Function at 0x4a0860
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5be9f8
mov eax, dword fs:[0]
push eax
mov eax, 0x4278
call fcn.0059a600
mov eax, dword [0x6319d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x5a8]
call fcn.00408110
push 0x5dc
lea eax, [ebp - 0x4270]
xor ebx, ebx
push 0x4b
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x4274], ebx
call fcn.00599fb0
mov ecx, 0x5dc
xor eax, eax
lea edi, [ebp - 0x3c94]
add esp, 0xc
rep stosd dword es:[edi], eax
mov byte [ebp - 4], 1
call fcn.004a8620
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4a08ee
push 0x80004005
call fcn.00401b60
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x4278], ebx
mov eax, dword [esi + 4]
xor esi, esi
mov byte [ebp - 4], 2
cmp eax, esi
jne 0x4a096b
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a092d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x4274]
mov byte [ebp - 4], 0
call fcn.004065e0
lea ecx, [ebp - 0x5a8]
call fcn.004082d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00599ed4
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0x4280]
mov ecx, dword [eax]
add eax, 8
mov dword [ebp - 0x4280], ecx
push eax
lea ecx, [ebp - 0x5a8]
call fcn.0040bbe0
mov eax, dword [ebp - 0x530]
cmp eax, 7
je 0x4a09a0
cmp eax, 0xb
je 0x4a09a0
cmp eax, 8
je 0x4a09a0
cmp eax, 9
jne 0x4a0cc5
mov dword [ebp - 0x2524], esi
mov dword [ebp - 0x251c], esi
mov dword [ebp - 0x2518], esi
mov dword [ebp - 0x2510], esi
push 0x5dc
lea edx, [ebp - 0x23fc]
push 0x4b
push edx
mov dword [ebp - 0x2400], esi
call fcn.00599fb0
mov ecx, 0x5dc
xor eax, eax
lea edi, [ebp - 0x1e20]
add esp, 0xc
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x59c]
mov esi, dword [ecx - 0xc]
xor edi, edi
mov byte [ebp - 4], 5
cmp esi, edi
jl 0x4a0cd6
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, esi
or eax, edx
jge 0x4a0a1d
push esi
lea ecx, [ebp - 0x59c]
call fcn.00402280
mov ecx, dword [ebp - 0x59c]
push ecx
lea ecx, [ebp - 0x2524]
call fcn.0043ce60
mov ecx, dword [ebp - 0x598]
push edi
push edi
lea eax, [ebp - 0x4274]
push eax
push str.HKLM
push ecx
lea ecx, [ebp - 0x2524]
mov byte [ebp - 4], 6
call fcn.0043b8e0
mov edx, dword [ebp - 0x4274]
cmp edx, edi
je 0x4a0cb4
lea eax, [ebp - 0x4270]
jmp 0x4a0a7e
mov edx, dword [ebp - 0x4274]
mov eax, dword [ebp - 0x427c]
xor edi, edi
cmp eax, edi
je 0x4a0b37
lea ecx, [ebp - 0x4270]
sub eax, ecx
inc eax
lea ecx, [eax - 1]
cmp ecx, 0x5db
ja 0x4a0b37
cmp eax, edx
jae 0x4a0ab1
lea eax, [ebp + eax - 0x4270]
mov dword [ebp - 0x427c], eax
jmp 0x4a0ab7
mov dword [ebp - 0x427c], edi
cmp ecx, edx
jae 0x4a0ac7
cmp ecx, 0xffffffff
je 0x4a0ac7
mov edi, dword [ebp + ecx*4 - 0x3c94]
mov ecx, dword [edi + 0xc]
push ecx
call fcn.0059b19a
push eax
call fcn.0059b13d
mov esi, dword [edi + 0xc]
add esp, 8
mov edx, eax
mov edi, edi
mov cl, byte [edx]
mov byte [esi], cl
inc edx
inc esi
test cl, cl
jne 0x4a0ae0
push eax
call fcn.0059a02a
mov eax, dword [edi + 0xc]
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONUNINSTALL
push eax
call fcn.0059ade0
add esp, 0xc
test eax, eax
je 0x4a0ca7
sub eax, dword [edi + 0xc]
cmp eax, 0xffffffff
je 0x4a0ca7
mov edx, dword [edi + 0x18]
push str.UninstallString
push edx
call fcn.00599e8d
add esp, 8
test eax, eax
jne 0x4a0ca7
mov edi, dword [edi + 0x30]
test edi, edi
jne 0x4a0b3f
jmp 0x4a0b4d
mov dword [ebp - 0x427c], edi
jmp 0x4a0ac7
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a0b44
sub eax, edx
push eax
push edi
lea ecx, [ebp - 0x4278]
call fcn.004026b0
mov esi, dword [ebp - 0x4278]
mov edi, dword [esi - 0xc]
test edi, edi
js 0x4a0cd6
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4a0b8e
push edi
lea ecx, [ebp - 0x4278]
call fcn.00402280
mov esi, dword [ebp - 0x4278]
lea eax, [edi + 1]
push eax
push esi
call fcn.0059a1fe
add esp, 8
cmp eax, 0x50
ja case.0x4a0bab.0
movzx ecx, byte [eax + 0x4a0cfc]
jmp dword [ecx*4 + 0x4a0cec]
cmp edi, dword [esi - 8]
jg 0x4a0cd6
mov dword [esi - 0xc], edi
mov byte [edi + esi], 0
cmp dword [esi - 0xc], 0
jl 0x4a0c84
push 0x5cedcc
push esi
call fcn.0059a963
add esp, 8
test eax, eax
je 0x4a0c84
sub eax, esi
cmp eax, 0xffffffff
je 0x4a0c84
add eax, 4
push eax
lea edx, [ebp - 0x4284]
push edx
lea ecx, [ebp - 0x4278]
call fcn.004024f0
mov ecx, dword [eax]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
mov byte [ebp - 4], 7
cmp eax, esi
je 0x4a0c5e
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4a0c4e
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x4a0c4e
push eax
call fcn.004022e0
mov ebx, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x4a0c43
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
add ebx, 0x10
mov dword [ebp - 0x4278], ebx
jmp 0x4a0c5e
mov eax, dword [ecx - 0xc]
push eax
push ecx
lea ecx, [ebp - 0x4278]
call fcn.004026b0
mov eax, dword [ebp - 0x4284]
add eax, 0xfffffff0
mov byte [ebp - 4], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4a0c84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x4278]
call fcn.00408a80
lea ecx, [ebp - 0x4278]
call fcn.00408a00
mov ebx, dword [ebp - 0x4278]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x427c], 0
jne 0x4a0a70
lea ecx, [ebp - 0x2524]
mov byte [ebp - 4], 2
call fcn.004339c0
xor esi, esi
cmp dword [ebp - 0x4280], esi
jne 0x4a0965
jmp 0x4a090d
push 0x80070057
call fcn.00401b60
call fcn.004a6ea5
call fcn.004a6edd
mov edi, edi
mov dl, 0xb
dec edx
add al, ah
or al, 0x4a
add ch, ah
or al, 0x4a
add ch, ah
or al, 0x4a
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3