Function at 0x403650
Capabilities:
Delete registry value
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4397e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4510e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
mov esi, dword [ebx]
lea edx, [eax - 0x10]
sub esi, 0x10
cmp edx, esi
je 0x4036d7
cmp dword [esi + 0xc], 0
lea edi, [esi + 0xc]
jl 0x4036cc
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x4036cc
push edx
call fcn.004021d0
add esp, 4
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4036c5
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebx], eax
jmp 0x4036d7
push dword [eax - 0xc]
mov ecx, ebx
push eax
call fcn.00402100
mov eax, dword [ebp + 0xc]
mov esi, dword [ebx + 4]
lea edx, [eax - 0x10]
sub esi, 0x10
cmp edx, esi
je 0x40372d
cmp dword [esi + 0xc], 0
jl 0x403721
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x403721
push edx
call fcn.004021d0
add esp, 4
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x403719
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [ebx + 4], eax
jmp 0x40372d
push dword [eax - 0xc]
lea ecx, [ebx + 4]
push eax
call fcn.00402100
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0xc], eax
call fcn.00409d5c
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x403755
push 0x80004005
call fcn.004022b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x18], 0
mov byte [ebp - 4], 2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x4037c8
lea eax, [ebp - 0x24]
push 0x447444
push eax
call fcn.004073f0
mov eax, dword [ebp - 0x24]
add esp, 4
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.004021d0
add eax, 0x10
add esp, 4
mov ecx, ebx
mov dword [esi], eax
call fcn.004031a0
xor esi, esi
push 0
push 0xa
push 0x45a954
call fcn.00404810
test eax, eax
je 0x4037c1
push 0xc8
call edi
inc esi
cmp esi, 0x64
jl 0x4037a2
push 0x3e8
call edi
lea eax, [ebp - 0x24]
push 0x447468
push eax
call fcn.004073f0
mov esi, dword [ebp - 0x24]
add esi, 0xfffffff0
add esp, 4
mov ecx, dword [esi]
mov dword [ebp - 0x1c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x403803
cmp ecx, dword [esi]
jne 0x403803
mov eax, 1
lock xadd dword [edx], eax
jmp 0x403846
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x18], edx
test edx, edx
jne 0x40381a
call fcn.004021c0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.0041bebc
mov esi, dword [ebp - 0x18]
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
call fcn.004031a0
push ecx
mov esi, esp
mov dword [ebp - 0x28], esp
mov dword [ebp - 0x1c], esi
call fcn.00409d5c
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40387a
push 0x80004005
call fcn.004022b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, 0x447d3c
mov byte [ebp - 4], 3
test eax, 0xffff0000
jne 0x4038b6
movzx eax, ax
push eax
call fcn.0040a185
test eax, eax
je 0x4038c4
mov edx, 0x447d3c
movzx ecx, dx
push ecx
push eax
mov ecx, esi
call fcn.00401cf0
jmp 0x4038c4
push 0
push 0x447d3c
mov ecx, esi
call fcn.00402100
push ecx
mov byte [ebp - 4], 4
mov esi, esp
mov dword [ebp - 0x20], esp
mov dword [ebp - 0x1c], esi
call fcn.00409d5c
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4038ed
push 0x80004005
call fcn.004022b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.TouchEn_nxWeb_UNInstaller.exe
mov byte [ebp - 4], 5
test eax, 0xffff0000
jne 0x403929
movzx eax, ax
push eax
call fcn.0040a185
test eax, eax
je 0x403937
mov edx, str.TouchEn_nxWeb_UNInstaller.exe
movzx ecx, dx
push ecx
push eax
mov ecx, esi
call fcn.00401cf0
jmp 0x403937
push 0x1d
push str.TouchEn_nxWeb_UNInstaller.exe
mov ecx, esi
call fcn.00402100
mov byte [ebp - 4], 6
mov esi, dword [ebx]
push ecx
mov ecx, dword [esi - 0x10]
sub esi, 0x10
mov eax, dword [ecx]
mov dword [ebp - 0x18], esp
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x403966
cmp ecx, dword [esi]
jne 0x403966
mov eax, 1
lock xadd dword [edx], eax
jmp 0x4039a9
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x40397d
call fcn.004021c0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.0041bebc
mov esi, dword [ebp - 0x1c]
add esp, 0x10
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x18]
mov edx, 1
mov dword [esi], eax
mov ecx, 0x440
mov byte [ebp - 4], 2
call fcn.00403270
add esp, 0xc
test eax, eax
je 0x4039d2
push 0x3e8
call edi
mov ecx, ebx
call fcn.00403d60
lea eax, [ebp - 0x24]
push 0x4474ec
push eax
call fcn.004073f0
mov esi, dword [ebp - 0x24]
add esi, 0xfffffff0
add esp, 4
mov ecx, dword [esi]
mov dword [ebp - 0x18], esp
mov eax, dword [ecx]
mov dword [ebp - 0x28], esi
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x403a17
cmp ecx, dword [esi]
jne 0x403a17
mov eax, 1
lock xadd dword [edx], eax
jmp 0x403a5a
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edx, eax
mov dword [ebp - 0x1c], edx
test edx, edx
jne 0x403a2e
call fcn.004021c0
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edx + 0x10]
push eax
call fcn.0041bebc
mov esi, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
call fcn.004031a0
push str.TENXWGuard
call fcn.004354f0
push 0x3e8
call edi
xor esi, esi
lea esp, [esp]
push 1
push 5
push 0x45a940
call fcn.00404810
test eax, eax
je 0x403a9c
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x403a80
xor esi, esi
mov edi, edi
push 0
push 5
push 0x45a940
call fcn.00404810
test eax, eax
je 0x403abc
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x403aa0
mov ecx, ebx
call fcn.00404990
xor esi, esi
push 0
push 5
push 0x45a940
call fcn.00404810
test eax, eax
je 0x403ae1
push 0x64
call edi
inc esi
cmp esi, 0x32
jl 0x403ac5
mov esi, dword [ebx]
push 1
push ecx
mov ecx, dword [esi - 0x10]
mov dword [ebp - 0x1c], esp
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi - 4], 0
lea edx, [esi - 4]
mov ecx, eax
jl 0x403b0f
cmp ecx, dword [esi - 0x10]
jne 0x403b0f
lea edi, [esi - 0x10]
mov eax, 1
lock xadd dword [edx], eax
jmp 0x403b49
mov eax, dword [ecx]
push 2
push dword [esi - 0xc]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x403b23
call fcn.004021c0
mov eax, dword [esi - 0xc]
mov dword [edi + 4], eax
mov ecx, dword [esi - 0xc]
lea eax, [ecx*2 + 2]
push eax
lea eax, [ecx*2 + 2]
push esi
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0041bebc
add esp, 0x10
mov ecx, dword [ebp - 0x1c]
lea eax, [edi + 0x10]
mov dword [ecx], eax
mov ecx, ebx
call fcn.00406690
push 0xf013f
push ecx
mov esi, esp
mov dword [ebp - 0x20], esi
call fcn.00409d5c
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x403b7f
push 0x80004005
call fcn.004022b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallTouchEn_nxWeb_32_
mov byte [ebp - 4], 7
test eax, 0xffff0000
jne 0x403bb3
movzx edi, ax
push edi
call fcn.0040a185
test eax, eax
je 0x403bc1
push edi
push eax
mov ecx, esi
call fcn.00401cf0
jmp 0x403bc1
push 0x45
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallTouchEn_nxWeb_32_
mov ecx, esi
call fcn.00402100
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x11]
mov byte [ebp - 4], 2
call fcn.00401890
push 0xf023f
push ecx
mov esi, esp
mov dword [ebp - 0x20], esi
call fcn.00409d5c
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x403bf9
push 0x80004005
call fcn.004022b0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
mov eax, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallTouchEn_nxWeb_32_
mov byte [ebp - 4], 8
test eax, 0xffff0000
jne 0x403c2d
movzx edi, ax
push edi
call fcn.0040a185
test eax, eax
je 0x403c3b
push edi
push eax
mov ecx, esi
call fcn.00401cf0
jmp 0x403c3b
push 0x51
push str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstallTouchEn_nxWeb_32_
mov ecx, esi
call fcn.00402100
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x11]
mov byte [ebp - 4], 2
call fcn.00401890
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x18]
push eax
push 0xf023f
push 0
push str.SOFTWAREWOW6432NodeiniLINECrossEX_touchenex_
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x403c8d
push str.nxweb
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x403c8d
push eax
call esi
lea eax, [ebp - 0x18]
push eax
push 0xf013f
push 0
push str.SOFTWAREiniLINECrossEX_touchenex_
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x403cbc
push str.nxweb
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x403cbc
push eax
call esi
push 0x200
push str.SOFTWAREWOW6432NodeiniLINECrossEX_touchenex_
push ecx
call fcn.004033e0
push 0x100
push str.SOFTWAREiniLINECrossEX_touchenex_
push ecx
call fcn.004033e0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x28]
or ebx, 0xffffffff
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403cfc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x403d1c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0xc]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x403d3d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041bcb9
mov esp, ebp
pop ebp
ret 0x14