Function at 0x419b80
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value
Self delete

Disassembly:
push 0xffffffffffffffff
push 0x462a18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x47dac0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon2
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419cf6
call fcn.004268df
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419be3
push 0x80004005
call fcn.00401820
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0x104
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x419c29
push 0x104
lea ecx, [esp + 0x14]
call fcn.004018a0
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
push esi
push 0
push 0
push str.InstallLocation
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
jne 0x419c4b
xor eax, eax
jmp 0x419c65
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x419c50
sub eax, edx
sar eax, 1
js 0x419df1
cmp eax, dword [esi - 8]
jg 0x419df1
mov dword [esi - 0xc], eax
mov word [esi + eax*2], 0
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SharedAccountConfigConfig.ini
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.00403590
add esp, 0xc
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x419d0a
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419cd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x419cf6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0xc]
mov eax, dword [ecx]
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push edx
push eax
push str.HomePage
push str.Startup
call edi
mov eax, dword [esp + 0xc]
push eax
push str.home
push str.StartPageType
push str.Startup
call edi
mov ecx, dword [esp + 0xc]
push ecx
push 0x46c27c
push str.ConfirmExit
push str.Advanced
call edi
mov edx, dword [esp + 0xc]
push edx
push 0x46c27c
push str.Running
push str.Settings
call edi
call fcn.004268df
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419d84
push 0x80004005
call fcn.00401820
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
push esi
lea ecx, [esp + 0x30]
push str._c_del___sSharedAccountData.ini_
push ecx
mov byte [esp + 0x30], 2
call fcn.00406fd0
mov edi, dword [esp + 0x38]
add esp, 0xc
push 0
push 0
push edi
push str.cmd.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [edi - 0x10]
mov byte [esp + 0x24], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x419cad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x419cad
push 0x80070057
call fcn.00401820
int3