Function at 0x4013d0
Capabilities:
Create directory
Delete registry key
Get common file path
Query or enumerate registry value
Terminate process

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
call fcn.00409050
call fcn.00408660
push 0x41e7cc
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
mov edi, dword [esp + 0x64]
push edi
push str.Main_:_Install_Type__s
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x1c
push 0
push str.c:zv
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, str._UNINSTALLS
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x401457
test cl, cl
je 0x401453
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x401457
add eax, 2
add esi, 2
test cl, cl
jne 0x40142f
xor eax, eax
jmp 0x40145c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40155a
push str._AUTO
push edi
call fcn.00418fc0
add esp, 8
test eax, eax
je 0x40155a
call fcn.004083d0
test eax, eax
jne 0x40155a
push str.Main_:User_not_LOG_IN_to_Administrator_Account
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0xc
mov esi, str._UNINSTALL
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4014d2
test cl, cl
je 0x4014ce
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4014d2
add eax, 2
add esi, 2
test cl, cl
jne 0x4014aa
xor eax, eax
jmp 0x4014d7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401518
push edi
push str.Main_:Install_Type___s_:_Not_LOG_IN_to_Administrator_Account
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x10
push 0
push str.NPSetup_:_Limited_user_warning__
push str.Please_LOG_IN_to_Administrator_Account___Run_As_Administrator_to_Uninstall_NPAV____
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call fcn.004090c0
push 0
call fcn.0040d8b0
push 4
push str.NPSetup_:_Limited_user_warning__
push str.Please_LOG_IN_to_Administrator_Account___Run_As_Administrator_n_n_t_tAbort_NPAV_Setup_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40155a
push edi
push str.Main_:Install_Type___s_:_Setup_aborting__user_Not_LOG_IN_to_Administrator_Account
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x10
call fcn.004090c0
push 0
call fcn.0040d8b0
mov edi, 0x42410c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x4238c4
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov edi, 0x4238c4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x4015bd
push 0x104
push 0x4238c4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x4238c4
call fcn.0040d840
add esp, 8
test eax, eax
je 0x4015bd
mov byte [eax], 0
mov ecx, dword [esp + 0x50]
push 0x104
push 0x423ad0
mov dword [0x4240b0], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
push 0x423e9c
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401658
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push 0x4239cc
push 0
push 0
push str.ProgramFilesDir
push ecx
mov dword [esp + 0x2c], 0x104
call ebp
mov edx, dword [esp + 0x10]
push edx
call edi
push 0x4239cc
push str.Main_:_HKLM_ProgramFilesDir___s
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x10
mov eax, dword [esp + 0x58]
mov esi, str._UNINSTALL
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x401685
test cl, cl
je 0x401681
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x401685
add eax, 2
add esi, 2
test cl, cl
jne 0x401661
xor eax, eax
jmp 0x40168a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x401789
lea eax, [esp + 0x10]
push eax
push str.SoftwareMessage_LabsNet_ProtectorConfig
push 0x80000002
call ebx
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
jne 0x4016ef
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x58]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0
push str.ShieldP
push eax
mov dword [esp + 0x70], 0x64
call ebp
test eax, eax
jne 0x4016ef
mov ecx, dword [esp + 0x10]
push ecx
call edi
push 0
push 0x408d60
mov edx, dword [esp + 0x58]
push 0
push 0x88
push edx
call esi
push 0x44
push str.NP_Uninstall_Wizard
push str.Are_you_sure_to_uninstall_Net_Protector_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
jne 0x401733
push str.Main_:UnInstallation_Cancelled
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x10
push str.Main_:Uninstallation_Started...
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
mov eax, dword [esp + 0x5c]
add esp, 0xc
push 0
push 0x406a70
push 0
push 0x72
push eax
call esi
push str.Main_:Uinstallation_DONE
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x10
mov edi, dword [esp + 0x58]
mov esi, str._UNINSTALLS
mov eax, edi
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4017bc
test cl, cl
je 0x4017b8
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4017bc
add eax, 2
add esi, 2
test cl, cl
jne 0x401794
xor eax, eax
jmp 0x4017c1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40182b
push edi
push str.Main_:Install_Type___s_Silent_uninstallation_starts...
push 0x423bf0
mov dword [0x424108], 1
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
mov eax, dword [esp + 0x60]
add esp, 0x10
push 0
push 0x406a70
push 0
push 0x72
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push edi
push str.Main_:Install_Type___s_Silent_uninstallation_finished
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 0x10
push str._AUTO
push edi
call fcn.00418fc0
add esp, 8
test eax, eax
jne 0x401864
push edi
push str.Main_:Install_Type___s_Silent_Installation...
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
add esp, 0x10
mov dword [0x424104], 1
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SYSTEMCurrentControlSetServicesZeroVProtect
push 0x80000002
call esi
push str.SYSTEMCurrentControlSetServicesZVONLINE
push 0x80000002
call esi
push str.SYSTEMCurrentControlSetServicesZVRegMon
push 0x80000002
call esi
push str.SYSTEMCurrentControlSetServicesSFilter
push 0x80000002
call esi
push edi
push str.Main_:Install_Type___s_Installation...
push 0x423bf0
call fcn.0040da30
push 0x423bf0
call fcn.00408aa0
mov ecx, dword [esp + 0x60]
add esp, 0x10
push 0
push 0x405b70
push 0
push 0x6e
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret 0x10