Function at 0x4130d0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4502cb
mov eax, dword fs:[0]
push eax
sub esp, 0xa3c
mov eax, dword [0x462408]
xor eax, esp
mov dword [esp + 0xa38], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x462408]
xor eax, esp
push eax
lea eax, [esp + 0xa50]
mov dword fs:[0], eax
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebp
mov word [esp + 0x2c], bp
mov eax, edx
mov dword [esp + 0xa58], ebp
xor ebx, ebx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x413132
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x30]
call fcn.00403d80
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403cb0
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x413169
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x20]
push ecx
push 0x20019
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x250]
push eax
mov eax, dword [esp + 0x28]
push ebp
push ebp
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x58]
push edx
push ebx
push eax
mov dword [esp + 0x44], 0x104
mov dword [esp + 0x3c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, ebp
jne 0x4131da
mov ecx, dword [esp + 0x1c]
shr ecx, 1
mov word [esp + ecx*2 + 0x24c], bp
push edi
lea edx, [esp + 0x250]
lea ecx, [esp + 0x48]
call fcn.004133a0
add ebx, 1
cmp esi, ebp
je 0x413180
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
push eax
push edi
call fcn.00421290
mov edx, str.dump
call fcn.00401d60
test eax, eax
je 0x413218
mov ecx, str.dump
call fcn.00401e00
mov edx, eax
mov ecx, edi
call fcn.0041dc80
mov ecx, dword [edi + 4]
mov ebx, dword [ecx]
mov ebp, edi
nop
test ebp, ebp
mov esi, dword [edi + 4]
je 0x41322b
cmp ebp, edi
je 0x413230
call fcn.0043641d
cmp ebx, esi
je 0x413328
test ebp, ebp
jne 0x413241
call fcn.0043641d
cmp ebx, dword [ebp + 4]
jne 0x41324b
call fcn.0043641d
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
add eax, 0xffffffff
cmp eax, 0xa
ja case.0x41325d.2
jmp dword [eax*4 + 0x413374]
cmp ebx, dword [ebp + 4]
jne 0x41326e
call fcn.0043641d
push esi
mov ecx, edi
call fcn.0041b3f0
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x413285
call fcn.0043641d
push edi
mov ecx, esi
call fcn.0041b7a0
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x41329c
call fcn.0043641d
mov ecx, esi
call fcn.0041b960
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x4132af
call fcn.0043641d
push edi
mov ecx, esi
call fcn.0041bed0
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x4132c3
call fcn.0043641d
push edi
mov ecx, esi
call fcn.0041c230
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x4132d7
call fcn.0043641d
mov ecx, esi
call fcn.0041c720
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x4132ea
call fcn.0043641d
mov ecx, esi
call fcn.0041c8b0
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x4132fd
call fcn.0043641d
push edi
call fcn.00419cf0
jmp case.0x41325d.2
cmp ebx, dword [ebp + 4]
jne 0x41330f
call fcn.0043641d
push edi
mov ecx, esi
call fcn.0041ca30
cmp ebx, dword [ebp + 4]
jne 0x413321
call fcn.0043641d
mov ebx, dword [ebx]
jmp 0x413220
mov edx, dword [esp + 0x18]
push edx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x40], 8
jb 0x41334c
mov eax, dword [esp + 0x2c]
push eax
call fcn.0043642d
add esp, 4
mov ecx, dword [esp + 0xa50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.00434b37
add esp, 0xa48
ret