Function at 0x42c8b0
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get startup folder
Link many functions at runtime
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51c6ed
mov eax, dword fs:[0]
push eax
mov eax, 0x1478
call fcn.00459470
mov eax, dword [0x56c3c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x143c], eax
lea eax, [ebp - 0x420]
push 0
push eax
mov dword [ebp - 0x1448], 0
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x531cd0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0042b830
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp dword [esi], 0
jne 0x42c9a9
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x42c9a9
push str.HttpInit
push eax
call edi
push str.HttpUninit
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.zlib_uncompress
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.zlib_compress
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.zlib_compressBound
push dword [esi]
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42c9a9
call eax
mov dword [esi + 0xc], eax
mov edi, dword [ebp - 0x143c]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1450], 0x42bd20
mov dword [ebp - 0x144c], edi
lea eax, [ebp - 0x1454]
mov dword [ebp - 4], 0
push eax
call fcn.0042db10
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
push 1
call fcn.0042bc00
push 0x531e14
call fcn.004215a0
mov esi, esp
mov dword [ebp - 0x1430], esp
call fcn.004232b0
push eax
mov ecx, esi
call fcn.0040a230
push ecx
mov dword [ebp - 4], 1
mov esi, esp
call fcn.004221b0
push eax
mov ecx, esi
call fcn.0040a230
mov dword [ebp - 4], 0xffffffff
call fcn.004fad70
mov eax, dword [edi + 8]
lea esi, [edi + 8]
add esp, 8
mov dword [ebp - 0x1438], esi
push dword [eax - 0xc]
push eax
call fcn.0041ffe0
mov ecx, eax
call fcn.0041ffc0
mov ecx, eax
call fcn.00425b00
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.0041ffe0
mov ecx, eax
call fcn.0041ffc0
mov ecx, eax
call fcn.00426510
push dword [esi]
call fcn.004317e0
add esp, 4
mov ecx, edi
push 4
call fcn.0042bc00
push str.start_close_all_processes
call fcn.004215a0
add esp, 4
push esi
call fcn.0041ffe0
mov ecx, eax
call fcn.0041ffc0
push eax
call fcn.004358d0
add esp, 8
mov ecx, edi
push 5
call fcn.0042bc00
call fcn.0042bb50
test al, al
jne 0x42cabd
call fcn.00434430
push str.Remove_Drivers
call fcn.004215a0
add esp, 4
lea eax, [ebp - 0x1428]
lea ecx, [ebp - 0x1421]
push eax
call fcn.0042abf0
push dword [eax]
mov dword [ebp - 4], 2
call fcn.004387c0
mov edx, dword [ebp - 0x1428]
or esi, 0xffffffff
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cb14
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042af70
push dword [eax]
mov dword [ebp - 4], 3
call fcn.00438920
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cb5b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042a890
push dword [eax]
mov dword [ebp - 4], 4
call fcn.004387c0
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cba2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042ae40
push dword [eax]
mov dword [ebp - 4], 5
call fcn.00438920
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cbe9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0042bb50
test al, al
je 0x42cc84
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042a680
push dword [eax]
mov dword [ebp - 4], 6
call fcn.004387c0
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cc3d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042a920
push dword [eax]
mov dword [ebp - 4], 7
call fcn.00438920
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cc84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042ac80
push dword [eax]
mov dword [ebp - 4], 8
call fcn.0043b630
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cccb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1428]
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042ab50
push dword [eax]
mov dword [ebp - 4], 9
call fcn.0043afe0
mov edx, dword [ebp - 0x1428]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cd12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.uninstall_guardhp
call fcn.004215a0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492a50
add esp, 0x10
lea eax, [ebp - 0x1428]
lea ecx, [ebp - 0x1421]
push eax
call fcn.0042a720
push dword [eax]
lea eax, [ebp - 0x218]
push dword [edi + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x1428]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cd73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004230a0
mov ecx, eax
test ecx, ecx
je 0x42d4b6
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1428], eax
lea eax, [ebp - 0x142c]
mov dword [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x1421]
call fcn.0042ad20
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xb
push ecx
push dword [eax]
lea eax, [ebp - 0x1428]
push eax
call fcn.0040c210
mov edx, dword [ebp - 0x142c]
add esp, 0xc
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cde8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1428]
lea eax, [ebp - 0x218]
push 0xffffffffffffffff
push 0
push 0
push 0
push 1
push edi
push eax
call fcn.00436a30
push str.uninstall_HaloBand
call fcn.004215a0
add esp, 4
cmp dword [0x56a0cc], 0
je 0x42cf08
push str.GetNativeSystemInfo
push 0x531420
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42cefe
xorps xmm0, xmm0
mov dword [ebp - 0x1464], 0
lea ecx, [ebp - 0x1484]
push ecx
movups xmmword [ebp - 0x1484], xmm0
movups xmmword [ebp - 0x1474], xmm0
call eax
mov ax, word [ebp - 0x1484]
cmp ax, 9
je 0x42cef4
cmp ax, 6
je 0x42cef4
cmp ax, 0xc
je 0x42cef4
push str.IsWow64Process2
push 0x53144c
mov dword [ebp - 0x1440], 0
mov dword [ebp - 0x142c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1444], eax
test eax, eax
je 0x42ceeb
lea eax, [ebp - 0x142c]
push eax
lea eax, [ebp - 0x1440]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x1444]
test eax, eax
je 0x42ceeb
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x142c], cx
sete al
mov dword [0x56f84c], eax
jmp 0x42cefe
xor eax, eax
mov dword [0x56f84c], eax
jmp 0x42cefe
mov dword [0x56f84c], 1
mov dword [0x56a0cc], 0
cmp dword [0x56f84c], 0
lea ecx, [ebp - 0x1421]
je 0x42cf2e
lea eax, [ebp - 0x1430]
push eax
call fcn.0042aa80
mov byte [ebp - 4], 0xc
mov ecx, 1
jmp 0x42cf3f
lea eax, [ebp - 0x1434]
push eax
call fcn.0042a7d0
mov ecx, 2
push dword [eax]
mov eax, dword [ebp - 0x1438]
mov dword [ebp - 0x142c], ecx
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ecx, dword [ebp - 0x142c]
test cl, 2
je 0x42cf99
mov edx, dword [ebp - 0x1434]
and ecx, 0xfffffffd
mov dword [ebp - 0x142c], ecx
add edx, 0xfffffff0
mov dword [ebp - 0x1448], ecx
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cf99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x142c]
mov dword [ebp - 4], 0xa
test cl, 1
je 0x42cfc2
mov edx, dword [ebp - 0x1430]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42cfc2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.004230a0
mov ecx, eax
test ecx, ecx
je 0x42d4c0
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x142c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x142c]
push str._u__s___s_
push eax
call fcn.0040c210
add esp, 0xc
lea eax, [ebp - 0x1434]
lea ecx, [ebp - 0x1421]
push eax
call fcn.0042aed0
mov dword [ebp - 0x1430], eax
mov esi, dword [ebp - 0x142c]
mov byte [ebp - 4], 0xe
cmp dword [esi - 4], 1
jle 0x42d042
push dword [esi - 0xc]
lea ecx, [ebp - 0x142c]
call fcn.00408290
mov esi, dword [ebp - 0x142c]
mov eax, dword [ebp - 0x1430]
push 0xffffffffffffffff
push 0
push 0
push 0
push 1
push esi
push dword [eax]
call fcn.00436a30
mov edx, dword [ebp - 0x1434]
or eax, 0xffffffff
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d076
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.uninstall_mininnews
call fcn.004215a0
add esp, 4
lea eax, [ebp - 0x1430]
lea ecx, [ebp - 0x1421]
push eax
call fcn.0042a9c0
push dword [eax]
mov eax, dword [ebp - 0x1438]
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x1430]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d0ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x7d0
push 0
push 1
push 0
push 1
push str._uninstall
lea eax, [ebp - 0x218]
push eax
call fcn.00436a30
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0xa
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42d106
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x42d124
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
push str.remove_desktop_shortcuts
call fcn.004215a0
mov edi, dword [ebp - 0x143c]
add esp, 4
mov ecx, edi
call fcn.0042c310
push 6
mov ecx, edi
call fcn.0042bc00
push str.remove_start_menu_shortcuts
call fcn.004215a0
push 0x800
lea eax, [ebp - 0xc20]
push 0
push eax
call fcn.00492a50
add esp, 0x10
lea eax, [ebp - 0xc20]
push 1
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x800
lea eax, [ebp - 0x1420]
push 0
push eax
call fcn.00492a50
add esp, 0xc
lea eax, [ebp - 0xc20]
push 0x5321b0
push eax
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1420]
push eax
call fcn.00430df0
push str.remove_themedata
call fcn.004215a0
lea eax, [ebp - 0x142c]
push eax
call fcn.0042b8c0
add esp, 0xc
push dword [ebp - 0x142c]
mov dword [ebp - 4], 0xf
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42d1f3
push dword [ebp - 0x142c]
call fcn.00430df0
add esp, 4
mov edx, dword [ebp - 0x142c]
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x42d215
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 7
mov ecx, edi
call fcn.0042bc00
push str.remove_appdata
call fcn.004215a0
push 0x800
lea eax, [ebp - 0xc20]
push 0
push eax
call fcn.00492a50
add esp, 0x10
lea eax, [ebp - 0xc20]
push 1
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0041ffe0
cmp dword [eax + 0x120], 0
je 0x42d30d
push 0x208
lea eax, [ebp - 0xe28]
push 0
push eax
call fcn.00492a50
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492a50
add esp, 0x18
lea eax, [ebp - 0xc20]
push str.HaloDesktopDataConfig.ini
push eax
lea eax, [ebp - 0xe28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xe28]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0x52d04c
push str.CloudRootPath
push str.Cloud
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x42d2ef
lea eax, [ebp - 0x218]
push eax
call fcn.00430740
add esp, 4
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
je 0x42d313
lea eax, [ebp - 0x218]
push eax
call fcn.00430df0
add esp, 4
jmp 0x42d313
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push str.HaloDesktopData
lea eax, [ebp - 0xc20]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xc20]
push eax
call esi
test eax, eax
je 0x42d342
lea eax, [ebp - 0xc20]
push eax
call fcn.00430df0
add esp, 4
push 8
mov ecx, edi
call fcn.0042bc00
push dword [edi + 8]
call fcn.0043a1b0
push str.remove_file_by_registry
call fcn.004215a0
lea esi, [edi + 0xc]
push esi
push str.SOFTWAREHaloDesktop_file_list
push dword [edi + 8]
call fcn.00432200
push esi
push str.SOFTWAREHaloDesktop_file_pe
push dword [edi + 8]
call fcn.00432200
push str.remove_registry
call fcn.004215a0
add esp, 0x24
mov ecx, edi
call fcn.0042c400
push 8
mov ecx, edi
call fcn.0042bc00
push str.remove_autorun
call fcn.004215a0
add esp, 4
lea ecx, [ebp - 0x1421]
call fcn.00439620
push dword [edi + 8]
lea ecx, [ebp - 0x1421]
mov dword [ebp - 4], 0x10
call fcn.00439820
push str.Delete_AutoRun
call fcn.004215a0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1421]
call fcn.00439630
push 9
mov ecx, edi
call fcn.0042bc00
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallHaloDesktop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.004215a0
push dword [edi + 8]
push str.start_delete_all_files_in__s
call fcn.004215a0
add esp, 0xc
mov ecx, edi
push dword [edi + 8]
call fcn.0042bde0
push dword [edi + 8]
push str.end_delete_all_files_in__s
call fcn.004215a0
push str..tmp
push dword [edi + 8]
call fcn.00430a90
add esp, 0x10
mov ecx, edi
push 0x62
call fcn.0042bc00
push str.start_create_runonce_bat
call fcn.004215a0
push dword [edi + 8]
push esi
call fcn.00433c50
add esp, 0xc
mov ecx, edi
push 0x64
call fcn.0042bc00
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x145c], 0x42bcf0
mov dword [ebp - 0x1458], edi
lea eax, [ebp - 0x1460]
mov dword [ebp - 4], 0x11
push eax
call fcn.0042db10
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045945a
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00404b60
push 0x80004005
call fcn.00404b60
int3