Function at 0x42fa80
Capabilities:
Check if file exists
Delete registry key
Get common file path
Link many functions at runtime
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50dc87
mov eax, dword fs:[0]
push eax
mov eax, 0x1d80
call fcn.00445e50
mov eax, dword [0x55a2d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x1d58], eax
lea eax, [ebp - 0x528]
push 0
push eax
call fcn.004814e0
add esp, 0xc
lea eax, [ebp - 0x528]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x521080
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.0042ef80
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp dword [esi], 0
jne 0x42fb6f
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi], eax
test eax, eax
je 0x42fb6f
push str.HttpInit
push eax
call edi
push str.HttpUninit
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.zlib_uncompress
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.zlib_compress
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.zlib_compressBound
push dword [esi]
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x42fb6f
call eax
mov dword [esi + 0xc], eax
mov edi, dword [ebp - 0x1d58]
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1540], 0x42f170
mov dword [ebp - 0x153c], edi
lea eax, [ebp - 0x1544]
mov dword [ebp - 4], 0
push eax
call fcn.004311e0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, edi
push 1
call fcn.0042f050
push 0x521154
call fcn.00428660
mov esi, esp
mov dword [ebp - 0x1d50], esp
call fcn.00420e70
push eax
mov ecx, esi
call fcn.0040a1b0
push ecx
mov dword [ebp - 4], 1
mov esi, esp
call fcn.0041fbe0
push eax
mov ecx, esi
call fcn.0040a1b0
mov dword [ebp - 4], 0xffffffff
call fcn.004dd830
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004814e0
add esp, 0x14
lea eax, [ebp - 0x218]
add edi, 8
mov dword [ebp - 0x1d64], edi
push 0x51d984
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0x1770
lea eax, [ebp - 0x1d54]
mov dword [ebp - 0x1d54], 0
push eax
push 1
push 0
push 1
push str.__uninstall
lea eax, [ebp - 0x218]
push eax
call fcn.00432510
lea eax, [ebp - 0x1d54]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e570
push dword [eax]
mov dword [ebp - 4], 2
call fcn.00428660
mov edx, dword [ebp - 0x1d54]
or esi, 0xffffffff
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42fca1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x210
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004814e0
add esp, 0xc
lea eax, [ebp - 0x1d54]
lea ecx, [ebp - 0x1d49]
push eax
call fcn.0042eae0
push dword [eax]
lea eax, [ebp - 0x220]
push dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x1d54]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42fcf7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00421fb0
mov ecx, eax
test ecx, ecx
je 0x430b68
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1d68], eax
lea eax, [ebp - 0x1d54]
mov dword [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e870
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 4
push ecx
push dword [eax]
lea eax, [ebp - 0x1d68]
push eax
call fcn.0040c190
mov edx, dword [ebp - 0x1d54]
add esp, 0xc
mov byte [ebp - 4], 3
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42fd6c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1d68]
lea eax, [ebp - 0x1d60]
push 0x3e8
push eax
push 1
push 0
push 1
push edi
lea eax, [ebp - 0x220]
mov dword [ebp - 0x1d60], 0
push eax
call fcn.00432510
push 0x210
lea eax, [ebp - 0x1758]
push 0
push eax
call fcn.004814e0
add esp, 0xc
cmp dword [0x559f64], 0
je 0x42fea7
push str.GetNativeSystemInfo
push 0x51fe50
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42fe9d
xorps xmm0, xmm0
mov dword [ebp - 0x1d6c], 0
lea ecx, [ebp - 0x1d8c]
push ecx
movups xmmword [ebp - 0x1d8c], xmm0
movups xmmword [ebp - 0x1d7c], xmm0
call eax
mov ax, word [ebp - 0x1d8c]
cmp ax, 9
je 0x42fe93
cmp ax, 6
je 0x42fe93
cmp ax, 0xc
je 0x42fe93
push str.IsWow64Process2
push 0x51fe7c
mov dword [ebp - 0x1d54], 0
mov dword [ebp - 0x1d5c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1d50], eax
test eax, eax
je 0x42fe8a
lea eax, [ebp - 0x1d5c]
push eax
lea eax, [ebp - 0x1d54]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x1d50]
test eax, eax
je 0x42fe8a
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x1d5c], cx
sete al
mov dword [0x55f6b0], eax
jmp 0x42fe9d
xor eax, eax
mov dword [0x55f6b0], eax
jmp 0x42fe9d
mov dword [0x55f6b0], 1
mov dword [0x559f64], 0
cmp dword [0x55f6b0], 0
mov ecx, str.QsShell.dll
mov eax, str.QsShell64.dll
cmove eax, ecx
push eax
mov eax, dword [ebp - 0x1d58]
push dword [eax + 8]
lea eax, [ebp - 0x1758]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1758]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42ff8a
call fcn.00421fb0
mov ecx, eax
test ecx, ecx
je 0x430b72
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1d5c], eax
lea eax, [ebp - 0x1758]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x1d5c]
push str.__u__s___s_
push eax
call fcn.0040c190
mov esi, dword [ebp - 0x1d5c]
add esp, 0xc
mov dword [ebp - 0x1d50], 0
cmp dword [esi - 4], 1
jle 0x42ff4f
push dword [esi - 0xc]
lea ecx, [ebp - 0x1d5c]
call fcn.00408210
mov esi, dword [ebp - 0x1d5c]
push 0x1770
lea eax, [ebp - 0x1d50]
push eax
push 1
push 0
push 1
push esi
push str.regsvr32.exe
call fcn.00432510
lea edx, [esi - 0x10]
mov byte [ebp - 4], 3
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ff8a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x210
lea eax, [ebp - 0x738]
push 0
push eax
call fcn.004814e0
add esp, 0xc
lea eax, [ebp - 0x1d50]
lea ecx, [ebp - 0x1d49]
push eax
call fcn.0042e1b0
push dword [eax]
mov eax, dword [ebp - 0x1d58]
push dword [eax + 8]
lea eax, [ebp - 0x738]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x1d50]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42ffe7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x738]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430037
lea eax, [ebp - 0x738]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x430037
push str.Uninst
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1d50], eax
test eax, eax
je 0x430037
push str.uninst_computerz12
call fcn.00428660
add esp, 4
push 0x51dde0
call dword [ebp - 0x1d50]
mov dword [ebp - 4], 0xffffffff
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x430055
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1d64]
mov eax, dword [edi]
push dword [eax - 0xc]
push eax
call fcn.004223c0
mov ecx, eax
call fcn.004223a0
mov ecx, eax
call fcn.00429590
mov eax, dword [edi]
push dword [eax - 0xc]
push eax
call fcn.004223c0
mov ecx, eax
call fcn.004223a0
mov ecx, eax
call fcn.00429fa0
push dword [edi]
call fcn.00422d60
mov ecx, dword [ebp - 0x1d58]
add esp, 4
push 4
call fcn.0042f050
push str.start_close_all_processes
call fcn.00428660
add esp, 4
push edi
call fcn.004223c0
mov ecx, eax
call fcn.004223a0
push eax
call fcn.00435fe0
mov ecx, dword [ebp - 0x1d58]
add esp, 8
push 5
call fcn.0042f050
cmp dword [0x559f68], 0
je 0x43019d
push 0x51dec4
mov dword [ebp - 0x1d60], 0
mov dword [ebp - 0x1d54], 0
mov dword [ebp - 0x1d5c], 0
mov dword [ebp - 0x1d68], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x43018d
push str.RtlGetNtVersionNumbers
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x430158
lea ecx, [ebp - 0x1d5c]
push ecx
lea ecx, [ebp - 0x1d54]
push ecx
lea ecx, [ebp - 0x1d60]
push ecx
call eax
movzx eax, word [ebp - 0x1d5c]
mov dword [ebp - 0x1d5c], eax
mov dword [ebp - 0x1d68], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x1d68], 0
je 0x43018d
mov eax, dword [ebp - 0x1d60]
cmp eax, 6
jne 0x43017e
cmp dword [ebp - 0x1d54], 4
je 0x430183
jmp 0x43018d
cmp eax, 0xa
jb 0x43018d
mov dword [0x55f6b4], 1
mov edi, dword [ebp - 0x1d64]
mov dword [0x559f68], 0
cmp dword [0x55f6b4], 0
jne 0x4301ab
call fcn.00425e80
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e270
push dword [eax]
mov dword [ebp - 4], 6
call fcn.004dbb30
mov edx, dword [ebp - 0x1d50]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4301ef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e750
push dword [eax]
mov dword [ebp - 4], 7
call fcn.00451d00
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430236
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042ea50
push dword [eax]
mov dword [ebp - 4], 8
call fcn.004516b0
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43027d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e440
push dword [eax]
mov dword [ebp - 4], 9
call fcn.004dbb30
mov edx, dword [ebp - 0x1d50]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4302c1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e620
push dword [eax]
mov dword [ebp - 4], 0xa
call fcn.00451d00
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430308
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e7e0
push dword [eax]
mov dword [ebp - 4], 0xb
call fcn.004516b0
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43034f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e6b0
push dword [eax]
mov dword [ebp - 4], 0xc
call fcn.004dbb30
mov edx, dword [ebp - 0x1d50]
mov eax, esi
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430393
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e300
push dword [eax]
mov dword [ebp - 4], 0xd
call fcn.00451d00
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4303da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e110
push dword [eax]
mov dword [ebp - 4], 0xe
call fcn.004516b0
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430421
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e3a0
push dword [eax]
mov dword [ebp - 4], 0xf
call fcn.00451d00
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430468
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e4d0
push dword [eax]
mov dword [ebp - 4], 0x10
call fcn.004516b0
mov edx, dword [ebp - 0x1d50]
add esp, 4
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4304af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004814e0
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x1d50]
push eax
lea ecx, [ebp - 0x1d49]
call fcn.0042e9a0
push dword [eax]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edx, dword [ebp - 0x1d50]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x430524
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x430555
push str.UnRegisterTypes
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43054e
push SysReAllocString
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.remove_desktop_shortcuts
call fcn.00428660
mov ecx, dword [ebp - 0x1d58]
add esp, 4
call fcn.0042f6a0
mov ecx, dword [ebp - 0x1d58]
push 6
call fcn.0042f050
push str.remove_start_menu_shortcuts
call fcn.00428660
push 0x800
lea eax, [ebp - 0xd28]
push 0
push eax
call fcn.004814e0
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0xd28]
add esp, 0x10
push 1
push 0x17
push eax
push 0
call esi
push 0x800
lea eax, [ebp - 0x1d48]
push 0
push eax
call fcn.004814e0
add esp, 0xc
lea eax, [ebp - 0xd28]
push 0x521104
push eax
lea eax, [ebp - 0x1d48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x1d48]
push eax
call fcn.00433330
push str.remove_appdata
call fcn.00428660
push 0x800
lea eax, [ebp - 0xd28]
push 0
push eax
call fcn.004814e0
add esp, 0x14
lea eax, [ebp - 0xd28]
push 1
push 0x1a
push eax
push 0
call esi
push str.QuickSeeData
lea eax, [ebp - 0xd28]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0xd28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43064c
lea eax, [ebp - 0xd28]
push eax
call fcn.00433330
add esp, 4
mov esi, dword [ebp - 0x1d58]
mov ecx, esi
push 7
call fcn.0042f050
push dword [edi]
call fcn.00437e30
push str.remove_file_by_registry
call fcn.00428660
lea edi, [esi + 0xc]
mov esi, dword [ebp - 0x1d64]
push edi
push str.SOFTWAREQuickSee_file_list
push dword [esi]
call fcn.00423780
push edi
push str.SOFTWAREQuickSee_file_pe
push dword [esi]
call fcn.00423780
push str.remove_registry
call fcn.00428660
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x1d60], 1
push 0
push eax
mov dword [ebp - 0x1d50], 0x104
call fcn.004814e0
add esp, 0x30
lea eax, [ebp - 0x1d50]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1d60]
push eax
push str.InstallDate
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430706
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push str.InstallDate
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x1548]
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x1548], xmm0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.00421fb0
mov ecx, eax
test ecx, ecx
je 0x430b7c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1d54], eax
movzx eax, word [ebp - 0x153c]
push eax
movzx eax, word [ebp - 0x153e]
push eax
movzx eax, word [ebp - 0x1540]
push eax
movzx eax, word [ebp - 0x1542]
push eax
movzx eax, word [ebp - 0x1546]
push eax
movzx eax, word [ebp - 0x1548]
push eax
lea eax, [ebp - 0x1d54]
mov dword [ebp - 4], 0x11
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.0040c190
mov esi, dword [ebp - 0x1d54]
add esp, 0x20
mov eax, dword [esi - 0xc]
add eax, eax
push eax
push esi
push 1
push str.LastUninstallDate
push str.SOFTWAREQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.SOFTWAREQuickSee
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x43080b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x1d58]
push 8
call fcn.0042f050
push str.remove_autorun
call fcn.00428660
add esp, 4
lea ecx, [ebp - 0x1d49]
call fcn.00436d40
mov esi, dword [ebp - 0x1d64]
lea ecx, [ebp - 0x1d49]
mov dword [ebp - 4], 0x12
push dword [esi]
call fcn.004374f0
push str.Delete_AutoRun
call fcn.00428660
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1d49]
call fcn.00436d50
mov ecx, dword [ebp - 0x1d58]
push 9
call fcn.0042f050
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQuickSee
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.Delete_uninstall_registry
call fcn.00428660
push dword [esi]
push str.start_delete_all_files_in__s
call fcn.00428660
mov ecx, dword [ebp - 0x1d58]
add esp, 0xc
push dword [esi]
call fcn.0042f230
push dword [esi]
push str.end_delete_all_files_in__s
call fcn.00428660
push str..tmp
push dword [esi]
call fcn.00432fd0
mov ecx, dword [ebp - 0x1d58]
add esp, 0x10
push 0x62
call fcn.0042f050
push str.start_create_runonce_bat
call fcn.00428660
push dword [esi]
push edi
call fcn.004256a0
add esp, 0xc
push dword [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430b0a
call fcn.00421fb0
mov ecx, eax
test ecx, ecx
je 0x430b86
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x1d54], esi
push 0x800
lea eax, [ebp - 0xd28]
mov dword [ebp - 4], 0x13
push 0
push eax
call fcn.004814e0
push 0x800
lea eax, [ebp - 0x1528]
push 0
push eax
call fcn.004814e0
add esp, 0x18
lea eax, [ebp - 0xd28]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xfe
lea eax, [ebp - 0x31e]
push 0
push eax
call fcn.004814e0
add esp, 0xc
xor edi, edi
xor eax, eax
xorps xmm0, xmm0
mov word [ebp - 0x320], ax
lea eax, [ebp - 0x1538]
push eax
movups xmmword [ebp - 0x1538], xmm0
call dword [sym.imp.ole32.dll_CoCreateGuid]
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004814e0
movzx eax, byte [ebp - 0x1529]
push eax
movzx eax, byte [ebp - 0x152a]
push eax
movzx eax, byte [ebp - 0x152b]
push eax
movzx eax, byte [ebp - 0x152c]
push eax
movzx eax, byte [ebp - 0x152d]
push eax
movzx eax, byte [ebp - 0x152e]
push eax
movzx eax, byte [ebp - 0x152f]
push eax
movzx eax, byte [ebp - 0x1530]
push eax
movzx eax, word [ebp - 0x1532]
push eax
movzx eax, word [ebp - 0x1534]
push eax
push dword [ebp - 0x1538]
lea eax, [ebp - 0x210]
push str._08X__04X__04x__02X_02X__02X_02X_02X_02X_02X_02X
push eax
call fcn.0042de00
lea ecx, [ebp - 0x210]
add esp, 0x40
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430a20
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x320]
push 0x80
push eax
call fcn.004aa4ea
add esp, 0x10
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0xd28]
push eax
lea eax, [ebp - 0x1528]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str..tmp
lea eax, [ebp - 0x1528]
push 0x400
push eax
call fcn.004b004d
add esp, 0xc
lea eax, [ebp - 0x1528]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x430a9c
inc edi
cmp edi, 0xa
jl 0x430972
jmp 0x430acd
lea ecx, [ebp - 0x1528]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430aa5
sub ecx, edx
lea eax, [ebp - 0x1528]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1d54]
call fcn.0040b6d0
mov esi, dword [ebp - 0x1d54]
mov eax, dword [ebp - 0x1d64]
push 6
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push str.remove_directory
call fcn.00428660
add esp, 4
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x430b0a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1d58]
mov ecx, esi
push 0x64
call fcn.0042f050
mov dword [ebp - method.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.virtual_0], vtable.mf_bind_t_class_CUninstaller__class_CUninstaller___void_.0
mov dword [ebp - 0x1530], 0x42f140
mov dword [ebp - 0x152c], esi
lea eax, [ebp - 0x1534]
mov dword [ebp - 4], 0x14
push eax
call fcn.004311e0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00445e3a
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.00404ae0
push 0x80004005
call fcn.00404ae0
push 0x80004005
call fcn.00404ae0
push 0x80004005
call fcn.00404ae0
int3