Function at 0x4131a0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452aa6
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x469744]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov edi, ecx
mov esi, edx
xor eax, eax
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa64], esi
mov dword [ebp - 0xa20], 7
mov dword [ebp - 0xa24], ebx
mov word [ebp - 0xa34], ax
mov eax, esi
mov dword [ebp - 4], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413201
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0xa34]
call fcn.00406550
push 0xa
mov eax, str.Uninstall
mov ecx, esi
call fcn.00403640
cmp dword [ebp - 0xa20], 8
mov eax, dword [ebp - 0xa34]
jae 0x41323d
mov eax, esi
lea ecx, [ebp - 0xa60]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0xa5c]
push edx
lea eax, [ebp - 0xa18]
push eax
mov eax, dword [ebp - 0xa60]
push 0
push 0
lea ecx, [ebp - 0xa68]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push eax
mov dword [ebp - 0xa68], 0x104
mov dword [ebp - 0xa5c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jne 0x4133b5
mov ecx, dword [ebp - 0xa5c]
lea eax, [ebp - 0x218]
shr ecx, 1
xor edx, edx
push str.Folder
push eax
mov word [ebp + ecx*2 - 0xa18], dx
call fcn.0043a998
add esp, 8
test eax, eax
je 0x413314
lea ecx, [ebp - 0xa18]
push 0x459764
push ecx
call fcn.0043a998
add esp, 8
test eax, eax
je 0x4132f9
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004135b0
jmp 0x413314
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_Folder:__s
push 0x46a9d4
xor eax, eax
call fcn.0042d150
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a998
add esp, 8
test eax, eax
je 0x413373
lea ecx, [ebp - 0xa18]
push 0x459764
push ecx
call fcn.0043a998
add esp, 8
test eax, eax
je 0x413358
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004135b0
jmp 0x413373
lea edx, [ebp - 0x218]
push edx
push str.Uninstall_Reg_Value_not_added_for_File:__s
push 0x46a9d4
xor eax, eax
call fcn.0042d150
add esp, 0xc
lea eax, [ebp - 0x218]
push str.File
push eax
call fcn.0043a998
add esp, 8
test eax, eax
jne 0x4133b5
lea ecx, [ebp - 0x218]
push str.Folder
push ecx
call fcn.0043a998
add esp, 8
test eax, eax
jne 0x4133b5
push edi
lea edx, [ebp - 0xa18]
lea ecx, [ebp - 0x218]
call fcn.004135b0
inc ebx
test esi, esi
je 0x413257
mov edx, dword [ebp - 0xa60]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa64]
push eax
mov ecx, edi
call fcn.00421cb0
push str.dump
call fcn.00402130
test eax, eax
je 0x4133fa
mov ecx, str.dump
call fcn.00402200
mov edx, eax
mov ecx, edi
call fcn.0041f190
mov eax, dword [edi]
mov esi, dword [eax]
mov dword [ebp - 0xa58], esi
cmp esi, eax
je 0x413537
jmp 0x413416
mov esi, dword [ebp - 0xa58]
lea ecx, [ebp - 0xa50]
add esi, 8
push ecx
mov edx, 0x4596b8
mov ecx, esi
call fcn.00410fd0
mov ebx, dword [eax + 0x10]
mov ecx, ebx
cmp ecx, ebx
jae 0x413435
mov edx, ebx
cmp ebx, 6
jb 0x413441
mov edx, 6
cmp dword [eax + 0x14], 8
jb 0x41344b
mov ecx, dword [eax]
jmp 0x41344d
mov ecx, eax
mov eax, str.ignore
test edx, edx
je 0x41346d
mov di, word [ecx]
cmp di, word [eax]
jne 0x413477
add ecx, 2
add eax, 2
dec edx
jne 0x413456
mov edi, dword [ebp - 0xa54]
cmp ebx, 6
jae 0x413487
or eax, 0xffffffff
jmp 0x41348f
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x413467
mov edi, dword [ebp - 0xa54]
jmp 0x41348f
xor eax, eax
cmp ebx, 6
setne al
test eax, eax
sete al
mov byte [ebp - 4], 0
cmp dword [ebp - 0xa3c], 8
mov byte [edi + 0x41], al
jb 0x4134b3
mov ecx, dword [ebp - 0xa50]
push ecx
call fcn.00439c00
add esp, 4
mov eax, dword [esi]
dec eax
cmp eax, 0xb
ja case.0x4134bb.3
jmp dword [eax*4 + 0x413580]
push edi
mov ecx, esi
call fcn.0041c590
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041c9c0
jmp case.0x4134bb.3
mov ecx, esi
call fcn.0041cc10
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041d1d0
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041d4d0
jmp case.0x4134bb.3
mov ecx, esi
mov ebx, edi
call fcn.0041da10
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041db90
jmp case.0x4134bb.3
call fcn.0041a940
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041dec0
jmp case.0x4134bb.3
push edi
mov ecx, esi
call fcn.0041df80
mov edx, dword [ebp - 0xa58]
mov eax, dword [edx]
mov dword [ebp - 0xa58], eax
cmp eax, dword [edi]
jne 0x413410
mov eax, dword [ebp - 0xa64]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [ebp - 0xa20], 8
jb 0x413561
mov ecx, dword [ebp - 0xa34]
push ecx
call fcn.00439c00
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00438876
mov esp, ebp
pop ebp
ret