Function at 0x4015c9
Capabilities:
Delete directory
Delete file
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2690
call fcn.004026a0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
cmp edi, ebx
je 0x401d8d
cmp word [edi], bx
je 0x401d8d
lea eax, [ebp - 0x650]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x650]
push 0x404744
push eax
call esi
lea eax, [ebp - 0x650]
push edi
push eax
call esi
lea eax, [ebp - 0x650]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.004024bc
test eax, eax
je 0x401653
lea eax, [ebp - 0x650]
push 0x10
push eax
push dword [0x4049e0]
jmp 0x401731
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x23e]
mov word [ebp - 0x240], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x208
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AppPath
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x4016a0
cmp dword [ebp - 8], 1
jne 0x4016a0
xor eax, eax
cmp eax, ebx
je 0x4016a9
push 0x10
push 0x404078
jmp 0x401648
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xc66]
mov word [ebp - 0xc68], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xc68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xc68]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x4016ee
mov word [eax + 2], bx
lea eax, [ebp - 0xc68]
push str.ttpctrl.dll
push eax
call esi
push ebx
push ebx
push 3
push ebx
push ebx
lea eax, [ebp - 0xc68]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
jne 0x40174d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x401761
push 0x30
push 0x404078
push dword [0x4049ec]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 4], ebx
je 0x401746
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x401ee7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc68]
push eax
call fcn.004014f9
pop ecx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa5e]
mov word [ebp - 0xa60], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.AppUninst
mov dword [ebp - 0xc], 0x208
push dword [ebp - 4]
xor edi, edi
call esi
cmp eax, ebx
jne 0x401802
cmp dword [ebp - 8], 1
jne 0x401802
mov edi, dword [ebp - 0xc]
xor eax, eax
shr edi, 1
cmp eax, ebx
jne 0x401802
cmp edi, ebx
je 0x401802
mov ecx, 0x108
lea edi, [ebp - 0x1ab2]
mov word [ebp - 0x1ab4], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x1ab4]
push str.__s___s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1ab4]
push 0xa
push eax
call fcn.0040203d
add esp, 0x18
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x1076]
mov word [ebp - 0x1078], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push str.ThirdPart
push dword [ebp - 4]
call esi
cmp dword [ebp - 4], ebx
je 0x40184c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
lea ecx, [ebp - 4]
call fcn.004024bc
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401886
push dword [ebp + 8]
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x401886
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa60]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x4018e9
push 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
push 0x80000002
lea ecx, [ebp - 4]
mov word [esi], bx
call fcn.004024bc
test eax, eax
jne 0x4018e9
add esi, 2
push esi
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], ebx
je 0x4018e9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
mov esi, str..lnk
lea eax, [ebp - 0x240]
push esi
push dword [0x404a74]
push ebx
push eax
call fcn.00401356
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
test eax, eax
je 0x401918
lea eax, [ebp - 0x240]
push eax
call edi
push esi
lea eax, [ebp - 0x240]
push dword [0x404a74]
push 2
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x40193d
lea eax, [ebp - 0x240]
push eax
call edi
push str..url
lea eax, [ebp - 0x240]
push dword [0x404a80]
push ebx
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401965
lea eax, [ebp - 0x240]
push eax
call edi
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x448]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x3f4]
push dword [0x404a74]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x448]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 0x1a
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x4019c3
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, 0x81
xor eax, eax
mov ecx, edx
lea edi, [ebp - 0xe6e]
mov word [ebp - 0xe70], bx
mov word [ebp - 0x1280], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x127e]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x4000000
lea eax, [ebp - 0xe70]
push esi
push eax
push dword [0x404a74]
call edi
pop ecx
inc eax
push eax
push dword [0x404a74]
call fcn.00401146
lea eax, [ebp - 0xe70]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.00401356
add esp, 0x24
test eax, eax
je 0x401a4d
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0xe70]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 2
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401a7b
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x4000000
lea eax, [ebp - 0x1280]
push esi
push eax
push dword [0x404a84]
call edi
pop ecx
inc eax
push eax
push dword [0x404a84]
call fcn.00401146
lea eax, [ebp - 0x1280]
push str..url
push eax
lea eax, [ebp - 0x240]
push ebx
push eax
call fcn.00401356
add esp, 0x24
test eax, eax
je 0x401acb
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch_
pop ecx
lea edi, [ebp - 0x1690]
rep movsd dword es:[edi], dword [esi]
push 0x6d
xor eax, eax
pop ecx
lea edi, [ebp - 0x163c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0x1690]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1690]
push str..lnk
push eax
lea eax, [ebp - 0x240]
push 0x1a
push eax
call fcn.00401356
add esp, 0x10
test eax, eax
je 0x401b2a
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x448]
push 0x404744
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [ebp + eax*2 - 0x448]
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 8]
push dword [eax + 0x404298]
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.004011a4
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x38
pop ecx
jb 0x401b69
mov dword [ebp + 8], ebx
mov eax, dword [ebp + 8]
push dword [eax + 0x404280]
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
add dword [ebp + 8], 4
cmp dword [ebp + 8], 0x18
pop ecx
jb 0x401b8f
push dword [0x404a74]
lea eax, [ebp - 0x2690]
push dword [0x404a78]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x38]
call fcn.00401eec
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp + 8], eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push 0x4049f0
call fcn.0040242e
push ebx
push 0x402201
push dword [ebp + 8]
push 0x65
push dword [0x4049f8]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [ebp - 0x1c], ebx
jne 0x401c4d
push str.ttplayer.xml
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.PlayList
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
mov dword [esp], str.Skin
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x401c7d
push str.Lyrics
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
mov dword [esp], str.CDDB
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
pop ecx
cmp dword [ebp - 0x14], ebx
jne 0x401c97
push str.Cache
push edi
call esi
lea eax, [ebp - 0x448]
push eax
call fcn.00401267
pop ecx
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp word [ebp - 0x1078], bx
je 0x401d77
lea eax, [ebp - 0x650]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x650]
push 0x404744
push eax
call esi
lea eax, [ebp - 0x1078]
push eax
lea eax, [ebp - 0x650]
push eax
call esi
lea eax, [ebp - 0x650]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp - 4]
call fcn.004024bc
test eax, eax
jne 0x401d77
mov ecx, 0x81
lea edi, [ebp - 0x856]
mov word [ebp - 0x858], bx
mov dword [ebp + 8], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp + 8]
xor esi, esi
push eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push str.UninstallString
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x401d66
cmp dword [ebp - 8], 1
jne 0x401d66
mov esi, dword [ebp + 8]
xor eax, eax
shr esi, 1
cmp eax, ebx
jne 0x401d66
cmp esi, ebx
je 0x401d66
lea eax, [ebp - 0x858]
push 0xa
push eax
call fcn.0040203d
pop ecx
pop ecx
cmp dword [ebp - 4], ebx
je 0x401d85
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
je 0x401d85
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x401ee7
mov edi, dword [str.TTPlayer]
lea eax, [ebp - 0x1488]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1488]
push 0x404744
push eax
call esi
lea eax, [ebp - 0x1488]
push edi
push eax
call esi
lea eax, [ebp - 0x1488]
push 0x2001f
push eax
push 0x80000002
lea ecx, [ebp + 8]
mov dword [ebp + 8], ebx
call fcn.004024bc
test eax, eax
je 0x401e0b
push 0x10
push 0x404078
push dword [0x4049e0]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x401746
push dword [ebp + 8]
jmp 0x401740
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x856]
mov word [ebp - 0x858], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.DisplayName
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov edi, 0x404078
jne 0x401eb8
cmp dword [ebp - 0xc], 1
jne 0x401eb8
xor eax, eax
cmp eax, ebx
jne 0x401eb8
lea eax, [ebp - 0x858]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x4049d8]
push edi
call esi
lea eax, [ebp - 0x858]
push eax
lea eax, [ebp - 0x1e90]
push dword [0x4049e4]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1e90]
push 0x34
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x401eb8
cmp dword [ebp + 8], ebx
je 0x401d85
push dword [ebp + 8]
jmp 0x401d7f
push dword [ebp - 0x10]
call fcn.00401393
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x401ed7
push 0x10
push edi
push dword [0x4049e0]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp + 8], ebx
je 0x401ee5
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret