Function at 0x4015c9
Capabilities:
Delete directory
Delete file
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2668
call fcn.00402100
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x401d10
cmp word [edi], bx
je 0x401d10
lea eax, [ebp - 0x628]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x628]
push 0x404734
push eax
call esi
lea eax, [ebp - 0x628]
push edi
push eax
call esi
lea eax, [ebp - 0x628]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.0040209d
test eax, eax
je 0x401653
lea eax, [ebp - 0x628]
push 0x10
push eax
push dword [0x404980]
jmp 0x401731
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x216]
mov word [ebp - 0x218], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.AppPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4016a0
cmp dword [ebp - 0xc], 1
jne 0x4016a0
xor eax, eax
cmp eax, ebx
je 0x4016a9
push 0x10
push 0x404078
jmp 0x401648
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc3e]
mov word [ebp - 0xc40], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xc40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xc40]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4016ee
mov word [eax + 2], bx
lea eax, [ebp - 0xc40]
push str.ttpctrl.dll
push eax
call esi
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0xc40]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40174d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x401761
push 0x30
push 0x404078
push dword [0x40498c]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 4], ebx
je 0x401746
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401e6a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc40]
push eax
call fcn.004014f9
pop ecx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa36]
mov word [ebp - 0xa38], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.AppUninst
mov dword [ebp - 8], 0x208
push dword [ebp - 4]
xor edi, edi
call esi
cmp eax, ebx
jne 0x401802
cmp dword [ebp - 0xc], 1
jne 0x401802
mov edi, dword [ebp - 8]
xor eax, eax
shr edi, 1
cmp eax, ebx
jne 0x401802
cmp edi, ebx
je 0x401802
mov ecx, 0x108
lea edi, [ebp - 0x1a8a]
mov word [ebp - 0x1a8c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x1a8c]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1a8c]
push 0xa
push eax
call fcn.00401e6f
add esp, 0x18
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x104e]
mov word [ebp - 0x1050], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.ThirdPart
push dword [ebp - 4]
call esi
cmp dword [ebp - 4], ebx
je 0x40184c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
lea ecx, [ebp - 4]
call fcn.0040209d
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401886
push dword [ebp + 8]
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x401886
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa38]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4018e9
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
lea ecx, [ebp - 4]
mov word [esi], bx
call fcn.0040209d
test eax, eax
jne 0x4018e9
add esi, 2
push esi
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x4018e9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, str..lnk
lea eax, [ebp - 0x218]
push esi
push dword [0x404a14]
push ebx
push eax
call fcn.00401356
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
test eax, eax
je 0x401918
lea eax, [ebp - 0x218]
push eax
call edi
push esi
lea eax, [ebp - 0x218]
push dword [0x404a14]
push 2
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x40193d
lea eax, [ebp - 0x218]
push eax
call edi
push str..url
lea eax, [ebp - 0x218]
push dword [0x404a20]
push ebx
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401965
lea eax, [ebp - 0x218]
push eax
call edi
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x420]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x3cc]
push dword [0x404a14]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x420]
push str..lnk
push eax
lea eax, [ebp - 0x218]
push 0x1a
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x4019c3
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0xe46]
mov word [ebp - 0xe48], bx
mov word [ebp - 0x1668], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x1666]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x4000000
lea eax, [ebp - 0xe48]
push esi
push eax
push dword [0x404a14]
call edi
pop ecx
inc eax
push eax
push dword [0x404a14]
call fcn.00401146
lea eax, [ebp - 0xe48]
push str..lnk
push eax
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00401356
add esp, 0x24
test eax, eax
je 0x401a4d
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xe48]
push str..lnk
push eax
lea eax, [ebp - 0x218]
push 2
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401a7b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4000000
lea eax, [ebp - 0x1668]
push esi
push eax
push dword [0x404a24]
call edi
pop ecx
inc eax
push eax
push dword [0x404a24]
call fcn.00401146
lea eax, [ebp - 0x1668]
push str..url
push eax
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00401356
add esp, 0x24
test eax, eax
je 0x401acb
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x1258]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x1204]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x1258]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1258]
push str..lnk
push eax
lea eax, [ebp - 0x218]
push 0x1a
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401b2a
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa38]
push eax
lea eax, [ebp - 0x420]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x420]
push 0x404734
push eax
call edi
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x420]
mov dword [ebp + 8], ebx
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push dword [eax + 0x40429c]
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.004011a4
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x34
pop ecx
jb 0x401b6e
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 8]
push dword [eax + 0x404280]
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.00401267
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x1c
pop ecx
jb 0x401b96
push dword [0x404a14]
lea eax, [ebp - 0x2668]
push dword [0x404a18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2668]
push 0x24
push 0x404078
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x401c20
push str.Lyrics
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.00401267
mov dword [esp], str.CDDB
push dword [ebp - 8]
call esi
lea eax, [ebp - 0x420]
push eax
call fcn.00401267
pop ecx
lea eax, [ebp - 0xa38]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp word [ebp - 0x1050], bx
je 0x401cfa
lea eax, [ebp - 0x628]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call esi
lea eax, [ebp - 0x628]
push 0x404734
push eax
call edi
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x628]
push eax
call edi
lea eax, [ebp - 0x628]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
call fcn.0040209d
test eax, eax
jne 0x401cfa
mov ecx, 0x81
lea edi, [ebp - 0x82e]
mov word [ebp - 0x830], bx
mov dword [ebp + 8], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
xor esi, esi
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.UninstallString
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401ce9
cmp dword [ebp - 0xc], 1
jne 0x401ce9
mov esi, dword [ebp + 8]
xor eax, eax
shr esi, 1
cmp eax, ebx
jne 0x401ce9
cmp esi, ebx
je 0x401ce9
lea eax, [ebp - 0x830]
push 0xa
push eax
call fcn.00401e6f
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x401d08
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x401d08
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x401e6a
mov edi, dword [str.TTPlayer]
lea eax, [ebp - 0x1460]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1460]
push 0x404734
push eax
call esi
lea eax, [ebp - 0x1460]
push edi
push eax
call esi
lea eax, [ebp - 0x1460]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.0040209d
test eax, eax
je 0x401d8e
push 0x10
push 0x404078
push dword [0x404980]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x401746
push dword [ebp + 8]
jmp 0x401740
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82e]
mov word [ebp - 0x830], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.DisplayName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov edi, 0x404078
jne 0x401e3b
cmp dword [ebp - 8], 1
jne 0x401e3b
xor eax, eax
cmp eax, ebx
jne 0x401e3b
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x404978]
push edi
call esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x1e68]
push dword [0x404984]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1e68]
push 0x34
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x401e3b
cmp dword [ebp + 8], ebx
je 0x401d08
push dword [ebp + 8]
jmp 0x401d02
push dword [ebp - 0x10]
call fcn.00401393
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x401e5a
push 0x10
push edi
push dword [0x404980]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x401e68
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret