Function at 0x406200
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x411e8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x840
mov eax, dword [0x4161c0]
push ebx
push esi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0x1a
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea edi, [esp + 0x228]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x844], eax
movsw word es:[edi], word [esi]
xor eax, eax
mov ecx, 0x67
lea edi, [esp + 0x292]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x228]
push eax
call ebx
cmp word [0x417610], 0
mov edi, eax
mov dword [esp + 0x1c], edi
je 0x40629d
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.LvOem
lea ecx, [esp + 0x22c]
push ecx
call esi
push 0x417610
lea edx, [esp + 0x22c]
push edx
call esi
jmp 0x4062b0
push str.Lava_Lava
lea eax, [esp + 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea esi, [esp + 0x18]
call fcn.00405e50
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
test eax, eax
mov dword [esp + 0x854], 0
je 0x4062f3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x41386c
lea edx, [esp + 0x22c]
push edx
call esi
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x22c]
push ecx
call esi
mov eax, dword [ebp + 8]
test eax, eax
je 0x40634e
lea edx, [esp + 0x228]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp + 0x10]
lea ecx, [esp + edi*2 + 0x228]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x10]
push eax
jmp 0x406737
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x22c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
call edi
movzx eax, ax
cmp eax, 0x404
je 0x40638f
xor edx, edx
cmp eax, 0x804
sete dl
dec edx
and edx, 0xc8
mov dword [esp + 0x14], edx
jmp 0x406397
mov dword [esp + 0x14], 0x64
call edi
movzx eax, ax
cmp eax, 0x404
je 0x4063b8
xor ecx, ecx
cmp eax, 0x804
sete cl
dec ecx
and ecx, 0xc8
mov esi, ecx
jmp 0x4063bd
mov esi, 0x64
mov edx, dword [esp + 0x14]
lea eax, [edx*2 + 0x4173b8]
push eax
call ebx
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push ecx
lea edx, [esi + 0x4173b8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edx
push 1
push 0
push str.DisplayName
push eax
call esi
call edi
movzx eax, ax
cmp eax, 0x404
je 0x406410
xor ecx, ecx
cmp eax, 0x804
sete cl
dec ecx
and ecx, 0xc8
mov dword [esp + 0x14], ecx
jmp 0x406418
mov dword [esp + 0x14], 0x64
call edi
movzx eax, ax
cmp eax, 0x404
je 0x406439
xor edx, edx
cmp eax, 0x804
sete dl
dec edx
and edx, 0xc8
mov edi, edx
jmp 0x40643e
mov edi, 0x64
mov eax, dword [esp + 0x14]
lea ecx, [eax*2 + 0x417160]
push ecx
call ebx
mov ecx, dword [esp + 0x10]
lea edx, [eax + eax + 2]
push edx
lea eax, [edi + 0x417160]
push eax
push 1
push 0
push str.Publisher
push ecx
call esi
push 0x417098
call ebx
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push 0x417098
push 1
push 0
push str.HelpLink
push eax
call esi
push 0x416fd0
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push 0x416fd0
push 1
push 0
push str.URLInfoAbout
push edx
call esi
push 0x416f08
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
push 0x416f08
push 1
push 0
push str.URLUpdateInfo
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea edx, [esp + 0x63c]
push edx
push 0
call edi
push 0x104
lea eax, [esp + 0x24]
push eax
push 0x413338
lea ecx, [esp + 0x644]
push ecx
call fcn.00403bd0
lea edx, [esp + 0x20]
push edx
call ebx
mov edx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push 0
push str.UninstallString
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x103
lea ecx, [esp + 0x26]
push ecx
push 0
call edi
lea edx, [esp + 0x22]
push 0x5c
push edx
call fcn.004080e6
add esp, 8
push 0x104
lea edi, [esp + 0x434]
mov word [eax + 2], 0
call fcn.00406010
test eax, eax
je 0x40658f
lea eax, [esp + 0x22]
push eax
mov ecx, edi
push ecx
call fcn.004091a6
mov edi, eax
push edi
lea edx, [esp + 0x43c]
push edx
push str.SetControlPanel:GetRegInstallDir____s___cmp_d_n
call fcn.00403310
add esp, 0x14
test edi, edi
je 0x40673d
mov eax, dword [str.SoftwareDianji_]
push eax
lea ecx, [esp + 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [0x417610], 0
je 0x4065d3
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.LvOem
lea edx, [esp + 0x434]
push edx
call edi
push 0x417610
lea eax, [esp + 0x434]
push eax
call edi
jmp 0x4065e6
push str.Lava_Lava
lea ecx, [esp + 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x44c]
push eax
push 0x80000001
call edi
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x40663f
lea ecx, [esp + 0x22]
push ecx
call ebx
mov ecx, dword [str.InstallDir]
lea edx, [eax + eax + 2]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x26]
push eax
push 1
push 0
push ecx
push edx
call esi
jmp 0x406688
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push edx
call edi
lea eax, [esp + 0x22]
push eax
call ebx
lea ecx, [eax + eax + 2]
mov eax, dword [str.InstallDir]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x26]
push edx
push 1
push 0
push eax
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.notwindowrun
push str.regtable
call fcn.00403570
add esp, 8
test eax, eax
jne 0x40673d
lea ecx, [esp + 0x638]
push 0x5c
push ecx
call fcn.004080e6
add esp, 8
push 0x416ca8
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x104
lea edx, [esp + 0x24]
push edx
push 0x4136d8
lea eax, [esp + 0x644]
push eax
call fcn.00403bd0
push 0
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call edi
lea edx, [esp + 0x20]
push edx
call ebx
mov edx, dword [esp + 0x1c]
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push 1
push 0
lea eax, [esp + edx*2 + 0x238]
push eax
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x854], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406766
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x84c]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x844]
call fcn.004077be
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4