Function at 0x404730
Capabilities:
Check os version
Delete directory
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
push 0xffffffffffffffff
push 0x40816d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa8
push ebx
push ebp
push esi
lea eax, [esp + 0x20]
push edi
mov esi, ecx
push eax
xor ebp, ebp
mov dword [esp + 0x28], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x28]
mov ebx, 1
cmp eax, 6
jb 0x404776
mov ebp, ebx
mov edi, 7
push str.ptclient.exe
mov ecx, esi
call fcn.00402ab0
dec edi
jne 0x40477b
push 0x3e8
call fcn.00406e40
add esp, 4
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_2
test ebp, ebp
mov dword [esp + 0xc0], 0
je 0x404803
lea ecx, [esp + 0x18]
push ecx
call fcn.00404f20
add esp, 4
push str.PicaToolsClientSe7en
lea edx, [esp + 0x18]
push eax
push edx
mov byte [esp + 0xcc], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 2
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0xc0], bl
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0xc0], 0
lea ecx, [esp + 0x18]
jmp 0x404857
lea eax, [esp + 0x14]
push eax
call fcn.00404f20
add esp, 4
push str.PicaToolsClient
lea ecx, [esp + 0x1c]
mov bl, 3
push eax
push ecx
mov byte [esp + 0xcc], bl
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0xc0], bl
call sub.MFC42.DLL_CString::CString
mov byte [esp + 0xc0], 0
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x1c], esp
push edx
call fcn.004078f6
mov ecx, esi
call fcn.00402ef0
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x404885
mov eax, dword [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x18]
push str.ptvd_drivers
push ecx
call fcn.004052c0
add esp, 8
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0xc4], 5
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x18]
mov byte [esp + 0xc0], 0
call sub.MFC42.DLL_CString::CString
push ecx
lea edx, [esp + 0x14]
mov ecx, esp
mov dword [esp + 0x18], esp
push edx
call fcn.004078f6
mov ecx, esi
call fcn.00402ef0
test eax, eax
je 0x4048dd
mov eax, dword [esp + 0x10]
push eax
call edi
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.PicaLiveHelper.exe
push ecx
call fcn.004052c0
add esp, 8
mov ecx, esi
call fcn.00404300
push ecx
mov edx, esp
mov dword [esp + 0x18], esp
push str.PicaToolsHelper.exe
push edx
call fcn.004052c0
add esp, 8
mov ecx, esi
call fcn.00404300
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
push str.pmcashx.ocx
push eax
call fcn.004052c0
add esp, 8
mov ecx, esi
call fcn.00404300
push ecx
mov ecx, esp
mov dword [esp + 0x18], esp
push str.picablank.a__
push ecx
call fcn.004052c0
add esp, 8
mov ecx, esi
call fcn.00404300
push str.SOFTWAREMediaweb
push 0x80000002
mov ecx, esi
call fcn.00404570
push str.SOFTWAREmediawebi_Inc.
push 0x80000002
mov ecx, esi
call fcn.00404570
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsYourApp.exe
push 0x80000002
mov ecx, esi
call fcn.00404570
push str.SOFTWAREMediaweb
push 0x80000001
mov ecx, esi
call fcn.00404570
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x4049c5
mov eax, dword [esp + 0x1c]
push str.ptRun
push eax
call ebx
mov ecx, dword [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call esi
test eax, eax
jne 0x4049fa
mov eax, dword [esp + 0x1c]
push str.ptRun
push eax
call ebx
mov ecx, dword [esp + 0x1c]
push ecx
call edi
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString_2
test ebp, ebp
mov byte [esp + 0xc0], 6
je 0x404a1d
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallD7384136_35BC_49AB_93EB_9A6B728882A6
jmp 0x404a22
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallEDAFEC30_5095_4F0D_AB77_1FD83DCF01BA
lea ecx, [esp + 0x24]
call fcn.004078a2
mov edx, dword [esp + 0x20]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x20]
mov byte [esp + 0xc0], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov dword [esp + 0xc0], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0xb8]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0xb4
ret