408
push str.42Fibu
push str.EFIBU
call fcn.004017cf
movsx ecx, byte [ebp - 0x32c]
cmp ecx, 0x6a
je 0x4029a1
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x4a
je 0x4029a1
mov dword [ebp - 0x338], 0
jmp 0x4029ab
mov dword [ebp - 0x338], 1
cmp dword [ebp - 0x338], 0
je 0x4029d4
push str.42_SoftwareFinanzbuchhaltung
lea eax, [ebp - 0x218]
push eax
call fcn.00403d50
add esp, 8
mov byte [ebp - 0x321], 1
jmp 0x402bad
push 0x410ffc
push 2
lea ecx, [ebp - 0x32c]
push ecx
push 0x415408
push str.4Master
push str.EFIBU
call fcn.004017cf
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x6a
je 0x402a1a
movsx eax, byte [ebp - 0x32c]
cmp eax, 0x4a
je 0x402a1a
mov dword [ebp - 0x33c], 0
jmp 0x402a24
mov dword [ebp - 0x33c], 1
cmp dword [ebp - 0x33c], 0
je 0x402a46
push str.4Master_Software
lea ecx, [ebp - 0x218]
push ecx
call fcn.00403d50
add esp, 8
jmp 0x402bad
push 0x410ffc
push 2
lea edx, [ebp - 0x32c]
push edx
push 0x415408
push str.Midata
push str.EFIBU
call fcn.004017cf
movsx eax, byte [ebp - 0x32c]
cmp eax, 0x6a
je 0x402a8c
movsx ecx, byte [ebp - 0x32c]
cmp ecx, 0x4a
je 0x402a8c
mov dword [ebp - 0x340], 0
jmp 0x402a96
mov dword [ebp - 0x340], 1
cmp dword [ebp - 0x340], 0
je 0x402ab8
push str.Midata_DMS
lea edx, [ebp - 0x218]
push edx
call fcn.00403d50
add esp, 8
jmp 0x402bad
push 0x410ffc
push 2
lea eax, [ebp - 0x32c]
push eax
push 0x415408
push str.Komda
push str.EFIBU
call fcn.004017cf
movsx ecx, byte [ebp - 0x32c]
cmp ecx, 0x6a
je 0x402afe
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x4a
je 0x402afe
mov dword [ebp - 0x344], 0
jmp 0x402b08
mov dword [ebp - 0x344], 1
cmp dword [ebp - 0x344], 0
je 0x402b2a
push str.Komda_EURO_FIBU
lea eax, [ebp - 0x218]
push eax
call fcn.00403d50
add esp, 8
jmp 0x402bad
push 0x410ffc
push 2
lea ecx, [ebp - 0x32c]
push ecx
push 0x415408
push str.MSOFT
push str.EFIBU
call fcn.004017cf
movsx edx, byte [ebp - 0x32c]
cmp edx, 0x6a
je 0x402b70
movsx eax, byte [ebp - 0x32c]
cmp eax, 0x4a
je 0x402b70
mov dword [ebp - 0x348], 0
jmp 0x402b7a
mov dword [ebp - 0x348], 1
cmp dword [ebp - 0x348], 0
je 0x402b99
push str.MSOFT_EURO_FIBU
lea ecx, [ebp - 0x218]
push ecx
call fcn.00403d50
add esp, 8
jmp 0x402bad
push str._syska_Anwendungen
lea edx, [ebp - 0x218]
push edx
call fcn.00403d50
add esp, 8
movzx eax, byte [ebp - 0x321]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.004022c0
add esp, 8
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 0
jne 0x402c19
movzx edx, byte [ebp - 0x321]
test edx, edx
je 0x402c19
lea eax, [ebp - 0x320]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00403d40
add esp, 8
push str.42_Software
lea edx, [ebp - 0x218]
push edx
call fcn.00403d50
add esp, 8
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004022c0
add esp, 8
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jbe 0x402cd7
lea edx, [ebp - 0x110]
push edx
call fcn.00403e40
add esp, 4
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
movsx ecx, byte [ebp + eax - 0x111]
cmp ecx, 0x5c
je 0x402c7e
push 0x41539c
lea edx, [ebp - 0x110]
push edx
call fcn.00403d50
add esp, 8
mov eax, dword [ebp - 0x330]
add eax, 1
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x334], 0
jmp 0x402c99
mov ecx, dword [ebp - 0x334]
add ecx, 1
mov dword [ebp - 0x334], ecx
cmp dword [ebp - 0x334], 0x27
jge 0x402cd7
mov edx, dword [ebp - 0x334]
mov eax, dword [edx*4 + 0x417018]
push eax
mov ecx, dword [ebp - 0x330]
lea edx, [ebp + ecx - 0x110]
push edx
call fcn.00403d40
add esp, 8
lea eax, [ebp - 0x110]
push eax
call fcn.004021e0
add esp, 4
jmp 0x402c8a
push 0x418820
call fcn.004021e0
add esp, 4
call fcn.00401991
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEFIBU.EXE
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403c0b
mov esp, ebp
pop ebp
ret