Function at 0x401f80
Capabilities:
Check for time delay via gettickcount
Delete file
Get installed programs
Hide graphical window
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x412976
mov eax, dword fs:[0]
push eax
sub esp, 0xc44
mov eax, dword [0x417050]
xor eax, esp
mov dword [esp + 0xc40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x417050]
xor eax, esp
push eax
lea eax, [esp + 0xc58]
mov dword fs:[0], eax
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xc60], ebx
push esi
push ebx
mov edx, str.EPUninstHideLogButton
mov ecx, str.Options
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
call fcn.004045b0
test eax, eax
setne al
push esi
push ebx
mov edx, str.UninstallRebootable
mov ecx, str.Options
mov byte [0x418e2c], al
call fcn.004045b0
test eax, eax
setne cl
mov byte [0x418e30], cl
push esi
push ebx
mov edx, str.AutoUninstIni
mov ecx, str.Options
call fcn.004045b0
test eax, eax
setne dl
mov byte [0x418e2e], dl
push esi
push ebx
mov edx, str.AutoUninstDat
mov ecx, str.Options
call fcn.004045b0
add esp, 0x20
push 0x104
lea ecx, [esp + 0x768]
test eax, eax
push ecx
setne al
push ebx
mov byte [0x418e2d], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, dword [0x418e38]
mov edi, dword [sym.imp.COMCTL32.dll_CreateMappedBitmap]
push ebx
push ebx
push ebx
push 0x69
push edx
call edi
push ebx
push ebx
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [0x418e38]
push 0x68
push eax
call edi
mov ecx, dword [0x418e38]
push ebx
push ebx
push ebx
push 0x6a
mov ebp, eax
push ecx
mov dword [esp + 0x44], ebp
call edi
mov edi, eax
push str.UninstallKey
push str.Options
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x454]
call fcn.004044e0
add esp, 8
cmp byte [esp + 0x44c], 0
jne 0x4020de
mov ecx, 4
call fcn.00404db0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x402bdc
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea edx, [esp + 0x558]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x414c6c
lea eax, [esp + 0x558]
push eax
call ebx
lea ecx, [esp + 0x44c]
push ecx
lea edx, [esp + 0x558]
push edx
call ebx
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x38]
push ecx
push 0
push 1
push 0
push 0
push 0
lea edx, [esp + 0x570]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4020c8
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x388]
push ecx
lea edx, [esp + 0x44]
push edx
push 0
push str.DisplayName
push eax
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x384]
push edx
lea eax, [esp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [0x418e38]
push 0x100
push 0x418c28
push 0xb
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x384]
push edx
lea eax, [esp + 0x190]
push 0x418c28
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x134
lea ecx, [esp + 0x388]
push ecx
lea edx, [esp + 0x194]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4020d2
mov eax, dword [0x418e38]
push 0
push 0x405070
push 0
push 0x64
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
lea ecx, [esp + 0x384]
push ecx
push eax
mov dword [0x418e34], eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x418e34]
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
push 0
push 0x172
push 0x3f0
push edx
call ebx
mov eax, dword [0x418e34]
push edi
push 0
push 0x172
push 0x3f1
push eax
call ebx
mov ecx, dword [0x418e34]
push edi
push 0
push 0x172
push 0x3f2
push ecx
call ebx
mov edx, dword [0x418e34]
push ebp
push 0
push 0x172
push 0x3f0
push edx
call ebx
mov eax, dword [0x418e34]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00401150
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edi, edi
cmp byte [0x418e31], 0
mov dword [esp + 0x18], eax
jne 0x402bdc
mov ebp, dword [sym.imp.USER32.dll_LoadStringA]
push 0xa
push 0x1f4
lea ecx, [esp + 0x194]
push ecx
push edi
call fcn.004061dd
lea edx, [esp + 0x19c]
push edx
push str.RegServer
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add edi, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x40234f
lea ecx, [esp + 0x84]
call fcn.00401330
test eax, eax
push 0x100
push 0x418c28
jl 0x402318
mov eax, dword [0x418e38]
push 0xd
push eax
jmp 0x402321
mov ecx, dword [0x418e38]
push 0xe
push ecx
call ebp
push 0x418c28
lea edx, [esp + 0x88]
push edx
push 0x414c85
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x4022af
jmp 0x402bdc
xor ebp, ebp
cmp byte [0x418e31], 0
jne 0x402bdc
mov edi, edi
push 0xa
push 0x1f4
lea eax, [esp + 0x194]
push eax
push ebp
call fcn.004061dd
lea ecx, [esp + 0x19c]
push ecx
push str.Files
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add ebp, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x4024ef
lea edx, [esp + 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + eax + 0x84]
push eax
lea ecx, [esp + 0x88]
push ecx
call dword [sym.imp.USER32.dll_CharPrevA]
mov edi, eax
movzx edx, byte [edi]
push edx
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
jne 0x40248c
cmp byte [edi], 0x5c
jne 0x40248c
push ebx
call fcn.0040522d
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
je 0x40240c
push 0x104
push ebx
push edi
call fcn.00409ae0
add esp, 0xc
jmp 0x40240e
xor edi, edi
lea eax, [esp + 0x84]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, edi
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], bl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x402432
sub eax, edx
push eax
push edi
lea ecx, [esp + 0x50]
call fcn.00403e60
mov byte [esp + 0xc60], 1
lea ecx, [esp + 0x48]
lea eax, [esp + 0x20]
call fcn.00402dd0
mov byte [esp + 0xc60], 0
cmp dword [esp + 0x60], 0x10
jb 0x402479
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.00406205
add esp, 4
mov dword [esp + 0x60], 0xf
mov dword [esp + 0x5c], ebx
mov byte [esp + 0x4c], 0
jmp 0x4024dd
lea edx, [esp + 0x84]
push edx
call fcn.004017f0
add esp, 4
test al, al
push 0x100
push 0x418c28
je 0x4024b4
mov eax, dword [0x418e38]
push 8
push eax
jmp 0x4024bd
mov ecx, dword [0x418e38]
push 9
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea edx, [esp + 0x88]
push edx
push 0x414c85
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x402360
jmp 0x402bdc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, dword [esp + 0x18]
sub eax, edi
cmp eax, 0x3e8
jae 0x402514
call fcn.00404c00
call ebx
sub eax, edi
cmp eax, 0x3e8
jb 0x402504
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x418e34]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push eax
push 0
push 0x172
push 0x3f0
push ecx
call edi
mov edx, dword [esp + 0x30]
mov eax, dword [0x418e34]
push edx
push 0
push 0x172
push 0x3f1
push eax
call edi
call fcn.00404c00
call ebx
push esi
push 0
mov edx, str.CommonGroup
mov ecx, str.Group
mov dword [esp + 0x20], eax
call fcn.004045b0
add esp, 8
test eax, eax
setne cl
xor edi, edi
cmp byte [0x418e31], 0
mov byte [esp + 0x44], cl
jne 0x402bdc
mov ebp, dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x402590
push 0xa
push 0x1f4
lea edx, [esp + 0x194]
push edx
push edi
call fcn.004061dd
lea eax, [esp + 0x19c]
push eax
push str.Group
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add edi, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x402665
mov ecx, dword [esp + 0x44]
push ecx
lea ebx, [esp + 0x88]
call fcn.004015f0
add esp, 4
test al, al
setne al
test al, al
je 0x402653
mov edx, dword [0x418e38]
push 0x100
push 0x418c28
push 0xa
push edx
call ebp
mov eax, ebx
push eax
lea ecx, [esp + 0x870]
push 0x418c28
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov edx, dword [0x418e38]
add esp, 0xc
push 0x100
push 0x418c28
push 8
push edx
call ebp
push 0x418c28
lea eax, [esp + 0x870]
push eax
push 0x414c85
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x402590
jmp 0x402bdc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, dword [esp + 0x18]
sub eax, edi
cmp eax, 0x3e8
jae 0x402690
lea ebx, [ebx]
call fcn.00404c00
call ebx
sub eax, edi
cmp eax, 0x3e8
jb 0x402680
mov ecx, dword [esp + 0x1c]
mov edx, dword [0x418e34]
mov edi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push ecx
push 0
push 0x172
push 0x3f1
push edx
call edi
mov eax, dword [esp + 0x30]
mov ecx, dword [0x418e34]
push eax
push 0
push 0x172
push 0x3f2
push ecx
call edi
call fcn.00404c00
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
cmp byte [0x418e31], 0
mov dword [esp + 0x18], eax
jne 0x402bdc
jmp 0x4026f0
push 0xa
push 0x1f4
lea edx, [esp + 0x194]
push edx
push ebp
call fcn.004061dd
lea eax, [esp + 0x19c]
push eax
push str.Registry_CURRENT_USER
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add ebp, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x4027c1
xor edi, edi
lea eax, [esp + 0x84]
mov ebx, 0x80000001
call fcn.00401570
test eax, eax
jne 0x402778
mov ecx, dword [0x418e38]
push 0x100
push 0x418c28
push 8
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea edx, [esp + 0x88]
push edx
jmp 0x4027a2
cmp eax, 1
je 0x4027af
mov eax, dword [0x418e38]
push 0x100
push 0x418c28
push 9
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea ecx, [esp + 0x88]
push ecx
push str.HKEY_CURRENT_USER__
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x4026f0
jmp 0x402bdc
xor ebp, ebp
cmp byte [0x418e31], 0
jne 0x402bdc
push 0xa
push 0x1f4
lea edx, [esp + 0x194]
push edx
push ebp
call fcn.004061dd
lea eax, [esp + 0x19c]
push eax
push str.Registry_CLASSES_ROOT
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add ebp, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x4028a1
xor edi, edi
lea eax, [esp + 0x84]
mov ebx, 0x80000000
call fcn.00401570
test eax, eax
jne 0x402858
mov ecx, dword [0x418e38]
push 0x100
push 0x418c28
push 8
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea edx, [esp + 0x88]
push edx
jmp 0x402882
cmp eax, 1
je 0x40288f
mov eax, dword [0x418e38]
push 0x100
push 0x418c28
push 9
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea ecx, [esp + 0x88]
push ecx
push str.HKEY_CLASSES_ROOT__
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x4027d0
jmp 0x402bdc
xor ebp, ebp
cmp byte [0x418e31], 0
jne 0x402bdc
push 0xa
push 0x1f4
lea edx, [esp + 0x194]
push edx
push ebp
call fcn.004061dd
lea eax, [esp + 0x19c]
push eax
push str.Registry_LOCAL_MACHINE
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add ebp, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x40296b
xor edi, edi
lea eax, [esp + 0x84]
mov ebx, 0x80000002
call fcn.00401570
test eax, eax
jne 0x402934
mov ecx, dword [0x418e38]
push 0x100
push 0x418c28
push 8
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x418c28
lea edx, [esp + 0x88]
push edx
jmp 0x40294c
cmp eax, 1
je 0x402959
mov eax, 9
call fcn.00401000
push eax
lea eax, [esp + 0x88]
push eax
push str.HKEY_LOCAL_MACHINE__
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x4028b0
jmp 0x402bdc
xor ebp, ebp
cmp byte [0x418e31], 0
jne 0x402a1b
push 0xa
push 0x1f4
lea ecx, [esp + 0x194]
push ecx
push ebp
call fcn.004061dd
lea edx, [esp + 0x19c]
push edx
push str.Registry_USERS
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x9c]
add ebp, 1
call fcn.004044e0
add esp, 0x18
cmp byte [esp + 0x84], 0
je 0x402a34
xor edi, edi
lea eax, [esp + 0x84]
mov ebx, 0x80000003
call fcn.00401570
test eax, eax
jne 0x4029e9
lea eax, [edi + 8]
call fcn.00401000
push eax
lea eax, [esp + 0x88]
push eax
jmp 0x402a01
cmp eax, 1
je 0x402a0e
mov eax, 9
call fcn.00401000
push eax
lea ecx, [esp + 0x88]
push ecx
push str.HKEY_USERS__
call fcn.004011d0
add esp, 0xc
cmp byte [0x418e31], 0
je 0x40297a
mov dword [esp + 0xc60], 0xffffffff
lea esi, [esp + 0x20]
call fcn.00402d60
jmp 0x402d31
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov edi, dword [esp + 0x18]
sub eax, edi
cmp eax, 0x3e8
jae 0x402a60
lea esp, [esp]
call fcn.00404c00
call ebx
sub eax, edi
cmp eax, 0x3e8
jb 0x402a50
mov edx, dword [esp + 0x1c]
mov eax, dword [0x418e34]
push edx
push 0
push 0x172
push 0x3f2
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
call fcn.00404c00
call fcn.00401240
mov ecx, dword [0x418e34]
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push ecx
mov byte [0x418e32], 1
call ebp
mov edi, eax
mov eax, 7
call fcn.00401000
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 5
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
call edi
mov edx, dword [0x418e34]
push 0x3ef
push edx
call ebp
cmp byte [0x418e2c], 0
jne 0x402ada
push 5
push eax
call edi
mov eax, 6
call fcn.00401000
push eax
mov eax, dword [0x418e34]
push 0x3eb
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x74]
push ecx
call edi
test eax, eax
je 0x402b54
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea esp, [esp]
mov eax, dword [0x418e34]
lea edx, [esp + 0x68]
push edx
push eax
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x402b43
lea ecx, [esp + 0x68]
push ecx
call ebp
lea edx, [esp + 0x68]
push edx
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x74]
push eax
call edi
test eax, eax
jne 0x402b20
cmp byte [0x418e2f], 0
mov byte [esp + 0x16], 1
je 0x402b89
push 0x134
push 0x414e74
mov eax, 0xc
call fcn.00401000
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402b89
mov byte [esp + 0x17], 1
push str.UninstFile
push str.General
mov eax, esi
mov ebx, 0x104
lea ecx, [esp + 0x664]
call fcn.004044e0
push esi
push 0xffffffffffffffff
mov edx, str.UninstSrcProcess
mov ecx, str.General
call fcn.004045b0
add esp, 0x10
push esi
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [esp + 0x44c]
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ebx, 0x80000002
call fcn.00401570
push str.EXEpressUninstallSyncEvent
push 0
push 2
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call edi
mov ecx, dword [esp + 0x38]
push ecx
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402c21
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call ebx
cmp byte [esp + 0x16], 0
je 0x402c82
lea edx, [esp + 0x65c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [esp + 0x28]
cmp dword [esp + 0x24], ebp
je 0x402c86
mov esi, dword [esp + 0x24]
add esi, 4
mov edi, 0x10
lea esp, [esp]
cmp dword [esi + 0x14], edi
jb 0x402c69
mov eax, dword [esi]
jmp 0x402c6b
mov eax, esi
push 0
push eax
call fcn.00401cd0
add esi, 0x1c
lea eax, [esi - 4]
add esp, 8
cmp eax, ebp
jne 0x402c60
jmp 0x402c86
mov ebp, dword [esp + 0x28]
push 0x1f4
lea ecx, [esp + 0x190]
push ecx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea esi, [esp + 0x18c]
call fcn.00401e90
cmp byte [esp + 0x17], 0
je 0x402cda
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov esi, eax
call edi
sub eax, esi
cmp eax, 0x3e8
ja 0x402cd3
push 1
call ebx
call edi
sub eax, esi
cmp eax, 0x3e8
jbe 0x402cc4
call fcn.00401f30
xor edi, edi
mov dword [esp + 0xc60], 0xffffffff
mov ebx, dword [esp + 0x24]
cmp ebx, edi
je 0x402d25
cmp ebx, ebp
je 0x402d1c
lea esi, [ebx + 0x18]
cmp dword [esi], 0x10
jb 0x402d05
mov edx, dword [esi - 0x14]
push edx
call fcn.00406205
add esp, 4
mov dword [esi], 0xf
mov dword [esi - 4], edi
mov byte [esi - 0x14], 0
add esi, 0x1c
lea eax, [esi - 0x18]
cmp eax, ebp
jne 0x402cf4
push ebx
call fcn.00406205
add esp, 4
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
xor eax, eax
mov ecx, dword [esp + 0xc58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc40]
xor ecx, esp
call fcn.004052f5
add esp, 0xc50
ret